Edit tour

Windows Analysis Report
Fortexternal.exe

Overview

General Information

Sample name:	Fortexternal.exe
Analysis ID:	1565319
MD5:	9ea1cba0f5612a501df02b77bad76b1b
SHA1:	0271a7fbe4bc14e3e9da7f86509b56689f09fad6
SHA256:	bff256cd9e1eba31a2773edda9c514a6b544dea0b0accc52054a77c0f9117bef
Tags:	exeuser-aachum
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Accesses Audio hardware information via COM

Contain functionality to detect virtual machines

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Found many strings related to Crypto-Wallets (likely being stolen)

Locky time evasion found (measures execution of CloseHandle and GetProcessHeap)

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (mutex check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate device drivers

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Fortexternal.exe (PID: 1164 cmdline: "C:\Users\user\Desktop\Fortexternal.exe" MD5: 9EA1CBA0F5612A501DF02B77BAD76B1B)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Fortexternal.exe PID: 1164	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Fortexternal.exe.18cd0a8a0c0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T16:04:00.901494+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	104.26.9.59	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Fortexternal.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Fortexternal.exe

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Fortexternal.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_0000018CD0A05B00 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,CryptUnprotectData,

0_2_0000018CD0A05B00

Source: unknown

HTTPS traffic detected: 104.26.9.59:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: Fortexternal.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: 4~C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb=55GCTL source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_0000018CD09E44B3 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileA,type_info::_name_internal_method,type_info::_name_internal_method,		0_2_0000018CD09E44B3
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_0000018CD0A7694C FindFirstFileExW,		0_2_0000018CD0A7694C

Source: Joe Sandbox View

IP Address: 104.26.9.59 104.26.9.59

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49704 -> 104.26.9.59:443

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43Host: api.myip.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43Host: api.myip.com

Source: global traffic

DNS traffic detected: DNS query: api.myip.com

Source: Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4472768495.0000018CD2150000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4470519625.0000018CCBC0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: Fortexternal.exe, 00000000.00000002.4470519625.0000018CCBC0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/a
Source: Fortexternal.exe, 00000000.00000002.4471755752.0000018CD0654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/x~
Source: Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage(Hold
Source: Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 104.26.9.59:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9CF4970 OpenClipboard,MultiByteToWideChar,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,CloseClipboard,

0_2_00007FF7B9CF4970

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9CF4970 OpenClipboard,MultiByteToWideChar,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,CloseClipboard,

0_2_00007FF7B9CF4970

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9CF4820 OpenClipboard,GetClipboardData,CloseClipboard,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

0_2_00007FF7B9CF4820

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D22F30 GetClientRect,QueryPerformanceCounter,GetForegroundWindow,ClientToScreen,SetCursorPos,GetCursorPos,ScreenToClient,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_00007FF7B9D22F30
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D23902 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_00007FF7B9D23902

System Summary

PE file contains section with special chars

Source: Fortexternal.exe	Static PE information: section name: ",aR
Source: Fortexternal.exe	Static PE information: section name: b>bbb
Source: Fortexternal.exe	Static PE information: section name: b&b+

Source: C:\Users\user\Desktop\Fortexternal.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D3F8A0 PostQuitMessage,GetWindowRect,SetWindowPos,NtdllDefWindowProc_A,

0_2_00007FF7B9D3F8A0

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D21EF0	0_2_00007FF7B9D21EF0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D2C0A0	0_2_00007FF7B9D2C0A0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D22F30	0_2_00007FF7B9D22F30
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D4030C	0_2_00007FF7B9D4030C
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D21660	0_2_00007FF7B9D21660
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D228E0	0_2_00007FF7B9D228E0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CFAAF0	0_2_00007FF7B9CFAAF0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CE9AC0	0_2_00007FF7B9CE9AC0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D27A80	0_2_00007FF7B9D27A80
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CDCA10	0_2_00007FF7B9CDCA10
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D139E0	0_2_00007FF7B9D139E0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D0F9D0	0_2_00007FF7B9D0F9D0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CD8990	0_2_00007FF7B9CD8990
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CFD940	0_2_00007FF7B9CFD940
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D18C90	0_2_00007FF7B9D18C90
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CE0BB0	0_2_00007FF7B9CE0BB0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CFEBC0	0_2_00007FF7B9CFEBC0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D1EF10	0_2_00007FF7B9D1EF10
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CFEE70	0_2_00007FF7B9CFEE70
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CF1E50	0_2_00007FF7B9CF1E50
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CEEE50	0_2_00007FF7B9CEEE50
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CFDDE0	0_2_00007FF7B9CFDDE0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CF0DC0	0_2_00007FF7B9CF0DC0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CF80F0	0_2_00007FF7B9CF80F0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CD9F90	0_2_00007FF7B9CD9F90
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D1CF70	0_2_00007FF7B9D1CF70
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CE72F0	0_2_00007FF7B9CE72F0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CFC2B0	0_2_00007FF7B9CFC2B0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D26290	0_2_00007FF7B9D26290
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CE7220	0_2_00007FF7B9CE7220
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CF0220	0_2_00007FF7B9CF0220
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D051F0	0_2_00007FF7B9D051F0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D211B0	0_2_00007FF7B9D211B0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D10130	0_2_00007FF7B9D10130
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D0C3F0	0_2_00007FF7B9D0C3F0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CDC330	0_2_00007FF7B9CDC330
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D1E680	0_2_00007FF7B9D1E680
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CE8630	0_2_00007FF7B9CE8630
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D15600	0_2_00007FF7B9D15600
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D125E0	0_2_00007FF7B9D125E0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D085E0	0_2_00007FF7B9D085E0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CF2600	0_2_00007FF7B9CF2600
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D23902	0_2_00007FF7B9D23902
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D6F900	0_2_00007FF7B9D6F900
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CFE910	0_2_00007FF7B9CFE910
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D0A8E0	0_2_00007FF7B9D0A8E0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CD98B0	0_2_00007FF7B9CD98B0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CF9890	0_2_00007FF7B9CF9890
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9CE27B0	0_2_00007FF7B9CE27B0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D097C0	0_2_00007FF7B9D097C0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D1F740	0_2_00007FF7B9D1F740
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D00750	0_2_00007FF7B9D00750
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_0000018CD0A3B080	0_2_0000018CD0A3B080
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_0000018CD0A769C0	0_2_0000018CD0A769C0

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: String function: 00007FF7B9CEB1B0 appears 36 times
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: String function: 00007FF7B9D2B9D0 appears 54 times
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: String function: 00007FF7B9D47590 appears 40 times
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: String function: 00007FF7B9D7A838 appears 866 times
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: String function: 00007FF7B9D43350 appears 1052 times
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: String function: 00007FF7B9D28E60 appears 49 times
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: String function: 00007FF7B9D4B500 appears 49 times
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: String function: 00007FF7B9CF4B40 appears 40 times

Source: Fortexternal.exe	Static PE information: Resource name: None type: DOS executable (COM)
Source: Fortexternal.exe	Static PE information: Resource name: None type: DOS executable (COM)

Source: Fortexternal.exe

Static PE information: Section: b>bbb ZLIB complexity 0.9987748329817159

Source: classification engine

Classification label: mal100.spyw.expl.evad.winEXE@1/1@1/1

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D27A80 GetLastError,FormatMessageW,LocalFree,GetLastError,FormatMessageW,LocalFree,00007FF8C0844BD0,GetLastError,GetLastError,FormatMessageW,LocalFree,GetLastError,FormatMessageW,LocalFree,GetLastError,GetLastError,FormatMessageW,LocalFree,

0_2_00007FF7B9D27A80

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D292C0 GetDiskFreeSpaceExW,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetPhysicallyInstalledSystemMemory,

0_2_00007FF7B9D292C0

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_0000018CD09D6BC0 std::_Fac_node::_Fac_node,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,

0_2_0000018CD09D6BC0

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D2A000 CoInitialize,CoCreateInstance,CoCreateInstance,

0_2_00007FF7B9D2A000

Source: C:\Users\user\Desktop\Fortexternal.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\FQQLHUPB.htm

Jump to behavior

Source: C:\Users\user\Desktop\Fortexternal.exe	Mutant created: \Sessions\1\BaseNamedObjects\MicrosoftVirtualPC7UserServiceMakeSureWe'reTheOnlyOneMutex
Source: C:\Users\user\Desktop\Fortexternal.exe	Mutant created: \Sessions\1\BaseNamedObjects\Frz_State
Source: C:\Users\user\Desktop\Fortexternal.exe	Mutant created: \Sessions\1\BaseNamedObjects\Sandboxie_SingleInstanceMutex_Control
Source: C:\Users\user\Desktop\Fortexternal.exe	Mutant created: \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_Mutex1

Source: C:\Users\user\Desktop\Fortexternal.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Fortexternal.exe, 00000000.00000003.2880322518.0000018CD223F000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2402006304.0000018CD223F000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2104062133.0000018CD2240000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2211597592.0000018CD223F000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4472934292.0000018CD223F000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2143307795.0000018CD223F000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2274864289.0000018CD223F000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2268550621.0000018CD223F000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2198698411.0000018CD223F000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.3020733876.0000018CD223F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE visits(id INTEGER PRIMARY KEY AUTOINCREMENT,url INTEGER NOT NULL,visit_time INTEGER NOT NULL,from_visit INTEGER,external_referrer_url TEXT,transition INTEGER DEFAULT 0 NOT NULL,segment_id INTEGER,visit_duration INTEGER DEFAULT 0 NOT NULL,incremented_omnibox_typed_score BOOLEAN DEFAULT FALSE NOT NULL,opener_visit INTEGER,originator_cache_guid TEXT,originator_visit_id INTEGER,originator_from_visit INTEGER,originator_opener_visit INTEGER,is_known_to_sync BOOLEAN DEFAULT FALSE NOT NULL,consider_for_ntp_most_visited BOOLEAN DEFAULT FALSE NOT NULL);z
Source: Fortexternal.exe, 00000000.00000002.4472895318.0000018CD218F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE server_card_metadata (id VARCHAR NOT NULL, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR);
Source: Fortexternal.exe, 00000000.00000002.4474637994.0000018CD2537000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2095796153.0000018CD2410000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.3011985426.0000018CD23F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Fortexternal.exe

ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: quartz.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: xinput1_4.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Fortexternal.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Fortexternal.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Fortexternal.exe

Static file information: File size 1151019 > 1048576

Source: Fortexternal.exe

Static PE information: Raw size of b>bbb is bigger than: 0x100000 < 0x10aa00

Source: Fortexternal.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: 4~C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb=55GCTL source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Fortexternal.exe

Unpacked PE file: 0.2.Fortexternal.exe.7ff7b9cd0000.1.unpack ",aR:EW;b>bbb:EW;Unknown_Section2:W; vs ",aR:ER;b>bbb:ER;Unknown_Section2:W;

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D223A0 QueryPerformanceFrequency,QueryPerformanceCounter,GetKeyboardLayout,GetLocaleInfoA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_00007FF7B9D223A0

Source: initial sample

Static PE information: section where entry point is pointing to: b>bbb

Source: Fortexternal.exe	Static PE information: section name: ",aR
Source: Fortexternal.exe	Static PE information: section name: b>bbb
Source: Fortexternal.exe	Static PE information: section name: b&b+

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_0000018CD0A17374 push ecx; iretd	0_2_0000018CD0A17375
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_0000018CD0A1760B push cs; ret	0_2_0000018CD0A1761C
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_0000018CD0A179A1 pushfd ; ret	0_2_0000018CD0A179A2

Source: Fortexternal.exe

Static PE information: section name: b>bbb entropy: 7.999721295159668

Source: C:\Users\user\Desktop\Fortexternal.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Accesses Audio hardware information via COM

Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\TreatAs	Jump to behavior

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: VBoxSF VBoxGuest VBoxMouse	0_2_00007FF7B9D3CC55
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: VBOX_DEFAULT: disk = VBOX_DEFAULT: ram = VBOX_DEFAULT: less than windows 10 detected VBOX_DEFAULT: windows 10 detected VBOX_DEFAULT: windows 11 detected VBOX_DEFAULT: returned false due to lack of precondition spec comparisons	0_2_00007FF7B9D292C0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: VBoxTrayToolWndClass VBoxTrayToolWnd	0_2_00007FF7B9D298D0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: VMware- VMware VMware Fusion	0_2_00007FF7B9D3C810
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: vmware VMware	0_2_00007FF7B9D3CA00
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: HKLM\HARDWARE\ACPI\DSDT\VBOX__ HKLM\HARDWARE\ACPI\FADT\VBOX__ HKLM\HARDWARE\ACPI\RSDT\VBOX__ HKLM\SYSTEM\ControlSet001\Services\VBoxGuest HKLM\SYSTEM\ControlSet001\Services\VBoxMouse HKLM\SYSTEM\ControlSet001\Services\VBoxService HKLM\SYSTEM\ControlSet001\Services\VBoxService HKLM\SYSTEM\ControlSet001\Services\VBoxSF HKLM\SYSTEM\ControlSet001\Services\VBoxVideo VMware HKCU\SOFTWARE\VMware, Inc.\VMware Tools VMware HKLM\SOFTWARE\VMware, Inc.\VMware Tools VMware VMware VMware HKLM\SYSTEM\ControlSet001\Services\VMTools VMware VMware HKLM\SYSTEM\ControlSet001\Services\vmware VMware VMware VMware HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_IDE_CD* VMware HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_SATA_CD* VMware HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_IDE_Hard_Drive* VMware HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_SATA_Hard_Drive* VMware	0_2_00007FF7B9D289A0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: BOCHS_CPU: neither AMD or Intel detected, returned false BOCHS_CPU: technique 1 found Bochs BOCHS_CPU: technique 2 found Bochs	0_2_00007FF7B9D2AD10
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: qemu-ga.exe qemu-ga.exe QEMU QEMU	0_2_00007FF7B9D2BC60
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: QEMU Virtual CPU QEMU Virtual CPU QEMU QEMU	0_2_00007FF7B9D2AC70
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: QEMU QEMU QEMU_HDD: model = QEMU_HDD: model =	0_2_00007FF7B9D3D0B0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: C:\windows\System32\Drivers\VMToolsHook.dll C:\windows\System32\Drivers\VBoxMouse.sys C:\windows\System32\Drivers\VBoxGuest.sys C:\windows\System32\Drivers\VBoxSF.sys C:\windows\System32\Drivers\VBoxVideo.sys C:\windows\System32\vboxoglpackspu.dll C:\windows\System32\vboxoglpassthroughspu.dll C:\windows\System32\vboxservice.exe C:\windows\System32\vboxservice.exe C:\windows\System32\vboxoglcrutil.dll C:\windows\System32\vboxdisp.dll C:\windows\System32\vboxhook.dll C:\windows\System32\vboxmrxnp.dll C:\windows\System32\vboxogl.dll C:\windows\System32\vboxtray.exe C:\windows\System32\VBoxControl.exe C:\windows\System32\vboxoglerrorspu.dll C:\windows\System32\vboxoglfeedbackspu.dll c:\windows\system32\vboxoglarrayspu.dll vbox VM_FILES: vmware score: VM_FILES: vbox score: VMware	0_2_00007FF7B9D29000
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: qemu qemu vbox vmware QEMU QEMU	0_2_00007FF7B9D27FA0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: BOCHS Bochs Bochs QEMU QEMU VBOX VMware VMWARE vmware tools VMware* VMware SVGA*	0_2_00007FF7B9D2B220
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: qemu-ga qemu-ga QEMU QEMU	0_2_00007FF7B9D2A200
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: vboxservice.exe vboxservice.exe vboxtray.exe	0_2_00007FF7B9D2A350
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: vmware VMware	0_2_00007FF7B9D28880
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: VMwareVMware VBoxVBoxVBox VMware QEMU QEMU	0_2_00007FF7B9D25760
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: SOFTWARE\VMware, Inc.\VMware Tools VMWARE_REG: result = VMware	0_2_00007FF7B9D28770

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D2AAD0

0_2_00007FF7B9D2AAD0

Locky time evasion found (measures execution of CloseHandle and GetProcessHeap)

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D282B0 GetProcessHeap,CloseHandle,

0_2_00007FF7B9D282B0

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Fortexternal.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (mutex check)

Source: C:\Users\user\Desktop\Fortexternal.exe	Mutex created: \Sessions\1\BaseNamedObjects\Sandboxie_SingleInstanceMutex_Control			Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Mutex created: \Sessions\1\BaseNamedObjects\Frz_State			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DIR_WATCH.DLL
Source: Fortexternal.exe	Binary or memory string: JOEBOXSERVER.EXE
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: QEMU-GA.EXE
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMUSRVC.EXE
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: API_LOG.DLL
Source: Fortexternal.exe	Binary or memory string: JOEBOXCONTROL.EXE
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: XENSERVICE.EXE

Source: C:\Users\user\Desktop\Fortexternal.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mssmbios\Data name: SMBiosData			Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mssmbios\Data name: AcpiData			Jump to behavior

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D2AAD0 rdtsc

0_2_00007FF7B9D2AAD0

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: GetCursorPos,Sleep,GetCursorPos,

0_2_00007FF7B9D286C0

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: K32EnumDeviceDrivers,K32GetDeviceDriverBaseNameA,00007FF8C6125630,00007FF8C6125630,

0_2_00007FF7B9D3CC55

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: GetAdaptersInfo,		0_2_00007FF7B9D7A088
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: GetAdaptersInfo,00007FF8C610F020,GetAdaptersInfo,00007FF8C610F020,		0_2_00007FF7B9D283C0

Source: C:\Users\user\Desktop\Fortexternal.exe	Window / User API: threadDelayed 5385			Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	Window / User API: foregroundWindowGot 1632			Jump to behavior

Source: C:\Users\user\Desktop\Fortexternal.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-74047

Source: C:\Users\user\Desktop\Fortexternal.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_0000018CD09E44B3 Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileA,type_info::_name_internal_method,type_info::_name_internal_method,		0_2_0000018CD09E44B3
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_0000018CD0A7694C FindFirstFileExW,		0_2_0000018CD0A7694C

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D2C470 GetSystemInfo,

0_2_00007FF7B9D2C470

Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\Drivers\Vmmouse.sys
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxMouse
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HYPER_X: added Hyper-V artifact VM
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vmci
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VM_FILES: vmware score:
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: hyper-v
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SOFTWARE\Microsoft\VirtualMachine
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Hyper-V artifact (not an actual VM)
Source: Fortexternal.exe, 00000000.00000002.4472768495.0000018CD2150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxTrayToolWndClass
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vmdebug
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\msvmmouf
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware SVGA*
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\xenevtchn
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: c:\windows\system32\drivers\vpc-s3.sys
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SOFTWARE\VMware, Inc.\VMware Tools
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\Drivers\VMToolsHook.dll
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMUSrvc.exe
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\Drivers\VBoxMouse.sys
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ManufacturerSELECT * FROM Win32_BaseBoard. Error: Failed to open event log: Failed to query event log: EvtNext failed. Error: EvtRender failed. Error: VMID: qemukvmvirtualvboxvirtualboxmonitorhypervhypervisorhvisorparallelsvmwarematch = BRAND_KEYWORDS: matches:
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\VMMEMCTL
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\HARDWARE\ACPI\FADT\VBOX__
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vmware
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\HARDWARE\ACPI\DSDT\VBOX__
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: c:\windows\system32\drivers\prlmouse.sys
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\xennet6
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\HARDWARE\ACPI\RSDT\VBOX__
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vpc-s3
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: QEMU+KVM Hyper-V Enlightenment
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_IDE_CD*
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: c:\windows\system32\drivers\prleth.sys
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\vboxmrxnp.dll
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\xensvc
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\Drivers\vmhgfs.dll
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxSF
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vmware
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SOFTWARE\Microsoft\Hyper-V
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\vboxservice.exe
Source: Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsdvboxservicer
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_IDE_Hard_Drive*
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vmx86
Source: Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\xenvdb
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\VBoxSF
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: KVM Hyper-V Enlightenment
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\VBoxService
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\Drivers\VBoxSF.sys
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vmicheartbeat
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Microsoft Virtual PC/Hyper-V
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Xbox NanoVisor (Hyper-V)
Source: Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: c:\windows\system32\drivers\vmsrvc.sys
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\xennet
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxGuest
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: c:\windows\system32\drivers\prl_pv32.sys
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware*
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: QEMU Virtual CPU
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HYPER_X: added Hyper-V real VM
Source: Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: QEMU+KVM
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vmusrvc.exe
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: QEMU_HDD: model =
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtrayx64dbge
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_SATA_CD*
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: qemu-ga.exe
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware-
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: \\.\VBoxMiniRdrDN
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vmicexchange
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vmicshutdown
Source: Fortexternal.exe, 00000000.00000003.2087549124.0000018CD21C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2073909900.0000018CD21C0000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2090329014.0000018CD21C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2091902136.0000018CD21C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2092187920.0000018CD21C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4472934292.0000018CD21C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2093754124.0000018CD21C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\vboxtray.exe
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxTrayToolWnd
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWARE
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Microsoft Hyper-V
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\VBoxMouse
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKCU\SOFTWARE\VMware, Inc.\VMware Tools
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Microsoft Azure Hyper-V
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: NETTITUDE_VM_MEMORY: Hyper-V detected
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: qemu-ga
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWARE_REG: result =
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\Drivers\vmGuestLib.dll
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware ESX
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\VMTools
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMwareVMware
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vmsrvc.exe
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vboxservice.exe
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware Workstation
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vpcbus
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vboxtray.exe
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: c:\windows\system32\drivers\prlvideo.sys
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\Drivers\VBoxGuest.sys
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vmmouse
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_SATA_Hard_Drive*
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vmicvss
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vmware tools
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware GSX
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware Fusion
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware Express
Source: Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Fortexternal.exe, 00000000.00000003.2097449555.0000018CD252A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-gaVGAuthServicevmwaretrays
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\vpcuhub
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: c:\windows\system32\drivers\prlfs.sys
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMSrvc.exe
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\vboxhook.dll
Source: Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HKLM\SYSTEM\ControlSet001\Services\VBoxGuest
Source: Fortexternal.exe, 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: wiresharkvmwareuserf
Source: Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: C:\windows\System32\Drivers\VmGuestLibJava.dll

Source: C:\Users\user\Desktop\Fortexternal.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Fortexternal.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D2AAD0 rdtsc

0_2_00007FF7B9D2AAD0

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D7582C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7B9D7582C

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D223A0 QueryPerformanceFrequency,QueryPerformanceCounter,GetKeyboardLayout,GetLocaleInfoA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_00007FF7B9D223A0

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D282B0 GetProcessHeap,CloseHandle,

0_2_00007FF7B9D282B0

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D75A0C SetUnhandledExceptionFilter,	0_2_00007FF7B9D75A0C
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D7A1C0 SetUnhandledExceptionFilter,	0_2_00007FF7B9D7A1C0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: 0_2_00007FF7B9D7582C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7B9D7582C

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D28330 cpuid

0_2_00007FF7B9D28330

Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: QueryPerformanceFrequency,QueryPerformanceCounter,GetKeyboardLayout,GetLocaleInfoA,LoadLibraryA,GetProcAddress,GetProcAddress,	0_2_00007FF7B9D223A0
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: GetKeyboardLayout,GetLocaleInfoA,	0_2_00007FF7B9D23C5B
Source: C:\Users\user\Desktop\Fortexternal.exe	Code function: GetLocaleInfoA,	0_2_00007FF7B9D7A260

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D75AB8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7B9D75AB8

Source: C:\Users\user\Desktop\Fortexternal.exe

Code function: 0_2_00007FF7B9D28880 GetUserNameA,00007FF8C61AFA40,

0_2_00007FF7B9D28880

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Fortexternal.exe	String found in binary or memory: \Electrum\wallets
Source: Fortexternal.exe	String found in binary or memory: \ElectronCash\wallets
Source: Fortexternal.exe	String found in binary or memory: \com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: Fortexternal.exe	String found in binary or memory: \Exodus\exodus.wallet
Source: Fortexternal.exe	String found in binary or memory: \Ethereum\keystore
Source: Fortexternal.exe	String found in binary or memory: Exodus Web
Source: Fortexternal.exe	String found in binary or memory: \Ethereum\keystore
Source: Fortexternal.exe	String found in binary or memory: \Coinomi\Coinomi\wallets
Source: Fortexternal.exe	String found in binary or memory: \Ethereum\keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Fortexternal.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 0.2.Fortexternal.exe.18cd0a8a0c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Fortexternal.exe PID: 1164, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	3 Obfuscated Files or Information	1 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Software Packing	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	135 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Fortexternal.exe	13%	ReversingLabs
Fortexternal.exe	100%	Avira	HEUR/AGEN.1314582
Fortexternal.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.myip.com	104.26.9.59	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.myip.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage	Fortexternal.exe, Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	false	high
https://api.myip.com/x~	Fortexternal.exe, 00000000.00000002.4471755752.0000018CD0654000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage(Hold	Fortexternal.exe, 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp	false	high
https://www.ecosia.org/newtab/	Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.myip.com/a	Fortexternal.exe, 00000000.00000002.4470519625.0000018CCBC0F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	Fortexternal.exe, 00000000.00000003.2105850326.0000018CD25B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Fortexternal.exe, 00000000.00000003.3034655629.0000018CD242A000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD258B000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2098405327.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000002.4475737301.0000018CD2568000.00000004.00000020.00020000.00000000.sdmp, Fortexternal.exe, 00000000.00000003.2096279929.0000018CD24C3000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.9.59	api.myip.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565319
Start date and time:	2024-11-29 16:03:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Fortexternal.exe
Detection:	MAL
Classification:	mal100.spyw.expl.evad.winEXE@1/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 52 Number of non-executed functions: 134
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Fortexternal.exe

Simulations

Behavior and APIs

Time	Type	Description
10:04:37	API Interceptor	16851270x Sleep call for process: Fortexternal.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.9.59	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse
	ZoomInstaller.exe	Get hash	malicious	Unknown	Browse
	ZoomInstaller.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer	Browse
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	iBO7gzlZr3.exe	Get hash	malicious	LummaC	Browse
	5zFCjSBLvw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	FySc2FzpA8.exe	Get hash	malicious	Go Injector	Browse
	setup.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, RedLine, Stealc, Stealerium, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.myip.com	file.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	172.67.75.163
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	172.67.75.163
	file.exe	Get hash	malicious	Unknown	Browse	104.26.8.59
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse	104.26.9.59
	file.exe	Get hash	malicious	Ailurophile Stealer	Browse	104.26.8.59
	installer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	installer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	installer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	installer.exe	Get hash	malicious	Unknown	Browse	104.26.8.59

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://google.lk/url?q=ernie.grue@nationalmi.com&nationalmi.com&sa=t&url=amp/s/i--iy.s3.us-east-1.amazonaws.com/vocabulary.html#ZXJuaWUuZ3J1ZUBuYXRpb25hbG1pLmNvbQ==	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.170.85
	IMG_1205 #U2014 ThingLink.html	Get hash	malicious	Unknown	Browse	104.18.41.175
	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.170.85
	http://myhobbybuys.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://29112024red01kamcjduq.z33.web.core.windows.net	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	http://antena1.rtp.pt	Get hash	malicious	RATDispenser	Browse	104.22.62.150
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://herald-review.com/users/logout-success/?expire=1626371676&referer_url=http://209.159.152.50	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.9.59
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	104.26.9.59
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	104.26.9.59
	pPLD6OSn7O.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	pPLD6OSn7O.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	0b3SUiWz3y.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	ww7Oxm9pwx.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	file.exe	Get hash	malicious	Vidar	Browse	104.26.9.59
	0b3SUiWz3y.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	ww7Oxm9pwx.exe	Get hash	malicious	Unknown	Browse	104.26.9.59

Process:	C:\Users\user\Desktop\Fortexternal.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.3585198384225
Encrypted:	false
SSDEEP:	3:YMb1gXMlJ9eMfQxaNmGGL4:YMeX6uxaNmRL4
MD5:	E86153F34E01C5AED461F812D7472D86
SHA1:	CB4491FAC004B18059BA1BDDFE2CD5696CD94F87
SHA-256:	D174A4EFD5E9EAC12E0161D4C4A1D5C26122C4C5EA6A1BE49D7A277B535CB2DF
SHA-512:	CA8A07D9515808AC4331D1790F75C2A05672E299366DE0A0EE55698F8679B366428DFB18E8390FF034B58E3D0D05165F4C9EE8F7481B7509B51A18A84DF5F51B
Malicious:	false
Reputation:	low
Preview:	{"ip":"8.46.123.228","country":"United States","cc":"US"}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.941678120775294
TrID:	Win64 Executable GUI (202006/5) 93.51% Win64 Executable (generic) (12005/4) 5.56% DOS Executable Generic (2002/1) 0.93% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Fortexternal.exe
File size:	1'151'019 bytes
MD5:	9ea1cba0f5612a501df02b77bad76b1b
SHA1:	0271a7fbe4bc14e3e9da7f86509b56689f09fad6
SHA256:	bff256cd9e1eba31a2773edda9c514a6b544dea0b0accc52054a77c0f9117bef
SHA512:	775c53b20545aa1a1dda4d6dcf24bdbb1de92e75732eac0cc2ee881340deaaac2f86aff0252caf45e1fe4f98431e86bdc8bfea00f61960c13edf70a2276997cd
SSDEEP:	24576:9kTa+r26m0APvncJ7GkTAW7lBgZH66tR5nXNAApPZ735AAoP:WTa+r2n0yvn07GET3L6L5XNAcB3iA0
TLSH:	7135122FF7D47761D921C0B3CAEB8749B3306265C2359F5B09C54E5FA19A40A7A8BF20
File Content Preview:	MZ......................@..1.01.UPX!._0x001ae48.........................!..L.!This program cannot be run in DOS mode....$.......7.posl.<sl.<sl.<z..<gl.<8..=ql.<c..=ul.<c..=wl.<c..=yl.<c..=Zl.<8..=ol.<T.e<pl.<sl.<.m.<8..={l.<8..<rl.<8..=rl.<Richsl.<.......

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140571bf0
Entrypoint Section:	b>bbb
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6743617E [Sun Nov 24 17:25:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	28575fafb8c0c2a177285558e2945540

Entrypoint Preview

Instruction
push ebx
push esi
push edi
push ebp
dec eax
lea esi, dword ptr [FFEF6405h]
dec eax
lea edi, dword ptr [esi-00467000h]
push edi
mov eax, 0056F1A2h
push eax
dec eax
mov ecx, esp
dec eax
mov edx, edi
dec eax
mov edi, esi
mov esi, 00109BECh
push ebp
dec eax
mov ebp, esp
inc esp
mov ecx, dword ptr [ecx]
dec ecx
mov eax, edx
dec eax
mov edx, esi
dec eax
lea esi, dword ptr [edi+02h]
push esi
mov al, byte ptr [edi]
dec edx
mov cl, al
and al, 07h
shr cl, 00000003h
dec eax
mov ebx, FFFFFD00h
dec eax
shl ebx, cl
mov cl, al
dec eax
lea ebx, dword ptr [esp+ebx*2-00000E78h]
dec eax
and ebx, FFFFFFC0h
push 00000000h
dec eax
cmp esp, ebx
jne 00007FC800D6A6EBh
push ebx
dec eax
lea edi, dword ptr [ebx+08h]
mov cl, byte ptr [esi-01h]
dec edx
mov byte ptr [edi+02h], al
mov al, cl
shr cl, 00000004h
mov byte ptr [edi+01h], cl
and al, 0Fh
mov byte ptr [edi], al
dec eax
lea ecx, dword ptr [edi-04h]
push eax
inc ecx
push edi
dec eax
lea eax, dword ptr [edi+04h]
inc ebp
xor edi, edi
inc ecx
push esi
inc ecx
mov esi, 00000001h
inc ecx
push ebp
inc ebp
xor ebp, ebp
inc ecx
push esp
push ebp
push ebx
dec eax
sub esp, 48h
dec eax
mov dword ptr [esp+38h], ecx
dec eax
mov dword ptr [esp+20h], eax
mov eax, 00000001h
dec eax
mov dword ptr [esp+40h], esi
dec esp
mov dword ptr [esp+30h], eax
mov ebx, eax
inc esp
mov dword ptr [esp+2Ch], ecx
movzx ecx, byte ptr [edi+02h]
shl ebx, cl
mov ecx, ebx

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[IMP] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5808f4	0x700	b&b+
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x573000	0xd8f4	b&b+
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2af000	0x6fa8	",aR
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x580ff4	0x20	b&b+
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5727e0	0x28	b>bbb
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x572810	0x140	b>bbb
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
",aR	0x1000	0x467000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
b>bbb	0x468000	0x10b000	0x10aa00	4159b5d554a59287fc68dd9009325fd8	False	0.9987748329817159	ARC archive data, packed	7.999721295159668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
b&b+	0x573000	0xf000	0xe200	d7bd3f996c1e76bb402bf61f4d2efad1	False	0.26581512721238937	data	3.949481025316456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
None	0x580738	0x2e	data			1.108695652173913
RT_RCDATA	0x2c3764	0x3201	empty			0
RT_RCDATA	0x2c6968	0x3201	empty			0
RT_RCDATA	0x2c9b6c	0x3201	empty			0
RT_RCDATA	0x2ccd70	0x3201	empty			0
RT_RCDATA	0x2cff74	0x3201	empty			0
RT_RCDATA	0x2d3178	0x3201	empty			0
RT_RCDATA	0x2d637c	0x3201	empty			0
RT_RCDATA	0x2d9580	0x3201	empty			0
RT_RCDATA	0x2dc784	0x3201	empty			0
RT_RCDATA	0x2df988	0x3201	empty			0
RT_RCDATA	0x2e2b8c	0x3201	empty			0
RT_RCDATA	0x2e5d90	0x3201	empty			0
RT_RCDATA	0x2e8f94	0x3201	empty			0
RT_RCDATA	0x2ec198	0x3201	empty			0
RT_RCDATA	0x2ef39c	0x3201	empty			0
RT_RCDATA	0x2f25a0	0x3201	empty			0
RT_RCDATA	0x2f57a4	0x3201	empty			0
RT_RCDATA	0x2f89a8	0x3201	empty			0
RT_RCDATA	0x2fbbac	0x3201	empty			0
RT_RCDATA	0x2fedb0	0x3201	empty			0
RT_RCDATA	0x301fb4	0x3201	empty			0
RT_RCDATA	0x3051b8	0x3201	empty			0
RT_RCDATA	0x3083bc	0x74	empty			0
RT_RCDATA	0x308430	0x3201	empty			0
RT_RCDATA	0x30b634	0x3201	empty			0
RT_RCDATA	0x30e838	0x3201	empty			0
RT_RCDATA	0x311a3c	0x3201	empty			0
RT_RCDATA	0x314c40	0x687	empty			0
RT_RCDATA	0x3152c8	0xf	empty			0
RT_RCDATA	0x3152d8	0x3201	empty			0
RT_RCDATA	0x3184dc	0xe316a	empty			0
RT_RCDATA	0x3fb648	0xe598	empty			0
RT_RCDATA	0x409be0	0x3201	empty			0
RT_RCDATA	0x40cde4	0x23	empty			0
RT_RCDATA	0x40ce08	0x55	empty			0
RT_RCDATA	0x40ce60	0x3201	empty			0
RT_RCDATA	0x410064	0x9e	empty			0
RT_RCDATA	0x410104	0x1f2	empty			0
RT_RCDATA	0x4102f8	0x3201	empty			0
RT_RCDATA	0x4134fc	0x3201	empty			0
RT_RCDATA	0x416700	0x3201	empty			0
RT_RCDATA	0x419904	0x3201	empty			0
RT_RCDATA	0x41cb08	0x7d	empty			0
RT_RCDATA	0x41cb88	0x7d	empty			0
RT_RCDATA	0x41cc08	0x7d	empty			0
RT_RCDATA	0x41cc88	0x7d	empty			0
RT_RCDATA	0x41cd08	0x7d	empty			0
RT_RCDATA	0x41cd88	0x7d	empty			0
RT_RCDATA	0x41ce08	0x7d	empty			0
RT_RCDATA	0x41ce88	0x7d	empty			0
RT_RCDATA	0x41cf08	0x7d	empty			0
RT_RCDATA	0x41cf88	0x7d	empty			0
RT_RCDATA	0x41d008	0x7d	empty			0
RT_RCDATA	0x41d088	0x7d	empty			0
RT_RCDATA	0x41d108	0x7d	empty			0
RT_RCDATA	0x41d188	0x7d	empty			0
RT_RCDATA	0x41d208	0x7d	empty			0
RT_RCDATA	0x41d288	0x7d	empty			0
RT_RCDATA	0x41d308	0x7d	empty			0
RT_RCDATA	0x41d388	0x7d	empty			0
RT_RCDATA	0x41d408	0x7d	empty			0
RT_RCDATA	0x41d488	0x7d	empty			0
RT_RCDATA	0x41d508	0x7d	empty			0
RT_RCDATA	0x41d588	0x7d	empty			0
RT_RCDATA	0x41d608	0x3201	empty			0
RT_RCDATA	0x42080c	0x3201	empty			0
RT_RCDATA	0x423a10	0x3201	empty			0
RT_RCDATA	0x426c14	0x3201	empty			0
RT_RCDATA	0x429e18	0x3201	empty			0
RT_RCDATA	0x42d01c	0x3201	empty			0
RT_RCDATA	0x430220	0x3201	empty			0
RT_RCDATA	0x433424	0x3201	empty			0
RT_RCDATA	0x436628	0x3201	empty			0
RT_RCDATA	0x43982c	0x3201	empty			0
RT_RCDATA	0x43ca30	0x3201	empty			0
RT_RCDATA	0x43fc34	0x3201	empty			0
RT_RCDATA	0x442e38	0x3201	empty			0
RT_RCDATA	0x44603c	0x3201	empty			0
RT_RCDATA	0x449240	0x3201	empty			0
RT_RCDATA	0x44c444	0x3201	empty			0
RT_RCDATA	0x44f648	0x3201	empty			0
RT_RCDATA	0x45284c	0x3201	empty			0
RT_RCDATA	0x455a50	0x3201	empty			0
RT_RCDATA	0x458c54	0x3201	empty			0
RT_RCDATA	0x45be58	0x3201	empty			0
RT_RCDATA	0x45f05c	0x3201	empty			0
RT_RCDATA	0x462260	0x3201	empty			0
RT_RCDATA	0x465464	0x3201	empty			0
RT_RCDATA	0x468668	0x3201	data			1.0008593078665728
RT_RCDATA	0x46b86c	0x3201	data			1.0008593078665728
RT_RCDATA	0x46ea70	0x3201	data			1.0008593078665728
RT_RCDATA	0x471c74	0x3201	data			1.0008593078665728
RT_RCDATA	0x474e78	0x3201	data			1.0008593078665728
RT_RCDATA	0x47807c	0x3201	data			1.0008593078665728
RT_RCDATA	0x47b280	0x3201	data			1.0008593078665728
RT_RCDATA	0x47e484	0x3201	data			1.0008593078665728
RT_RCDATA	0x481688	0x3201	data			1.0008593078665728
RT_RCDATA	0x48488c	0x3201	data			1.0008593078665728
RT_RCDATA	0x487a90	0x3201	data			1.0008593078665728
RT_RCDATA	0x48ac94	0x3201	data			1.0008593078665728
RT_RCDATA	0x48de98	0x3201	data			1.0008593078665728
RT_RCDATA	0x49109c	0x3201	PGP Secret Sub-key -			1.0008593078665728
RT_RCDATA	0x4942a0	0x3201	data			1.0008593078665728
RT_RCDATA	0x4974a4	0x3201	data			1.0008593078665728
RT_RCDATA	0x49a6a8	0x3201	data			1.0008593078665728
RT_RCDATA	0x49d8ac	0x3201	data			1.0008593078665728
RT_RCDATA	0x4a0ab0	0x3201	data			1.0008593078665728
RT_RCDATA	0x4a3cb4	0x3201	data			1.0008593078665728
RT_RCDATA	0x4a6eb8	0x3201	data			1.0008593078665728
RT_RCDATA	0x4aa0bc	0x3201	data			1.0008593078665728
RT_RCDATA	0x4ad2c0	0x3201	data			1.0008593078665728
RT_RCDATA	0x4b04c4	0x3201	data			1.0008593078665728
RT_RCDATA	0x4b36c8	0x3201	data			1.0008593078665728
RT_RCDATA	0x4b68cc	0x3201	data			1.0008593078665728
RT_RCDATA	0x4b9ad0	0x3201	data			1.0008593078665728
RT_RCDATA	0x4bccd4	0x3201	data			1.0008593078665728
RT_RCDATA	0x4bfed8	0x3201	data			1.0008593078665728
RT_RCDATA	0x4c30dc	0x3201	data			1.0008593078665728
RT_RCDATA	0x4c62e0	0x3201	data			1.0008593078665728
RT_RCDATA	0x4c94e4	0x3201	data			1.0008593078665728
RT_RCDATA	0x4cc6e8	0x3201	data			1.0008593078665728
RT_RCDATA	0x4cf8ec	0x3201	data			1.0008593078665728
RT_RCDATA	0x4d2af0	0x3201	data			1.0008593078665728
RT_RCDATA	0x4d5cf4	0x3201	data			1.0008593078665728
RT_RCDATA	0x4d8ef8	0x3201	data			1.0008593078665728
RT_RCDATA	0x4dc0fc	0x3201	data			1.0008593078665728
RT_RCDATA	0x4df300	0x3201	OpenPGP Public Key			1.0008593078665728
RT_RCDATA	0x4e2504	0x3201	data			1.0008593078665728
RT_RCDATA	0x4e5708	0x3201	data			1.0008593078665728
RT_RCDATA	0x4e890c	0x3201	data			1.0008593078665728
RT_RCDATA	0x4ebb10	0x3201	data			1.0008593078665728
RT_RCDATA	0x4eed14	0x3201	data			1.0008593078665728
RT_RCDATA	0x4f1f18	0x3201	data			1.0008593078665728
RT_RCDATA	0x4f511c	0x3201	data			1.0008593078665728
RT_RCDATA	0x4f8320	0x3201	data			1.0008593078665728
RT_RCDATA	0x4fb524	0x3201	data			1.0008593078665728
RT_RCDATA	0x4fe728	0x3201	data			1.0008593078665728
RT_RCDATA	0x50192c	0x3201	data			1.0008593078665728
RT_RCDATA	0x504b30	0x3201	data			1.0008593078665728
RT_RCDATA	0x507d34	0x3201	data			1.0008593078665728
RT_RCDATA	0x50af38	0x3201	data			1.0008593078665728
RT_RCDATA	0x50e13c	0x3201	data			1.0008593078665728
RT_RCDATA	0x511340	0x3201	data			1.0008593078665728
RT_RCDATA	0x514544	0x3201	data			1.0008593078665728
RT_RCDATA	0x517748	0x3201	data			1.0008593078665728
RT_RCDATA	0x51a94c	0x3201	data			1.0008593078665728
RT_RCDATA	0x51db50	0x3201	data			1.0008593078665728
RT_RCDATA	0x520d54	0x3201	data			1.0008593078665728
RT_RCDATA	0x523f58	0x3201	SysEx File - Lexicon			1.0008593078665728
RT_RCDATA	0x52715c	0x3201	data			1.0008593078665728
RT_RCDATA	0x52a360	0x3201	data			1.0008593078665728
RT_RCDATA	0x52d564	0x3201	data			1.0008593078665728
RT_RCDATA	0x530768	0x3201	data			1.0008593078665728
RT_RCDATA	0x53396c	0x3201	data			1.0008593078665728
RT_RCDATA	0x536b70	0x3201	data			1.0008593078665728
RT_RCDATA	0x539d74	0x3201	data			1.0008593078665728
RT_RCDATA	0x53cf78	0x3201	data			1.0008593078665728
RT_RCDATA	0x54017c	0x3201	data			1.0008593078665728
RT_RCDATA	0x543380	0x3201	data			1.0008593078665728
RT_RCDATA	0x546584	0x3201	data			1.0008593078665728
RT_RCDATA	0x549788	0x3201	data			1.0008593078665728
RT_RCDATA	0x54c98c	0x3201	data			1.0008593078665728
RT_RCDATA	0x54fb90	0x3201	data			1.0008593078665728
RT_RCDATA	0x552d94	0x3201	data			1.0008593078665728
RT_RCDATA	0x555f98	0x3201	data			1.0008593078665728
RT_RCDATA	0x55919c	0x3201	data			1.0008593078665728
RT_RCDATA	0x55c3a0	0x3201	data			1.0008593078665728
RT_RCDATA	0x55f5a4	0x3201	data			1.0008593078665728
RT_RCDATA	0x5627a8	0x3201	data			1.0008593078665728
RT_MANIFEST	0x58076c	0x2	data			5.0
RT_MANIFEST	0x580774	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727
None	0x565b30	0x162	data			1.0310734463276836
None	0x565c94	0xb8	data			1.059782608695652
None	0x565d4c	0x122	data			1.0379310344827586
None	0x565e70	0x16e	data			1.030054644808743
None	0x565fe0	0xfa	data			1.044
None	0x5660dc	0x156	data			1.0321637426900585
None	0x566234	0xf4	data			1.0450819672131149
None	0x566328	0xf8	data			1.0443548387096775
None	0x566420	0xc8	data			1.055
None	0x5664e8	0xa0	data			1.06875
None	0x566588	0xe0	PGP Secret Sub-key -			1.0491071428571428
None	0x566668	0xa8	data			1.0654761904761905
None	0x566710	0x164	data			1.0308988764044944
None	0x566874	0x146	data			1.0337423312883436
None	0x5669bc	0xfa	data			1.044
None	0x566ab8	0x18e	data			1.0276381909547738
None	0x566c48	0xb0	data			1.0625
None	0x566cf8	0x12e	data			1.0364238410596027
None	0x566e28	0xf0	data			1.0458333333333334
None	0x566f18	0x142	data			1.0341614906832297
None	0x56705c	0x138	data			1.0352564102564104
None	0x567194	0xc2	data			1.056701030927835
None	0x567258	0xe6	data			1.0478260869565217
None	0x567340	0xb2	data			1.0617977528089888
None	0x5673f4	0xa2	data			1.0679012345679013
None	0x567498	0x158	data			1.0319767441860466
None	0x5675f0	0xf8	data			1.0443548387096775
None	0x5676e8	0x144	data			1.0339506172839505
None	0x56782c	0xa4	data			1.0670731707317074
None	0x5678d0	0x150	data			1.0327380952380953
None	0x567a20	0xde	data			1.0495495495495495
None	0x567b00	0x8c	data			1.0785714285714285
None	0x567b8c	0xf4	data			1.0450819672131149
None	0x567c80	0xec	data			1.0466101694915255
None	0x567d6c	0x102	DOS executable (COM)			1.0426356589147288
None	0x567e70	0xc6	data			1.0555555555555556
None	0x567f38	0x108	data			1.0416666666666667
None	0x568040	0xc4	data			1.0561224489795917
None	0x568104	0x104	data			1.0423076923076924
None	0x568208	0x114	data			1.039855072463768
None	0x56831c	0x106	data			1.0419847328244274
None	0x568424	0x6e	data			1.1
None	0x568494	0x130	data			1.0361842105263157
None	0x5685c4	0x10a	data			1.0413533834586466
None	0x5686d0	0x134	data			1.0357142857142858
None	0x568804	0xfc	data			1.0436507936507937
None	0x568900	0xa6	data			1.0662650602409638
None	0x5689a8	0xe8	data			1.0474137931034482
None	0x568a90	0xb4	data			1.0611111111111111
None	0x568b44	0x8c	data			1.0785714285714285
None	0x568bd0	0x144	data			1.0339506172839505
None	0x568d14	0x74	data			1.0948275862068966
None	0x568d88	0xa6	data			1.0662650602409638
None	0x568e30	0xc0	data			1.0572916666666667
None	0x568ef0	0xde	data			1.0495495495495495
None	0x568fd0	0xce	data			1.0533980582524272
None	0x5690a0	0xac	data			1.063953488372093
None	0x56914c	0x80	data			1.0859375
None	0x5691cc	0x114	data			1.039855072463768
None	0x5692e0	0xb2	data			1.0617977528089888
None	0x569394	0x124	data			1.0376712328767124
None	0x5694b8	0xd6	data			1.0514018691588785
None	0x569590	0x14e	data			1.032934131736527
None	0x5696e0	0xde	data			1.0495495495495495
None	0x5697c0	0x10a	data			1.0413533834586466
None	0x5698cc	0x106	data			1.0419847328244274
None	0x5699d4	0xba	data			1.0591397849462365
None	0x569a90	0xa4	data			1.0670731707317074
None	0x569b34	0x94	data			1.0743243243243243
None	0x569bc8	0xb8	data			1.059782608695652
None	0x569c80	0x10c	DOS executable (COM)			1.041044776119403
None	0x569d8c	0xfc	data			1.0436507936507937
None	0x569e88	0x116	data			1.039568345323741
None	0x569fa0	0x10e	data			1.0407407407407407
None	0x56a0b0	0x140	data			1.034375
None	0x56a1f0	0xac	data			1.063953488372093
None	0x56a29c	0x122	data			1.0379310344827586
None	0x56a3c0	0xe2	data			1.0486725663716814
None	0x56a4a4	0xfe	data			1.0433070866141732
None	0x56a5a4	0x11e	data			1.0384615384615385
None	0x56a6c4	0xe4	data			1.0482456140350878
None	0x56a7a8	0x114	data			1.039855072463768
None	0x56a8bc	0x122	data			1.0379310344827586
None	0x56a9e0	0x192	data			1.027363184079602
None	0x56ab74	0xd0	data			1.0528846153846154
None	0x56ac44	0xea	data			1.047008547008547
None	0x56ad30	0x138	data			1.0352564102564104
None	0x56ae68	0x7c	data			1.0887096774193548
None	0x56aee4	0x8c	data			1.0785714285714285
None	0x56af70	0x15e	data			1.0314285714285714
None	0x56b0d0	0x100	data			1.04296875
None	0x56b1d0	0x100	data			1.04296875
None	0x56b2d0	0x106	data			1.0419847328244274
None	0x56b3d8	0xf8	data			1.0443548387096775
None	0x56b4d0	0x110	data			1.0404411764705883
None	0x56b5e0	0xc6	data			1.0555555555555556
None	0x56b6a8	0x12a	data			1.0369127516778522
None	0x56b7d4	0xe0	data			1.0491071428571428
None	0x56b8b4	0xd2	data			1.0523809523809524
None	0x56b988	0xb8	data			1.059782608695652
None	0x56ba40	0x14e	data			1.032934131736527
None	0x56bb90	0xca	old packed data			1.0544554455445545
None	0x56bc5c	0x18c	OpenPGP Secret Key			1.0277777777777777
None	0x56bde8	0x13a	data			1.035031847133758
None	0x56bf24	0xf2	data			1.0454545454545454
None	0x56c018	0x148	data			1.0335365853658536
None	0x56c160	0x74	data			1.0948275862068966
None	0x56c1d4	0x96	data			1.0733333333333333
None	0x56c26c	0xc6	data			1.0555555555555556
None	0x56c334	0x176	data			1.0294117647058822
None	0x56c4ac	0xca	data			1.0544554455445545

Imports

DLL	Import
ADVAPI32.dll	RegOpenKeyW
api-ms-win-crt-filesystem-l1-1-0.dll	_access
api-ms-win-crt-heap-l1-1-0.dll	free
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll	sinf
api-ms-win-crt-multibyte-l1-1-0.dll	_mbscmp
api-ms-win-crt-runtime-l1-1-0.dll	exit
api-ms-win-crt-stdio-l1-1-0.dll	fseek
api-ms-win-crt-string-l1-1-0.dll	strcmp
api-ms-win-crt-utility-l1-1-0.dll	rand
d3d9.dll	Direct3DCreate9
IMM32.dll	ImmGetContext
IPHLPAPI.DLL	GetAdaptersInfo
kernEl32.DlL	LoadLibraryA, DeleteAtom, GetProcAddress, VirtualProtect
MPR.dll	WNetGetProviderNameW
MSVCP140.dll	_Strxfrm
NTDll.DLL	RtlVirtualUnwind
OlE32.DLL	CoInitialize
OLEAUT32.dll	VariantClear
SHELL32.dll	ShellExecuteA
SHLWAPI.dll	PathCombineA
USER32.dll	SetCursor
VCRUNTIME140.dll	memcmp
VCRUNTIME140_1.dll	__CxxFrameHandler4
wevtapi.dll	EvtNext

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T16:04:00.901494+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	104.26.9.59	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 16:03:59.010489941 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:03:59.010530949 CET	443	49704	104.26.9.59	192.168.2.5
Nov 29, 2024 16:03:59.010607004 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:03:59.048656940 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:03:59.048674107 CET	443	49704	104.26.9.59	192.168.2.5
Nov 29, 2024 16:04:00.382134914 CET	443	49704	104.26.9.59	192.168.2.5
Nov 29, 2024 16:04:00.382339954 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:04:00.522241116 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:04:00.522263050 CET	443	49704	104.26.9.59	192.168.2.5
Nov 29, 2024 16:04:00.522733927 CET	443	49704	104.26.9.59	192.168.2.5
Nov 29, 2024 16:04:00.523245096 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:04:00.525295973 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:04:00.567341089 CET	443	49704	104.26.9.59	192.168.2.5
Nov 29, 2024 16:04:00.901516914 CET	443	49704	104.26.9.59	192.168.2.5
Nov 29, 2024 16:04:00.901627064 CET	443	49704	104.26.9.59	192.168.2.5
Nov 29, 2024 16:04:00.901658058 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:04:00.902084112 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:04:00.903239965 CET	49704	443	192.168.2.5	104.26.9.59
Nov 29, 2024 16:04:00.903256893 CET	443	49704	104.26.9.59	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 16:03:58.551580906 CET	63545	53	192.168.2.5	1.1.1.1
Nov 29, 2024 16:03:58.834400892 CET	53	63545	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 16:03:58.551580906 CET	192.168.2.5	1.1.1.1	0x8c97	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 16:03:58.834400892 CET	1.1.1.1	192.168.2.5	0x8c97	No error (0)	api.myip.com	104.26.9.59	A (IP address)	IN (0x0001)	false
Nov 29, 2024 16:03:58.834400892 CET	1.1.1.1	192.168.2.5	0x8c97	No error (0)	api.myip.com	104.26.8.59	A (IP address)	IN (0x0001)	false
Nov 29, 2024 16:03:58.834400892 CET	1.1.1.1	192.168.2.5	0x8c97	No error (0)	api.myip.com	172.67.75.163	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.myip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.9.59	443	1164	C:\Users\user\Desktop\Fortexternal.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 15:04:00 UTC	182	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43 Host: api.myip.com
2024-11-29 15:04:00 UTC	778	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 15:04:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AEghMuSM%2B7HOUjga1vEB%2Fr9juB5ib1QAhkDbZZADaIXXfLsXrNjwYHbey%2FVnB3JjdcDF5wa28m6b85VJK7o51TAMVUKwdlxoqweijhuOig6iLKBpMYVglgiNCjT2lQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea37cdc48bfde99-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1531&min_rtt=1509&rtt_var=611&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2818&recv_bytes=820&delivery_rate=1726788&cwnd=161&unsent_bytes=0&cid=4ef9263786cee0f9&ts=534&x=0"
2024-11-29 15:04:00 UTC	63	IN	Data Raw: 33 39 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 63 22 3a 22 55 53 22 7d 0d 0a Data Ascii: 39{"ip":"8.46.123.228","country":"United States","cc":"US"}
2024-11-29 15:04:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:03:53
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\Fortexternal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Fortexternal.exe"
Imagebase:	0x7ff7b9cd0000
File size:	1'151'019 bytes
MD5 hash:	9EA1CBA0F5612A501DF02B77BAD76B1B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	4.5%
Signature Coverage:	36.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	36

Executed Functions

Function 00007FF7B9D2C470 Relevance: 1665.1, APIs: 1, Strings: 945, Instructions: 9553
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FF7B9D2C4FC

Strings

i5-8200Y, xrefs: 00007FF7B9D33E7E
i7-2670QM, xrefs: 00007FF7B9D35B52
i5-560M, xrefs: 00007FF7B9D330E6
i5-4402EC, xrefs: 00007FF7B9D3265A
i7-2960XM, xrefs: 00007FF7B9D35ED6
i5-4250U, xrefs: 00007FF7B9D321AA
i7-6870HQ, xrefs: 00007FF7B9D37F6A
i7-2660M, xrefs: 00007FF7B9D35A9E
i3-3130M, xrefs: 00007FF7B9D2D79A
i5-3550, xrefs: 00007FF7B9D31DAE
i5-3427U, xrefs: 00007FF7B9D31B92
i3-2102, xrefs: 00007FF7B9D2CF6F
i7-9850HE, xrefs: 00007FF7B9D391B2
i5-660, xrefs: 00007FF7B9D336FE
i5-9600T, xrefs: 00007FF7B9D34892
i7-8706G, xrefs: 00007FF7B9D38A6E
i3-4102E, xrefs: 00007FF7B9D2DFCE
i7-3720QM, xrefs: 00007FF7B9D3634A
i5-2450M, xrefs: 00007FF7B9D3126E
i7-4860HQ, xrefs: 00007FF7B9D3715A
i7-620M, xrefs: 00007FF7B9D37862
i5-520UM, xrefs: 00007FF7B9D32E8E
i7-9750H, xrefs: 00007FF7B9D3904A
i5-8400T, xrefs: 00007FF7B9D342B6
i3-2365M, xrefs: 00007FF7B9D2D416
i5-4200H, xrefs: 00007FF7B9D31F52
i5-6440EQ, xrefs: 00007FF7B9D334E2
i5-8300H, xrefs: 00007FF7B9D3409A
i3-2312M, xrefs: 00007FF7B9D2D182
i5-7Y57, xrefs: 00007FF7B9D33E42
i5-4590T, xrefs: 00007FF7B9D32ACE
i7-620UM, xrefs: 00007FF7B9D378DA
i5-1230U, xrefs: 00007FF7B9D3058A
i7-6785R, xrefs: 00007FF7B9D37D8A
i7-940, xrefs: 00007FF7B9D38D02
i3-13100F, xrefs: 00007FF7B9D2CD89
i3-6320T, xrefs: 00007FF7B9D2EB4A
i7-980X, xrefs: 00007FF7B9D3913A
i7-4800MQ, xrefs: 00007FF7B9D36FF2
i5-560UM, xrefs: 00007FF7B9D33122
i3-4000M, xrefs: 00007FF7B9D2DCC2
i7-1195G7, xrefs: 00007FF7B9D351F2
i5-3439Y, xrefs: 00007FF7B9D31C0A
i7-4900MQ, xrefs: 00007FF7B9D371D2
i5-4360U, xrefs: 00007FF7B9D325A6
i5-430UM, xrefs: 00007FF7B9D3243E
i9-14900T, xrefs: 00007FF7B9D39D6A
i7-8700T, xrefs: 00007FF7B9D389F6
i5-4300M, xrefs: 00007FF7B9D322D6
i3-1315UE, xrefs: 00007FF7B9D2CE2B
i5-12600H, xrefs: 00007FF7B9D3094A
i9-12900K, xrefs: 00007FF7B9D3987E
i7-11370H, xrefs: 00007FF7B9D34D7E
i5-4210M, xrefs: 00007FF7B9D320BA
i5-1030G7, xrefs: 00007FF7B9D2FA86
i3-2120, xrefs: 00007FF7B9D2CFDE
i5-3610ME, xrefs: 00007FF7B9D31F16
i5-6585R, xrefs: 00007FF7B9D336C2
i9-10900X, xrefs: 00007FF7B9D39482
i7-4578U, xrefs: 00007FF7B9D36782
i7-9850H, xrefs: 00007FF7B9D39176
i3-10320, xrefs: 00007FF7B9D2C9BD
i5-2467M, xrefs: 00007FF7B9D312E6
i5-11500, xrefs: 00007FF7B9D30332
i5-6260U, xrefs: 00007FF7B9D3328A
i7-7567U, xrefs: 00007FF7B9D381C2
i7-6650U, xrefs: 00007FF7B9D37BAA
i9-7940X, xrefs: 00007FF7B9D39E1E
i5-10500T, xrefs: 00007FF7B9D2FE0A
i3-9300, xrefs: 00007FF7B9D2F7B6
i5-4570, xrefs: 00007FF7B9D3292A
i9-14900, xrefs: 00007FF7B9D39C02
i7-5850EQ, xrefs: 00007FF7B9D37682
i7-12700, xrefs: 00007FF7B9D3535A
i7-1180G7, xrefs: 00007FF7B9D3508A
i9-13900KS, xrefs: 00007FF7B9D39AD6
i5-12600HX, xrefs: 00007FF7B9D309FE
i3-4130T, xrefs: 00007FF7B9D2E136
i5-4410E, xrefs: 00007FF7B9D32696
i5-1240U, xrefs: 00007FF7B9D306F2
i5-8310Y, xrefs: 00007FF7B9D34112
i7-8670, xrefs: 00007FF7B9D3888E
i3-4360T, xrefs: 00007FF7B9D2E4F6
i3-9100, xrefs: 00007FF7B9D2F64E
i3-2370LM, xrefs: 00007FF7B9D2D48E
i3-330E, xrefs: 00007FF7B9D2DAE2
i5-1350PE, xrefs: 00007FF7B9D30D82
i7-2715QE, xrefs: 00007FF7B9D35CF6
i5-8265U, xrefs: 00007FF7B9D33FE6
i5-470UM, xrefs: 00007FF7B9D32D62
i7-6800K, xrefs: 00007FF7B9D37DC6
i3-9350KF, xrefs: 00007FF7B9D2F8A6
i3-4010M, xrefs: 00007FF7B9D2DD3A
i9-8950HK, xrefs: 00007FF7B9D39ED2
i3-350M, xrefs: 00007FF7B9D2DB96
i5-6442EQ, xrefs: 00007FF7B9D3355A
i9-11900T, xrefs: 00007FF7B9D39752
i7-2570QM, xrefs: 00007FF7B9D356A2
i9-13900T, xrefs: 00007FF7B9D39B12
i5-10310Y, xrefs: 00007FF7B9D2FB3A
i9-10900, xrefs: 00007FF7B9D392DE
i3-7102E, xrefs: 00007FF7B9D2EDA2
i5-4440, xrefs: 00007FF7B9D32786
i3-2100, xrefs: 00007FF7B9D2CF03
i7-1270P, xrefs: 00007FF7B9D3544A
i5-580M, xrefs: 00007FF7B9D331D6
i3-8145U, xrefs: 00007FF7B9D2F4AA
i7-7820HK, xrefs: 00007FF7B9D3841A
i7-2685QM, xrefs: 00007FF7B9D35C06
i7-5930K, xrefs: 00007FF7B9D376FA
i9-7900X, xrefs: 00007FF7B9D39DA6
i9-13900HX, xrefs: 00007FF7B9D39A22
i5-11600KF, xrefs: 00007FF7B9D30512
i9-10900TE, xrefs: 00007FF7B9D39446
i3-12300T, xrefs: 00007FF7B9D2CD1D
i3-2100T, xrefs: 00007FF7B9D2CF39
i5-1030G4, xrefs: 00007FF7B9D2FA4A
i3-12100F, xrefs: 00007FF7B9D2CBA3
i5-10600K, xrefs: 00007FF7B9D2FEFA
i7-950, xrefs: 00007FF7B9D38D7A
i7-8700, xrefs: 00007FF7B9D38942
i5-4690K, xrefs: 00007FF7B9D32CAE
i5-430M, xrefs: 00007FF7B9D32402
i9-10910, xrefs: 00007FF7B9D394BE
i9-11900H, xrefs: 00007FF7B9D39662
i7-10700TE, xrefs: 00007FF7B9D34BDA
i7-10700KF, xrefs: 00007FF7B9D34B62
i7-4910MQ, xrefs: 00007FF7B9D3720E
i5-12600HL, xrefs: 00007FF7B9D309C2
i7-9700E, xrefs: 00007FF7B9D38EA6
i5-9500T, xrefs: 00007FF7B9D34766
i5-7442EQ, xrefs: 00007FF7B9D33BAE
i5-2320, xrefs: 00007FF7B9D31016
i9-10940X, xrefs: 00007FF7B9D39536
i7-6970HQ, xrefs: 00007FF7B9D3805A
i3-6120T, xrefs: 00007FF7B9D2E9E2
i3-8145UE, xrefs: 00007FF7B9D2F4E6
i3-4158U, xrefs: 00007FF7B9D2E1EA
i5-6360U, xrefs: 00007FF7B9D333F2
i7-2617M, xrefs: 00007FF7B9D357CE
i3-7167U, xrefs: 00007FF7B9D2EECE
i3-10300, xrefs: 00007FF7B9D2C8E4
i7-5750HQ, xrefs: 00007FF7B9D37592
i7-6820HQ, xrefs: 00007FF7B9D37EB6
i5-7300U, xrefs: 00007FF7B9D33A46
i7-3770, xrefs: 00007FF7B9D363C2
i5-6267U, xrefs: 00007FF7B9D332C6
i3-6100H, xrefs: 00007FF7B9D2E8B6
i5-8365UE, xrefs: 00007FF7B9D341C6
i7-4650U, xrefs: 00007FF7B9D368AE
i3-4160, xrefs: 00007FF7B9D2E226
i3-4020Y, xrefs: 00007FF7B9D2DE2A
i5-8305G, xrefs: 00007FF7B9D340D6
i3-1115G4E, xrefs: 00007FF7B9D2CACB
i7-1185G7, xrefs: 00007FF7B9D3513E
i5-2500K, xrefs: 00007FF7B9D3148A
i7-4710HQ, xrefs: 00007FF7B9D36ACA
i3-9100HL, xrefs: 00007FF7B9D2F702
i3-7120, xrefs: 00007FF7B9D2EE1A
i9-9900KS, xrefs: 00007FF7B9D3A03A
i7-9700, xrefs: 00007FF7B9D38E6A
i7-6700K, xrefs: 00007FF7B9D37C9A
i7-5550U, xrefs: 00007FF7B9D3742A
i7-860S, xrefs: 00007FF7B9D3879E
i9-9900KF, xrefs: 00007FF7B9D39FFE
i3-4360, xrefs: 00007FF7B9D2E4BA
i5-8420T, xrefs: 00007FF7B9D3432E
i5-10310U, xrefs: 00007FF7B9D2FAFE
i5-6198DU, xrefs: 00007FF7B9D33212
i5-6500TE, xrefs: 00007FF7B9D3364A
i3-530, xrefs: 00007FF7B9D2E6D6
i3-7100T, xrefs: 00007FF7B9D2ECB2
i7-2620M, xrefs: 00007FF7B9D3580A
i7-660LM, xrefs: 00007FF7B9D37AF6
i7-13700F, xrefs: 00007FF7B9D3553A
i3-4110M, xrefs: 00007FF7B9D2E046
i9-10980HK, xrefs: 00007FF7B9D39572
i5-650, xrefs: 00007FF7B9D33596
i5-11400H, xrefs: 00007FF7B9D301CA
i7-4610M, xrefs: 00007FF7B9D36836
i3-7350K, xrefs: 00007FF7B9D2F0AE
i7-4770K, xrefs: 00007FF7B9D36D5E
i9-9900, xrefs: 00007FF7B9D39F86
i3-2105, xrefs: 00007FF7B9D2CFA5
i5-5675C, xrefs: 00007FF7B9D3315E
i5-1038NG7, xrefs: 00007FF7B9D2FC2A
i3-4150T, xrefs: 00007FF7B9D2E1AE
i7-2675QM, xrefs: 00007FF7B9D35B8E
i9-9940X, xrefs: 00007FF7B9D3A12A
i5-12600K, xrefs: 00007FF7B9D30A3A
i3-10100F, xrefs: 00007FF7B9D2C6EC
i5-11600K, xrefs: 00007FF7B9D304D6
i7-4790S, xrefs: 00007FF7B9D36F7A
i5-3570S, xrefs: 00007FF7B9D31E9E
i5-11500T, xrefs: 00007FF7B9D30422
i3-2394M, xrefs: 00007FF7B9D2D5F6
i7-5500U, xrefs: 00007FF7B9D373EE
i5-3339Y, xrefs: 00007FF7B9D319EE
i7-2640M, xrefs: 00007FF7B9D35972
i5-661, xrefs: 00007FF7B9D337EE
i3-2350M, xrefs: 00007FF7B9D2D362
i3-380M, xrefs: 00007FF7B9D2DC0E
i9-13900TE, xrefs: 00007FF7B9D39B4E
i7-3820QM, xrefs: 00007FF7B9D364EE
i7-870, xrefs: 00007FF7B9D38906
i3-7100U, xrefs: 00007FF7B9D2ECEE
i3-4330T, xrefs: 00007FF7B9D2E352
i3-3120M, xrefs: 00007FF7B9D2D722
i5-11600, xrefs: 00007FF7B9D3049A
i7-3635QM, xrefs: 00007FF7B9D3625A
i7-4720HQ, xrefs: 00007FF7B9D36BBA
i3-1110G4, xrefs: 00007FF7B9D2CA95
i3-4100M, xrefs: 00007FF7B9D2DF56
i7-4771, xrefs: 00007FF7B9D36E8A
i5-7287U, xrefs: 00007FF7B9D339CE
i5-450M, xrefs: 00007FF7B9D328EE
i7-2689M, xrefs: 00007FF7B9D35C42
i5-1135G7, xrefs: 00007FF7B9D30116
i9-14900KF, xrefs: 00007FF7B9D39CF2
i9-13900E, xrefs: 00007FF7B9D399AA
i7-4770TE, xrefs: 00007FF7B9D36E4E
i7-4760HQ, xrefs: 00007FF7B9D36C6E
i3-2390M, xrefs: 00007FF7B9D2D57E
i7-3770K, xrefs: 00007FF7B9D363FE
i5-6600, xrefs: 00007FF7B9D3373A
i3-9100F, xrefs: 00007FF7B9D2F6C6
i5-1140G7, xrefs: 00007FF7B9D30242
i3-14100T, xrefs: 00007FF7B9D2CECD
i7-10710U, xrefs: 00007FF7B9D34C16
i9-11900K, xrefs: 00007FF7B9D3969E
i3-4100U, xrefs: 00007FF7B9D2DF92
i3-390M, xrefs: 00007FF7B9D2DC86
i5-12490F, xrefs: 00007FF7B9D3076A
i7-6600U, xrefs: 00007FF7B9D37ABA
i9-14900K, xrefs: 00007FF7B9D39CB6
i9-11950H, xrefs: 00007FF7B9D3978E
i5-2405S, xrefs: 00007FF7B9D31142
i5-7360U, xrefs: 00007FF7B9D33A82
i3-9320, xrefs: 00007FF7B9D2F82E
i7-3615QE, xrefs: 00007FF7B9D3616A
i3-8020, xrefs: 00007FF7B9D2F162
i9-10900T, xrefs: 00007FF7B9D3940A
i7-7700HQ, xrefs: 00007FF7B9D382B2
i5-3380M, xrefs: 00007FF7B9D31B56
i7-6700HQ, xrefs: 00007FF7B9D37C5E
i5-6400T, xrefs: 00007FF7B9D3346A
i5-4422E, xrefs: 00007FF7B9D326D2
i5-7Y54, xrefs: 00007FF7B9D33E06
i5-4310M, xrefs: 00007FF7B9D3247A
i5-8500T, xrefs: 00007FF7B9D343E2
i7-11700KF, xrefs: 00007FF7B9D34FD6
i9-9900X, xrefs: 00007FF7B9D3A0B2
i5-10400F, xrefs: 00007FF7B9D2FCA2
i3-8350K, xrefs: 00007FF7B9D2F612
i5-1125G4, xrefs: 00007FF7B9D2FFEA
i3-1115GRE, xrefs: 00007FF7B9D2CB01
i5-1340PE, xrefs: 00007FF7B9D30BDE
i9-9980XE, xrefs: 00007FF7B9D3A1DE
i5-1115G4, xrefs: 00007FF7B9D2FFAE
i5-8400B, xrefs: 00007FF7B9D3423E
i3-4330, xrefs: 00007FF7B9D2E316
i7-9700KF, xrefs: 00007FF7B9D38F5A
i5-9400H, xrefs: 00007FF7B9D3463A
i7-12700F, xrefs: 00007FF7B9D35396
i7-4950HQ, xrefs: 00007FF7B9D372FE
i3-3210, xrefs: 00007FF7B9D2D7D6
i5-4300Y, xrefs: 00007FF7B9D3234E
i3-4370T, xrefs: 00007FF7B9D2E56E
i5-3340, xrefs: 00007FF7B9D31A2A
i7-4610Y, xrefs: 00007FF7B9D36872
i7-3689Y, xrefs: 00007FF7B9D3630E
i7-11700K, xrefs: 00007FF7B9D34F9A
i5-10600T, xrefs: 00007FF7B9D2FF72
i7-640M, xrefs: 00007FF7B9D37952
i5-1250PE, xrefs: 00007FF7B9D308D2
i3-7020U, xrefs: 00007FF7B9D2EBC2
i3-10300T, xrefs: 00007FF7B9D2C91B
i5-5287U, xrefs: 00007FF7B9D32F42
i7-9850HL, xrefs: 00007FF7B9D391EE
i7-4860EQ, xrefs: 00007FF7B9D3711E
i3-6300, xrefs: 00007FF7B9D2EA96
i7-3970X, xrefs: 00007FF7B9D36656
i7-3555LE, xrefs: 00007FF7B9D3603E
i7-10510U, xrefs: 00007FF7B9D348CE
i7-4930K, xrefs: 00007FF7B9D3724A
i7-1360P, xrefs: 00007FF7B9D354C2
i3-5157U, xrefs: 00007FF7B9D2E69A
i5-8500B, xrefs: 00007FF7B9D343A6
i5-9500, xrefs: 00007FF7B9D346B2
i3-1000G1, xrefs: 00007FF7B9D2C58A
i3-4110E, xrefs: 00007FF7B9D2E00A
i7-620UE, xrefs: 00007FF7B9D3789E
i9-12900T, xrefs: 00007FF7B9D39932
i7-4770HQ, xrefs: 00007FF7B9D36D22
i7-740QM, xrefs: 00007FF7B9D380D2
i5-4202Y, xrefs: 00007FF7B9D32042
i5-13600T, xrefs: 00007FF7B9D30F62
i5-13600H, xrefs: 00007FF7B9D30DFA
i3-14100, xrefs: 00007FF7B9D2CE61
i9-10885H, xrefs: 00007FF7B9D392A2
i7-2629M, xrefs: 00007FF7B9D35882
i3-7100E, xrefs: 00007FF7B9D2EC3A
i5-6685R, xrefs: 00007FF7B9D3382A
i7-1068NG7, xrefs: 00007FF7B9D34A36
i9-7920X, xrefs: 00007FF7B9D39DE2
i3-3110M, xrefs: 00007FF7B9D2D6AA
i5-13600KF, xrefs: 00007FF7B9D30EEA, 00007FF7B9D30F26
i5-10200H, xrefs: 00007FF7B9D2F95A
i5-10400T, xrefs: 00007FF7B9D2FD1A
i5-460M, xrefs: 00007FF7B9D32B0A
i5-2300, xrefs: 00007FF7B9D30F9E
i7-3920XM, xrefs: 00007FF7B9D36566
i5-8260U, xrefs: 00007FF7B9D33FAA
i5-10400, xrefs: 00007FF7B9D2FC66
i5-3340M, xrefs: 00007FF7B9D31A66
i5-6200U, xrefs: 00007FF7B9D3324E
i7-13700, xrefs: 00007FF7B9D354FE
i5-6350HQ, xrefs: 00007FF7B9D333B6
i7-4712HQ, xrefs: 00007FF7B9D36B42
i5-1145G7, xrefs: 00007FF7B9D3027E
i7-10700E, xrefs: 00007FF7B9D34AAE
i9-9960X, xrefs: 00007FF7B9D3A166
i7-720QM, xrefs: 00007FF7B9D38096
i5-750S, xrefs: 00007FF7B9D33C9E
i5-4400E, xrefs: 00007FF7B9D325E2
i7-2649M, xrefs: 00007FF7B9D359AE
i9-13900K, xrefs: 00007FF7B9D39A5E
i7-4850EQ, xrefs: 00007FF7B9D370A6
i5-2547M, xrefs: 00007FF7B9D316A6
i7-640LM, xrefs: 00007FF7B9D37916
i7-8550U, xrefs: 00007FF7B9D38636
i3-3229Y, xrefs: 00007FF7B9D2D97A
i3-4340TE, xrefs: 00007FF7B9D2E406
i5-10600KF, xrefs: 00007FF7B9D2FF36
i5-670, xrefs: 00007FF7B9D33866
i7-9700K, xrefs: 00007FF7B9D38F1E
i7-3770S, xrefs: 00007FF7B9D3643A
i3-8121U, xrefs: 00007FF7B9D2F3BA
i5-9300HF, xrefs: 00007FF7B9D34586
i5-4690T, xrefs: 00007FF7B9D32D26
i3-12100, xrefs: 00007FF7B9D2CB6D
i7-1250U, xrefs: 00007FF7B9D3522E
i7-660UM, xrefs: 00007FF7B9D37B6E
i5-8259U, xrefs: 00007FF7B9D33F6E
i5-11400T, xrefs: 00007FF7B9D30206
i7-5775R, xrefs: 00007FF7B9D3760A
i3-4005U, xrefs: 00007FF7B9D2DCFE
i3-2350LM, xrefs: 00007FF7B9D2D326
i5-8650, xrefs: 00007FF7B9D3450E
i3-4150, xrefs: 00007FF7B9D2E172
i3-10100Y, xrefs: 00007FF7B9D2C794
i7-6770HQ, xrefs: 00007FF7B9D37D4E
i7-4750HQ, xrefs: 00007FF7B9D36C32
i7-6567U, xrefs: 00007FF7B9D37A7E
i3-7101TE, xrefs: 00007FF7B9D2ED66
i5-6600K, xrefs: 00007FF7B9D33776
i5-3337U, xrefs: 00007FF7B9D319B2
i5-3317U, xrefs: 00007FF7B9D31886
i5-13500H, xrefs: 00007FF7B9D30C92
i7-2655LE, xrefs: 00007FF7B9D359EA
i9-7960X, xrefs: 00007FF7B9D39E5A
i3-6100E, xrefs: 00007FF7B9D2E87A
i7-4790K, xrefs: 00007FF7B9D36F3E
i7-5850HQ, xrefs: 00007FF7B9D376BE
i5-4310U, xrefs: 00007FF7B9D324B6
i7-2920XM, xrefs: 00007FF7B9D35E9A
i5-2380P, xrefs: 00007FF7B9D31052
i7-6820HK, xrefs: 00007FF7B9D37E7A
i5-3450S, xrefs: 00007FF7B9D31C82
i3-4012Y, xrefs: 00007FF7B9D2DDEE
i5-11400F, xrefs: 00007FF7B9D3018E
i5-4330M, xrefs: 00007FF7B9D324F2
i3-4170, xrefs: 00007FF7B9D2E29E
i7-2600, xrefs: 00007FF7B9D356DE
i5-4570T, xrefs: 00007FF7B9D329DE
i5-8600K, xrefs: 00007FF7B9D34496
i7-975, xrefs: 00007FF7B9D3900E
i5-5300U, xrefs: 00007FF7B9D32F7E
i5-13505H, xrefs: 00007FF7B9D30D0A
i5-4570R, xrefs: 00007FF7B9D32966
i5-12600HE, xrefs: 00007FF7B9D30986
i3-2120T, xrefs: 00007FF7B9D2D01A
i3-14100F, xrefs: 00007FF7B9D2CE97
i5-2537M, xrefs: 00007FF7B9D315F2
i3-4112E, xrefs: 00007FF7B9D2E082
i5-7200U, xrefs: 00007FF7B9D338DE
i5-3330, xrefs: 00007FF7B9D318FE
i7-9700TE, xrefs: 00007FF7B9D38FD2
i5-6400, xrefs: 00007FF7B9D3342E
i3-7110U, xrefs: 00007FF7B9D2EDDE
i5-4210Y, xrefs: 00007FF7B9D32132
i5-655K, xrefs: 00007FF7B9D33686
i5-1035G1, xrefs: 00007FF7B9D2FB76
i5-13500T, xrefs: 00007FF7B9D30CCE
i7-11700T, xrefs: 00007FF7B9D35012
i3-4330TE, xrefs: 00007FF7B9D2E38E
i7-4550U, xrefs: 00007FF7B9D3670A
i5-6500T, xrefs: 00007FF7B9D3360E
i5-4670S, xrefs: 00007FF7B9D32BFA
i7-7560U, xrefs: 00007FF7B9D38186
i3-10325, xrefs: 00007FF7B9D2C9F3
i3-7320T, xrefs: 00007FF7B9D2F036
i3-9100T, xrefs: 00007FF7B9D2F73E
i5-2490M, xrefs: 00007FF7B9D313D6
i9-13900F, xrefs: 00007FF7B9D399E6
i9-11900KB, xrefs: 00007FF7B9D396DA
i7-10810U, xrefs: 00007FF7B9D34C8E
i3-9300T, xrefs: 00007FF7B9D2F7F2
i5-13400F, xrefs: 00007FF7B9D30B2A
i7-11850HE, xrefs: 00007FF7B9D35102
i5-3320M, xrefs: 00007FF7B9D318C2
i5-2550K, xrefs: 00007FF7B9D316E2
i7-3517UE, xrefs: 00007FF7B9D35F4E
i5-9400, xrefs: 00007FF7B9D345C2
i7-1265U, xrefs: 00007FF7B9D3531E
i7-4770S, xrefs: 00007FF7B9D36DD6
i5-2450P, xrefs: 00007FF7B9D312AA
i7-13700K, xrefs: 00007FF7B9D35576
i3-8109U, xrefs: 00007FF7B9D2F306
i7-2635QM, xrefs: 00007FF7B9D358FA
INTEL_THREAD_MISMATCH: thread in database = , xrefs: 00007FF7B9D3A28F
i5-7267U, xrefs: 00007FF7B9D33992
i9-12900KF, xrefs: 00007FF7B9D398BA
i7-7Y75, xrefs: 00007FF7B9D3850A
i7-1185G7E, xrefs: 00007FF7B9D3517A
i5-10600, xrefs: 00007FF7B9D2FEBE
i7-4790T, xrefs: 00007FF7B9D36FB6
i5-11600T, xrefs: 00007FF7B9D3054E
i5-4460S, xrefs: 00007FF7B9D3283A
i5-760, xrefs: 00007FF7B9D33CDA
i7-4960HQ, xrefs: 00007FF7B9D3733A
i7-4765T, xrefs: 00007FF7B9D36CAA
i7-10700K, xrefs: 00007FF7B9D34B26
i7-3517U, xrefs: 00007FF7B9D35F12
i3-1315U, xrefs: 00007FF7B9D2CDF5
i3-4370, xrefs: 00007FF7B9D2E532
i3-8000T, xrefs: 00007FF7B9D2F126
i5-8600T, xrefs: 00007FF7B9D344D2
i3-2328M, xrefs: 00007FF7B9D2D1BE
i3-2375M, xrefs: 00007FF7B9D2D506
i5-1145G7E, xrefs: 00007FF7B9D302BA
i3-2377M, xrefs: 00007FF7B9D2D542
i7-6850K, xrefs: 00007FF7B9D37F2E
i7-4820K, xrefs: 00007FF7B9D3706A
i9-9900T, xrefs: 00007FF7B9D3A076
i3-2397M, xrefs: 00007FF7B9D2D66E
i9-12900F, xrefs: 00007FF7B9D39842
i3-7007U, xrefs: 00007FF7B9D2EB86
i3-2357M, xrefs: 00007FF7B9D2D3DA
i3-6100U, xrefs: 00007FF7B9D2E96A
i5-2497M, xrefs: 00007FF7B9D31412
i5-1145GRE, xrefs: 00007FF7B9D302F6
i5-5250U, xrefs: 00007FF7B9D32ECA
i7-10750H, xrefs: 00007FF7B9D34C52
i7-6700TE, xrefs: 00007FF7B9D37D12
i5-8400H, xrefs: 00007FF7B9D3427A
i7-2600K, xrefs: 00007FF7B9D3571A
i3-10305, xrefs: 00007FF7B9D2C951
i5-12500, xrefs: 00007FF7B9D307A6
i5-10400H, xrefs: 00007FF7B9D2FCDE
i5-8257U, xrefs: 00007FF7B9D33F32
i7-2740QM, xrefs: 00007FF7B9D35D6E
i7-3840QM, xrefs: 00007FF7B9D3652A
i5-3570K, xrefs: 00007FF7B9D31E62
i3-4010U, xrefs: 00007FF7B9D2DD76
i5-4340M, xrefs: 00007FF7B9D3252E
i7-2610UE, xrefs: 00007FF7B9D35792
i7-5557U, xrefs: 00007FF7B9D37466
i3-10305T, xrefs: 00007FF7B9D2C987
i5-2540M, xrefs: 00007FF7B9D3166A
i3-1000G4, xrefs: 00007FF7B9D2C5C6
i9-13980HX, xrefs: 00007FF7B9D39BC6
i7-3820, xrefs: 00007FF7B9D364B2
i5-1130G7, xrefs: 00007FF7B9D3009E
i3-4120U, xrefs: 00007FF7B9D2E0BE
i3-4030Y, xrefs: 00007FF7B9D2DEDE
i7-4770T, xrefs: 00007FF7B9D36E12
i7-2677M, xrefs: 00007FF7B9D35BCA
i3-2370M, xrefs: 00007FF7B9D2D4CA
i3-7310T, xrefs: 00007FF7B9D2EF82
i3-3245, xrefs: 00007FF7B9D2DA2E
i7-6500U, xrefs: 00007FF7B9D37A06
i7-4510U, xrefs: 00007FF7B9D366CE
i3-8100H, xrefs: 00007FF7B9D2F28E
i3-4350T, xrefs: 00007FF7B9D2E47E
i5-3210M, xrefs: 00007FF7B9D3180E
i5-1235U, xrefs: 00007FF7B9D305C6
i5-6300HQ, xrefs: 00007FF7B9D3333E
i5-4460, xrefs: 00007FF7B9D327FE
i3-1215UE, xrefs: 00007FF7B9D2CC7B
i5-4210H, xrefs: 00007FF7B9D3207E
i5-4200Y, xrefs: 00007FF7B9D32006
i5-4350U, xrefs: 00007FF7B9D3256A
i3-8100T, xrefs: 00007FF7B9D2F2CA
i7-3740QM, xrefs: 00007FF7B9D36386
i5-10500E, xrefs: 00007FF7B9D2FD92
i7-4701EQ, xrefs: 00007FF7B9D369DA
i3-10100, xrefs: 00007FF7B9D2C67A
i3-6320, xrefs: 00007FF7B9D2EB0E
i7-11375H, xrefs: 00007FF7B9D34DBA
i9-12900KS, xrefs: 00007FF7B9D398F6
i7-7510U, xrefs: 00007FF7B9D3814A
i5-6287U, xrefs: 00007FF7B9D33302
i3-13100, xrefs: 00007FF7B9D2CD53
i5-8365U, xrefs: 00007FF7B9D3418A
i9-9820X, xrefs: 00007FF7B9D39F0E
i5-540UM, xrefs: 00007FF7B9D3306E
i7-6900K, xrefs: 00007FF7B9D37FA6
i5-4590S, xrefs: 00007FF7B9D32A92
i9-10980XE, xrefs: 00007FF7B9D395AE
i5-6300U, xrefs: 00007FF7B9D3337A
i5-3550S, xrefs: 00007FF7B9D31DEA
i5-4460T, xrefs: 00007FF7B9D32876
i5-1155G7, xrefs: 00007FF7B9D3045E
i3-560, xrefs: 00007FF7B9D2E78A
i5-480M, xrefs: 00007FF7B9D32D9E
i7-2600S, xrefs: 00007FF7B9D35756
i7-12700KF, xrefs: 00007FF7B9D353D2
i7-5700EQ, xrefs: 00007FF7B9D3751A
i9-14900HX, xrefs: 00007FF7B9D39C7A
i7-6498DU, xrefs: 00007FF7B9D379CA
i3-4170T, xrefs: 00007FF7B9D2E2DA
i7-3770T, xrefs: 00007FF7B9D36476
i5-2400S, xrefs: 00007FF7B9D31106
i5-2430M, xrefs: 00007FF7B9D311F6
i5-1350P, xrefs: 00007FF7B9D30D46
i5-3470S, xrefs: 00007FF7B9D31CFA
i7-3960X, xrefs: 00007FF7B9D3661A
i7-620LM, xrefs: 00007FF7B9D37826
i7-12700T, xrefs: 00007FF7B9D3540E
i7-4930MX, xrefs: 00007FF7B9D37286
i7-2535QM, xrefs: 00007FF7B9D35666
i5-5575R, xrefs: 00007FF7B9D330AA
i9-11980HK, xrefs: 00007FF7B9D397CA
i5-5350H, xrefs: 00007FF7B9D32FBA
i3-7300T, xrefs: 00007FF7B9D2EF46
i5-1250P, xrefs: 00007FF7B9D30896
i9-10920X, xrefs: 00007FF7B9D394FA
i7-820QM, xrefs: 00007FF7B9D38582
i7-4700HQ, xrefs: 00007FF7B9D36962
i5-4302Y, xrefs: 00007FF7B9D3238A
i5-3437U, xrefs: 00007FF7B9D31BCE
i5-680, xrefs: 00007FF7B9D338A2
i5-3340S, xrefs: 00007FF7B9D31AA2
i7-965, xrefs: 00007FF7B9D38DF2
i7-3520M, xrefs: 00007FF7B9D35F8A
i7-4810MQ, xrefs: 00007FF7B9D3702E
i7-1065G7, xrefs: 00007FF7B9D349BE
i5-2560LM, xrefs: 00007FF7B9D3175A
i3-1210U, xrefs: 00007FF7B9D2CC0F
i7-10700F, xrefs: 00007FF7B9D34AEA
i7-3940XM, xrefs: 00007FF7B9D365DE
i5-8600, xrefs: 00007FF7B9D3445A
i7-8850H, xrefs: 00007FF7B9D38C12
i5-7500, xrefs: 00007FF7B9D33C26
i5-11500B, xrefs: 00007FF7B9D3036E
i7-3537U, xrefs: 00007FF7B9D35FC6
i5-4260U, xrefs: 00007FF7B9D32222
i7-3612QM, xrefs: 00007FF7B9D3612E
i5-13500, xrefs: 00007FF7B9D30C56
i3-8320, xrefs: 00007FF7B9D2F59A
i7-4850HQ, xrefs: 00007FF7B9D370E2
i7-11700B, xrefs: 00007FF7B9D34F22
i3-10105F, xrefs: 00007FF7B9D2C804
i7-8809G, xrefs: 00007FF7B9D38BD6
i3-2310E, xrefs: 00007FF7B9D2D10A
i3-2367M, xrefs: 00007FF7B9D2D452
i7-7660U, xrefs: 00007FF7B9D3823A
i5-7400T, xrefs: 00007FF7B9D33AFA
i3-330M, xrefs: 00007FF7B9D2DB1E
i7-3930K, xrefs: 00007FF7B9D365A2
i7-10700, xrefs: 00007FF7B9D34A72
i3-2348M, xrefs: 00007FF7B9D2D2EA
i3-4130, xrefs: 00007FF7B9D2E0FA
i3-7100, xrefs: 00007FF7B9D2EBFE
i7-4700EQ, xrefs: 00007FF7B9D36926
i5-10500TE, xrefs: 00007FF7B9D2FE46
i7-3632QM, xrefs: 00007FF7B9D3621E
i3-2310M, xrefs: 00007FF7B9D2D146
i7-1165G7, xrefs: 00007FF7B9D34EAA
i5-4570TE, xrefs: 00007FF7B9D32A1A
i7-8559U, xrefs: 00007FF7B9D386AE
i7-2840QM, xrefs: 00007FF7B9D35E22
i7-870S, xrefs: 00007FF7B9D38AE6
i5-12400T, xrefs: 00007FF7B9D3067A
i7-4960X, xrefs: 00007FF7B9D37376
i3-4340, xrefs: 00007FF7B9D2E3CA
i5-13600HE, xrefs: 00007FF7B9D30E36
i5-540M, xrefs: 00007FF7B9D33032
i5-2500S, xrefs: 00007FF7B9D314C6
i3-4030U, xrefs: 00007FF7B9D2DEA2
i5-3230M, xrefs: 00007FF7B9D3184A
i5-3475S, xrefs: 00007FF7B9D31D72
i7-1068G7, xrefs: 00007FF7B9D349FA
i7-2655QM, xrefs: 00007FF7B9D35A26
i5-7440EQ, xrefs: 00007FF7B9D33B36
i5-9500F, xrefs: 00007FF7B9D3472A
i7-3610QE, xrefs: 00007FF7B9D3607A
i5-4430, xrefs: 00007FF7B9D3270E
i3-330UM, xrefs: 00007FF7B9D2DB5A
i7-10700T, xrefs: 00007FF7B9D34B9E
i3-9350K, xrefs: 00007FF7B9D2F86A
i7-4712MQ, xrefs: 00007FF7B9D36B7E
i7-640UM, xrefs: 00007FF7B9D3798E
i3-7320, xrefs: 00007FF7B9D2EFFA
i7-960, xrefs: 00007FF7B9D38DB6
i7-4700EC, xrefs: 00007FF7B9D368EA
i7-5820K, xrefs: 00007FF7B9D37646
i5-6500, xrefs: 00007FF7B9D335D2
i3-6098P, xrefs: 00007FF7B9D2E802
i5-2500T, xrefs: 00007FF7B9D31502
i7-3612QE, xrefs: 00007FF7B9D360F2
i3-1005G1, xrefs: 00007FF7B9D2C63E
i3-2330M, xrefs: 00007FF7B9D2D236
i9-9880H, xrefs: 00007FF7B9D39F4A
i7-610E, xrefs: 00007FF7B9D377AE
i5-7500T, xrefs: 00007FF7B9D33C62
i7-7820EQ, xrefs: 00007FF7B9D383DE
i3-12100T, xrefs: 00007FF7B9D2CBD9
i5-9500TE, xrefs: 00007FF7B9D347A2
i7-9750HF, xrefs: 00007FF7B9D39086
i7-2760QM, xrefs: 00007FF7B9D35DAA
i5-12400, xrefs: 00007FF7B9D30602
i3-3225, xrefs: 00007FF7B9D2D902
i5-3570T, xrefs: 00007FF7B9D31EDA
i5-11500HE, xrefs: 00007FF7B9D303E6
i5-6402P, xrefs: 00007FF7B9D334A6
i5-9400T, xrefs: 00007FF7B9D34676
i7-2657M, xrefs: 00007FF7B9D35A62
i5-7260U, xrefs: 00007FF7B9D33956
i5-2435M, xrefs: 00007FF7B9D31232
i5-10210U, xrefs: 00007FF7B9D2F996
i3-9100TE, xrefs: 00007FF7B9D2F77A
i5-2540LM, xrefs: 00007FF7B9D3162E
i7-7820X, xrefs: 00007FF7B9D38492
i5-4430S, xrefs: 00007FF7B9D3274A
i7-990X, xrefs: 00007FF7B9D3922A
i5-10500H, xrefs: 00007FF7B9D2FDCE
i5-10500, xrefs: 00007FF7B9D2FD56
i5-4300U, xrefs: 00007FF7B9D32312
i3-8300, xrefs: 00007FF7B9D2F522
i3-6300T, xrefs: 00007FF7B9D2EAD2
i3-2395M, xrefs: 00007FF7B9D2D632
i7-11390H, xrefs: 00007FF7B9D34DF6
i3-3240, xrefs: 00007FF7B9D2D9B6
i3-11100B, xrefs: 00007FF7B9D2CA29
i5-7640X, xrefs: 00007FF7B9D33DCA
i7-860, xrefs: 00007FF7B9D38762
i7-2630QM, xrefs: 00007FF7B9D358BE
i5-3330S, xrefs: 00007FF7B9D3193A
i3-5020U, xrefs: 00007FF7B9D2E65E
i3-2355M, xrefs: 00007FF7B9D2D39E
i9-13900, xrefs: 00007FF7B9D3996E
i5-1340P, xrefs: 00007FF7B9D30BA2
i5-2477M, xrefs: 00007FF7B9D3135E
i7-4702MQ, xrefs: 00007FF7B9D36A8E
i9-10900E, xrefs: 00007FF7B9D3931A
i5-10505, xrefs: 00007FF7B9D2FE82
i5-8250U, xrefs: 00007FF7B9D33EF6
i3-8120T, xrefs: 00007FF7B9D2F37E
i5-1035G7, xrefs: 00007FF7B9D2FBEE
i5-750, xrefs: 00007FF7B9D33BEA
i5-9500E, xrefs: 00007FF7B9D346EE
i3-10110U, xrefs: 00007FF7B9D2C874
i7-11800H, xrefs: 00007FF7B9D3504E
i3-3217UE, xrefs: 00007FF7B9D2D84E
i5-2475M, xrefs: 00007FF7B9D31322
i5-9300H, xrefs: 00007FF7B9D3454A
i7-3610QM, xrefs: 00007FF7B9D360B6
i7-13700T, xrefs: 00007FF7B9D355EE
i7-8670T, xrefs: 00007FF7B9D388CA
i3-7310U, xrefs: 00007FF7B9D2EFBE
i5-4670T, xrefs: 00007FF7B9D32C36
i3-3227U, xrefs: 00007FF7B9D2D93E
i7-7740X, xrefs: 00007FF7B9D38366
i5-2510E, xrefs: 00007FF7B9D3153E
i7-1060G7, xrefs: 00007FF7B9D34946
i3-N300, xrefs: 00007FF7B9D2F8E2
i5-8550, xrefs: 00007FF7B9D3441E
i5-3570, xrefs: 00007FF7B9D31E26
i3-6167U, xrefs: 00007FF7B9D2EA5A
i7-6560U, xrefs: 00007FF7B9D37A42
i7-4870HQ, xrefs: 00007FF7B9D37196
i5-7400, xrefs: 00007FF7B9D33ABE
i3-10105T, xrefs: 00007FF7B9D2C83C
i7-6822EQ, xrefs: 00007FF7B9D37EF2
i7-7500U, xrefs: 00007FF7B9D3810E
i5-12600KF, xrefs: 00007FF7B9D30A76
i3-1000NG4, xrefs: 00007FF7B9D2C602
i7-8750H, xrefs: 00007FF7B9D38B22
i7-5960X, xrefs: 00007FF7B9D37772
i5-9600, xrefs: 00007FF7B9D347DE
i5-4220Y, xrefs: 00007FF7B9D3216E
i3-380UM, xrefs: 00007FF7B9D2DC4A
i5-2410M, xrefs: 00007FF7B9D3117E
i7-940XM, xrefs: 00007FF7B9D38D3E
i5-8350U, xrefs: 00007FF7B9D3414E
i5-3450, xrefs: 00007FF7B9D31C46
i9-10900F , xrefs: 00007FF7B9D39356
i5-2515E, xrefs: 00007FF7B9D3157A
i7-2637M, xrefs: 00007FF7B9D35936
i7-7820HQ, xrefs: 00007FF7B9D38456
i7-2860QM, xrefs: 00007FF7B9D35E5E
i7-11700F, xrefs: 00007FF7B9D34F5E
i5-2487M, xrefs: 00007FF7B9D3139A
i5-1240P, xrefs: 00007FF7B9D306B6
i5-2400, xrefs: 00007FF7B9D310CA
i3-3250, xrefs: 00007FF7B9D2DA6A
i5-2310, xrefs: 00007FF7B9D30FDA
i7-2710QE, xrefs: 00007FF7B9D35CBA
i5-4258U, xrefs: 00007FF7B9D321E6
i7-5950HQ, xrefs: 00007FF7B9D37736
i3-6102E, xrefs: 00007FF7B9D2E9A6
i7-6820EQ, xrefs: 00007FF7B9D37E3E
i5-11400, xrefs: 00007FF7B9D30152
i5-1030NG7, xrefs: 00007FF7B9D2FAC2
i9-13950HX, xrefs: 00007FF7B9D39B8A
i5-4402E, xrefs: 00007FF7B9D3261E
i5-6600T, xrefs: 00007FF7B9D337B2
i5-2557M, xrefs: 00007FF7B9D3171E
i3-11100HE, xrefs: 00007FF7B9D2CA5F
i3-8320T, xrefs: 00007FF7B9D2F5D6
i7-9700T, xrefs: 00007FF7B9D38F96
i5-5200U, xrefs: 00007FF7B9D32DDA
i7-1270PE, xrefs: 00007FF7B9D35486
i5-13400T, xrefs: 00007FF7B9D30B66
i7-8665U, xrefs: 00007FF7B9D38816
i7-5700HQ, xrefs: 00007FF7B9D37556
i7-3630QM, xrefs: 00007FF7B9D361E2
i7-9800X, xrefs: 00007FF7B9D390FE
i3-3220T, xrefs: 00007FF7B9D2D8C6
i3-8120, xrefs: 00007FF7B9D2F342
i7-4600M, xrefs: 00007FF7B9D367BE
i7-8569U, xrefs: 00007FF7B9D38726
i5-12500HL, xrefs: 00007FF7B9D3081E
i5-7600K, xrefs: 00007FF7B9D33D52
i5-7210U, xrefs: 00007FF7B9D3391A
i5-520E, xrefs: 00007FF7B9D32E16
i9-9990XE, xrefs: 00007FF7B9D3A21A
i7-3540M, xrefs: 00007FF7B9D36002
i5-4670R, xrefs: 00007FF7B9D32BBE
i3-3217U, xrefs: 00007FF7B9D2D812
i5-3470, xrefs: 00007FF7B9D31CBE
i3-6100, xrefs: 00007FF7B9D2E83E
i5-8269U, xrefs: 00007FF7B9D34022
i9-12900, xrefs: 00007FF7B9D39806
i5-9600KF, xrefs: 00007FF7B9D34856
i5-12600, xrefs: 00007FF7B9D3090E
i3-6100T, xrefs: 00007FF7B9D2E8F2
i3-8000, xrefs: 00007FF7B9D2F0EA
i5-8420, xrefs: 00007FF7B9D342F2
i3-10110Y, xrefs: 00007FF7B9D2C8AC
i5-11300H, xrefs: 00007FF7B9D30062
i5-2390T, xrefs: 00007FF7B9D3108E
i7-8565U, xrefs: 00007FF7B9D386EA
i3-1215UL, xrefs: 00007FF7B9D2CCB1
i3-5010U, xrefs: 00007FF7B9D2E5E6
i7-920XM, xrefs: 00007FF7B9D38C8A
i3-7101E, xrefs: 00007FF7B9D2ED2A
i7-660UE, xrefs: 00007FF7B9D37B32
i3-6157U, xrefs: 00007FF7B9D2EA1E
i7-6920HQ, xrefs: 00007FF7B9D37FE2
i7-7800X, xrefs: 00007FF7B9D383A2
i7-680UM, xrefs: 00007FF7B9D37E02
i5-5675R, xrefs: 00007FF7B9D3319A
i7-620LE, xrefs: 00007FF7B9D377EA
i5-4590, xrefs: 00007FF7B9D32A56
i3-8020T, xrefs: 00007FF7B9D2F19E
i5-5257U, xrefs: 00007FF7B9D32F06
i5-11260H, xrefs: 00007FF7B9D30026
i7-13790F, xrefs: 00007FF7B9D3562A
i7-2820QM, xrefs: 00007FF7B9D35DE6
i7-7700, xrefs: 00007FF7B9D38276
i5-12500T, xrefs: 00007FF7B9D3085A
i7-10875H, xrefs: 00007FF7B9D34D42
i3-8130U, xrefs: 00007FF7B9D2F3F6, 00007FF7B9D2F432
i3-550, xrefs: 00007FF7B9D2E74E
i5-5350U, xrefs: 00007FF7B9D32FF6
i5-11320H, xrefs: 00007FF7B9D300DA
i7-11850H, xrefs: 00007FF7B9D350C6
i3-2130, xrefs: 00007FF7B9D2D092
i9-11900KF, xrefs: 00007FF7B9D39716
i7-5600U, xrefs: 00007FF7B9D374A2
i7-8700K, xrefs: 00007FF7B9D389BA
i5-9400F, xrefs: 00007FF7B9D345FE
i7-875K, xrefs: 00007FF7B9D38B5E
i7-4702EC, xrefs: 00007FF7B9D36A16
i5-8500, xrefs: 00007FF7B9D3436A
i5-2560M, xrefs: 00007FF7B9D31796
i7-4558U, xrefs: 00007FF7B9D36746
i5-3335S, xrefs: 00007FF7B9D31976
i7-6700T, xrefs: 00007FF7B9D37CD6
i5-8210Y, xrefs: 00007FF7B9D33EBA
i3-8100F, xrefs: 00007FF7B9D2F252
i7-4770R, xrefs: 00007FF7B9D36D9A
i5-3350P, xrefs: 00007FF7B9D31ADE
i7-4785T, xrefs: 00007FF7B9D36EC6
i3-7300, xrefs: 00007FF7B9D2EF0A
i3-4100E, xrefs: 00007FF7B9D2DF1A
i3-10100T, xrefs: 00007FF7B9D2C724
i3-2125, xrefs: 00007FF7B9D2D056
i3-5015U, xrefs: 00007FF7B9D2E622
i3-6100TE, xrefs: 00007FF7B9D2E92E
i7-6950X, xrefs: 00007FF7B9D3801E
i5-7600T, xrefs: 00007FF7B9D33D8E
i5-4470, xrefs: 00007FF7B9D328B2
i7-970, xrefs: 00007FF7B9D38E2E
i5-4670, xrefs: 00007FF7B9D32B46
i3-4025U, xrefs: 00007FF7B9D2DE66
i7-4600U, xrefs: 00007FF7B9D367FA
i7-8086K, xrefs: 00007FF7B9D38546
i5-4278U, xrefs: 00007FF7B9D3225E
i5-4210U, xrefs: 00007FF7B9D320F6
i3-7130U, xrefs: 00007FF7B9D2EE92
i7-4980HQ, xrefs: 00007FF7B9D373B2
i9-9980HK, xrefs: 00007FF7B9D3A1A2
i7-3667U, xrefs: 00007FF7B9D36296
i3-2332M, xrefs: 00007FF7B9D2D272
i7-10870H, xrefs: 00007FF7B9D34D06
i9-7980XE, xrefs: 00007FF7B9D39E96
i7-10610U, xrefs: 00007FF7B9D34982
i5-12500H, xrefs: 00007FF7B9D307E2
i3-2340UE, xrefs: 00007FF7B9D2D2AE
i9-10900KF, xrefs: 00007FF7B9D393CE
i7-4770, xrefs: 00007FF7B9D36CE6
i7-4722HQ, xrefs: 00007FF7B9D36BF6
i5-4570S, xrefs: 00007FF7B9D329A2
i3-3120ME, xrefs: 00007FF7B9D2D75E
i3-540, xrefs: 00007FF7B9D2E712
i7-3687U, xrefs: 00007FF7B9D362D2
i5-4200U, xrefs: 00007FF7B9D31FCA
i5-2500, xrefs: 00007FF7B9D3144E
i5-4690S, xrefs: 00007FF7B9D32CEA
i3-8140U, xrefs: 00007FF7B9D2F46E
i3-7100H, xrefs: 00007FF7B9D2EC76
i9-10900K, xrefs: 00007FF7B9D39392
i7-6660U, xrefs: 00007FF7B9D37BE6
i9-9900K, xrefs: 00007FF7B9D39FC2
i3-3115C, xrefs: 00007FF7B9D2D6E6
i5-2520M, xrefs: 00007FF7B9D315B6
i5-10210Y, xrefs: 00007FF7B9D2F9D2
i5-13600, xrefs: 00007FF7B9D30DBE
i5-4670K, xrefs: 00007FF7B9D32B82
i7-5650U, xrefs: 00007FF7B9D374DE
i7-8650U, xrefs: 00007FF7B9D387DA
i7-2720QM, xrefs: 00007FF7B9D35D32
i3-10100TE, xrefs: 00007FF7B9D2C75C
i5-3360M, xrefs: 00007FF7B9D31B1A
i3-8100B, xrefs: 00007FF7B9D2F216
i3-1120G4, xrefs: 00007FF7B9D2CB37
i7-4940MX, xrefs: 00007FF7B9D372C2
i7-930, xrefs: 00007FF7B9D38CC6
i7-7700K, xrefs: 00007FF7B9D382EE
i3-8100, xrefs: 00007FF7B9D2F1DA
i7-840QM, xrefs: 00007FF7B9D385BE
i3-7340, xrefs: 00007FF7B9D2F072
i7-2627M, xrefs: 00007FF7B9D35846
i7-1260P, xrefs: 00007FF7B9D352A6
i5-2580M, xrefs: 00007FF7B9D317D2
i5-3470T, xrefs: 00007FF7B9D31D36
i5-1035G4, xrefs: 00007FF7B9D2FBB2
i5-1245U, xrefs: 00007FF7B9D3072E
i5-7440HQ, xrefs: 00007FF7B9D33B72
i3-370M, xrefs: 00007FF7B9D2DBD2
i5-4440S, xrefs: 00007FF7B9D327C2
i7-4702HQ, xrefs: 00007FF7B9D36A52
i3-5005U, xrefs: 00007FF7B9D2E5AA
i5-8400, xrefs: 00007FF7B9D34202
i5-4690, xrefs: 00007FF7B9D32C72
i5-6440HQ, xrefs: 00007FF7B9D3351E
i3-2308M, xrefs: 00007FF7B9D2D0CE
i3-10105, xrefs: 00007FF7B9D2C7CC
i7-9700F, xrefs: 00007FF7B9D38EE2
i9-10850K, xrefs: 00007FF7B9D39266
i9-9920X, xrefs: 00007FF7B9D3A0EE
i3-1215U, xrefs: 00007FF7B9D2CC45
i7-2667M, xrefs: 00007FF7B9D35ADA
i5-11500H, xrefs: 00007FF7B9D303AA
i9-11900, xrefs: 00007FF7B9D395EA
i5-4308U, xrefs: 00007FF7B9D323C6
i5-10300H, xrefs: 00007FF7B9D2FA0E
i3-12300, xrefs: 00007FF7B9D2CCE7
i7-7700T, xrefs: 00007FF7B9D3832A
i3-2330E, xrefs: 00007FF7B9D2D1FA
i7-880, xrefs: 00007FF7B9D38B9A
i7-6700, xrefs: 00007FF7B9D37C22
i5-2415M, xrefs: 00007FF7B9D311BA
i7-8709G, xrefs: 00007FF7B9D38AAA
INTEL_THREAD_MISMATCH: CPU model = , xrefs: 00007FF7B9D2C551
i5-520M, xrefs: 00007FF7B9D32E52
i7-8665UE, xrefs: 00007FF7B9D38852
i7-10850H, xrefs: 00007FF7B9D34CCA
i7-1255U, xrefs: 00007FF7B9D3526A
i5-13490F, xrefs: 00007FF7B9D30C1A
i7-8500Y, xrefs: 00007FF7B9D385FA
i7-920, xrefs: 00007FF7B9D38C4E
i9-14900F, xrefs: 00007FF7B9D39C3E
i7-2700K, xrefs: 00007FF7B9D35C7E
i5-4200M, xrefs: 00007FF7B9D31F8E
i7-980, xrefs: 00007FF7B9D390C2
i3-3250T, xrefs: 00007FF7B9D2DAA6
i7-1160G7, xrefs: 00007FF7B9D34E6E
i3-6006U, xrefs: 00007FF7B9D2E7C6
i7-8705G, xrefs: 00007FF7B9D38A32
i3-7120T, xrefs: 00007FF7B9D2EE56
i3-13100T, xrefs: 00007FF7B9D2CDBF
i7-7920HQ, xrefs: 00007FF7B9D384CE
i7-4710MQ, xrefs: 00007FF7B9D36B06
i5-13600K, xrefs: 00007FF7B9D30E72, 00007FF7B9D30EAE
i9-13900KF, xrefs: 00007FF7B9D39A9A
i7-5775C, xrefs: 00007FF7B9D375CE
i5-7300HQ, xrefs: 00007FF7B9D33A0A
i3-4010Y, xrefs: 00007FF7B9D2DDB2
i7-11600H, xrefs: 00007FF7B9D34E32
i3-8300T, xrefs: 00007FF7B9D2F55E
i3-4350, xrefs: 00007FF7B9D2E442
i7-4790, xrefs: 00007FF7B9D36F02
i3-3240T, xrefs: 00007FF7B9D2D9F2
i7-4700MQ, xrefs: 00007FF7B9D3699E
i9-14900KS, xrefs: 00007FF7B9D39D2E
i7-1260U, xrefs: 00007FF7B9D352E2
i9-11900F, xrefs: 00007FF7B9D39626
i5-7600, xrefs: 00007FF7B9D33D16
i5-8279U, xrefs: 00007FF7B9D3405E
i5-4288U, xrefs: 00007FF7B9D3229A
i5-9600K, xrefs: 00007FF7B9D3481A
i3-9100E, xrefs: 00007FF7B9D2F68A
i7-10510Y, xrefs: 00007FF7B9D3490A
i5-12600T, xrefs: 00007FF7B9D30AB2
i7-3615QM, xrefs: 00007FF7B9D361A6
i7-11700, xrefs: 00007FF7B9D34EE6
i3-N305, xrefs: 00007FF7B9D2F91E
i3-10100E, xrefs: 00007FF7B9D2C6B4
i5-13400, xrefs: 00007FF7B9D30AEE
i3-3220, xrefs: 00007FF7B9D2D88A
i7-8700B, xrefs: 00007FF7B9D3897E
i7-13700KF, xrefs: 00007FF7B9D355B2
i7-7600U, xrefs: 00007FF7B9D381FE
i7-2669M, xrefs: 00007FF7B9D35B16
i7-8557U, xrefs: 00007FF7B9D38672
i5-12400F, xrefs: 00007FF7B9D3063E
i3-4160T, xrefs: 00007FF7B9D2E262
i7-1185GRE, xrefs: 00007FF7B9D351B6
i3-2393M, xrefs: 00007FF7B9D2D5BA
i7-4500U, xrefs: 00007FF7B9D36692

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: InfoSystem
String ID: INTEL_THREAD_MISMATCH: CPU model = $INTEL_THREAD_MISMATCH: thread in database = $i3-1000G1$i3-1000G4$i3-1000NG4$i3-1005G1$i3-10100$i3-10100E$i3-10100F$i3-10100T$i3-10100TE$i3-10100Y$i3-10105$i3-10105F$i3-10105T$i3-10110U$i3-10110Y$i3-10300$i3-10300T$i3-10305$i3-10305T$i3-10320$i3-10325$i3-11100B$i3-11100HE$i3-1110G4$i3-1115G4E$i3-1115GRE$i3-1120G4$i3-12100$i3-12100F$i3-12100T$i3-1210U$i3-1215U$i3-1215UE$i3-1215UL$i3-12300$i3-12300T$i3-13100$i3-13100F$i3-13100T$i3-1315U$i3-1315UE$i3-14100$i3-14100F$i3-14100T$i3-2100$i3-2100T$i3-2102$i3-2105$i3-2120$i3-2120T$i3-2125$i3-2130$i3-2308M$i3-2310E$i3-2310M$i3-2312M$i3-2328M$i3-2330E$i3-2330M$i3-2332M$i3-2340UE$i3-2348M$i3-2350LM$i3-2350M$i3-2355M$i3-2357M$i3-2365M$i3-2367M$i3-2370LM$i3-2370M$i3-2375M$i3-2377M$i3-2390M$i3-2393M$i3-2394M$i3-2395M$i3-2397M$i3-3110M$i3-3115C$i3-3120M$i3-3120ME$i3-3130M$i3-3210$i3-3217U$i3-3217UE$i3-3220$i3-3220T$i3-3225$i3-3227U$i3-3229Y$i3-3240$i3-3240T$i3-3245$i3-3250$i3-3250T$i3-330E$i3-330M$i3-330UM$i3-350M$i3-370M$i3-380M$i3-380UM$i3-390M$i3-4000M$i3-4005U$i3-4010M$i3-4010U$i3-4010Y$i3-4012Y$i3-4020Y$i3-4025U$i3-4030U$i3-4030Y$i3-4100E$i3-4100M$i3-4100U$i3-4102E$i3-4110E$i3-4110M$i3-4112E$i3-4120U$i3-4130$i3-4130T$i3-4150$i3-4150T$i3-4158U$i3-4160$i3-4160T$i3-4170$i3-4170T$i3-4330$i3-4330T$i3-4330TE$i3-4340$i3-4340TE$i3-4350$i3-4350T$i3-4360$i3-4360T$i3-4370$i3-4370T$i3-5005U$i3-5010U$i3-5015U$i3-5020U$i3-5157U$i3-530$i3-540$i3-550$i3-560$i3-6006U$i3-6098P$i3-6100$i3-6100E$i3-6100H$i3-6100T$i3-6100TE$i3-6100U$i3-6102E$i3-6120T$i3-6157U$i3-6167U$i3-6300$i3-6300T$i3-6320$i3-6320T$i3-7007U$i3-7020U$i3-7100$i3-7100E$i3-7100H$i3-7100T$i3-7100U$i3-7101E$i3-7101TE$i3-7102E$i3-7110U$i3-7120$i3-7120T$i3-7130U$i3-7167U$i3-7300$i3-7300T$i3-7310T$i3-7310U$i3-7320$i3-7320T$i3-7340$i3-7350K$i3-8000$i3-8000T$i3-8020$i3-8020T$i3-8100$i3-8100B$i3-8100F$i3-8100H$i3-8100T$i3-8109U$i3-8120$i3-8120T$i3-8121U$i3-8130U$i3-8140U$i3-8145U$i3-8145UE$i3-8300$i3-8300T$i3-8320$i3-8320T$i3-8350K$i3-9100$i3-9100E$i3-9100F$i3-9100HL$i3-9100T$i3-9100TE$i3-9300$i3-9300T$i3-9320$i3-9350K$i3-9350KF$i3-N300$i3-N305$i5-10200H$i5-10210U$i5-10210Y$i5-10300H$i5-1030G4$i5-1030G7$i5-1030NG7$i5-10310U$i5-10310Y$i5-1035G1$i5-1035G4$i5-1035G7$i5-1038NG7$i5-10400$i5-10400F$i5-10400H$i5-10400T$i5-10500$i5-10500E$i5-10500H$i5-10500T$i5-10500TE$i5-10505$i5-10600$i5-10600K$i5-10600KF$i5-10600T$i5-1115G4$i5-1125G4$i5-11260H$i5-11300H$i5-1130G7$i5-11320H$i5-1135G7$i5-11400$i5-11400F$i5-11400H$i5-11400T$i5-1140G7$i5-1145G7$i5-1145G7E$i5-1145GRE$i5-11500$i5-11500B$i5-11500H$i5-11500HE$i5-11500T$i5-1155G7$i5-11600$i5-11600K$i5-11600KF$i5-11600T$i5-1230U$i5-1235U$i5-12400$i5-12400F$i5-12400T$i5-1240P$i5-1240U$i5-1245U$i5-12490F$i5-12500$i5-12500H$i5-12500HL$i5-12500T$i5-1250P$i5-1250PE$i5-12600$i5-12600H$i5-12600HE$i5-12600HL$i5-12600HX$i5-12600K$i5-12600KF$i5-12600T$i5-13400$i5-13400F$i5-13400T$i5-1340P$i5-1340PE$i5-13490F$i5-13500$i5-13500H$i5-13500T$i5-13505H$i5-1350P$i5-1350PE$i5-13600$i5-13600H$i5-13600HE$i5-13600K$i5-13600KF$i5-13600T$i5-2300$i5-2310$i5-2320$i5-2380P$i5-2390T$i5-2400$i5-2400S$i5-2405S$i5-2410M$i5-2415M$i5-2430M$i5-2435M$i5-2450M$i5-2450P$i5-2467M$i5-2475M$i5-2477M$i5-2487M$i5-2490M$i5-2497M$i5-2500$i5-2500K$i5-2500S$i5-2500T$i5-2510E$i5-2515E$i5-2520M$i5-2537M$i5-2540LM$i5-2540M$i5-2547M$i5-2550K$i5-2557M$i5-2560LM$i5-2560M$i5-2580M$i5-3210M$i5-3230M$i5-3317U$i5-3320M$i5-3330$i5-3330S$i5-3335S$i5-3337U$i5-3339Y$i5-3340$i5-3340M$i5-3340S$i5-3350P$i5-3360M$i5-3380M$i5-3427U$i5-3437U$i5-3439Y$i5-3450$i5-3450S$i5-3470$i5-3470S$i5-3470T$i5-3475S$i5-3550$i5-3550S$i5-3570$i5-3570K$i5-3570S$i5-3570T$i5-3610ME$i5-4200H$i5-4200M$i5-4200U$i5-4200Y$i5-4202Y$i5-4210H$i5-4210M$i5-4210U$i5-4210Y$i5-4220Y$i5-4250U$i5-4258U$i5-4260U$i5-4278U$i5-4288U$i5-4300M$i5-4300U$i5-4300Y$i5-4302Y$i5-4308U$i5-430M$i5-430UM$i5-4310M$i5-4310U$i5-4330M$i5-4340M$i5-4350U$i5-4360U$i5-4400E$i5-4402E$i5-4402EC$i5-4410E$i5-4422E$i5-4430$i5-4430S$i5-4440$i5-4440S$i5-4460$i5-4460S$i5-4460T$i5-4470$i5-450M$i5-4570$i5-4570R$i5-4570S$i5-4570T$i5-4570TE$i5-4590$i5-4590S$i5-4590T$i5-460M$i5-4670$i5-4670K$i5-4670R$i5-4670S$i5-4670T$i5-4690$i5-4690K$i5-4690S$i5-4690T$i5-470UM$i5-480M$i5-5200U$i5-520E$i5-520M$i5-520UM$i5-5250U$i5-5257U$i5-5287U$i5-5300U$i5-5350H$i5-5350U$i5-540M$i5-540UM$i5-5575R$i5-560M$i5-560UM$i5-5675C$i5-5675R$i5-580M$i5-6198DU$i5-6200U$i5-6260U$i5-6267U$i5-6287U$i5-6300HQ$i5-6300U$i5-6350HQ$i5-6360U$i5-6400$i5-6400T$i5-6402P$i5-6440EQ$i5-6440HQ$i5-6442EQ$i5-650$i5-6500$i5-6500T$i5-6500TE$i5-655K$i5-6585R$i5-660$i5-6600$i5-6600K$i5-6600T$i5-661$i5-6685R$i5-670$i5-680$i5-7200U$i5-7210U$i5-7260U$i5-7267U$i5-7287U$i5-7300HQ$i5-7300U$i5-7360U$i5-7400$i5-7400T$i5-7440EQ$i5-7440HQ$i5-7442EQ$i5-750$i5-7500$i5-7500T$i5-750S$i5-760$i5-7600$i5-7600K$i5-7600T$i5-7640X$i5-7Y54$i5-7Y57$i5-8200Y$i5-8210Y$i5-8250U$i5-8257U$i5-8259U$i5-8260U$i5-8265U$i5-8269U$i5-8279U$i5-8300H$i5-8305G$i5-8310Y$i5-8350U$i5-8365U$i5-8365UE$i5-8400$i5-8400B$i5-8400H$i5-8400T$i5-8420$i5-8420T$i5-8500$i5-8500B$i5-8500T$i5-8550$i5-8600$i5-8600K$i5-8600T$i5-8650$i5-9300H$i5-9300HF$i5-9400$i5-9400F$i5-9400H$i5-9400T$i5-9500$i5-9500E$i5-9500F$i5-9500T$i5-9500TE$i5-9600$i5-9600K$i5-9600KF$i5-9600T$i7-10510U$i7-10510Y$i7-1060G7$i7-10610U$i7-1065G7$i7-1068G7$i7-1068NG7$i7-10700$i7-10700E$i7-10700F$i7-10700K$i7-10700KF$i7-10700T$i7-10700TE$i7-10710U$i7-10750H$i7-10810U$i7-10850H$i7-10870H$i7-10875H$i7-11370H$i7-11375H$i7-11390H$i7-11600H$i7-1160G7$i7-1165G7$i7-11700$i7-11700B$i7-11700F$i7-11700K$i7-11700KF$i7-11700T$i7-11800H$i7-1180G7$i7-11850H$i7-11850HE$i7-1185G7$i7-1185G7E$i7-1185GRE$i7-1195G7$i7-1250U$i7-1255U$i7-1260P$i7-1260U$i7-1265U$i7-12700$i7-12700F$i7-12700KF$i7-12700T$i7-1270P$i7-1270PE$i7-1360P$i7-13700$i7-13700F$i7-13700K$i7-13700KF$i7-13700T$i7-13790F$i7-2535QM$i7-2570QM$i7-2600$i7-2600K$i7-2600S$i7-2610UE$i7-2617M$i7-2620M$i7-2627M$i7-2629M$i7-2630QM$i7-2635QM$i7-2637M$i7-2640M$i7-2649M$i7-2655LE$i7-2655QM$i7-2657M$i7-2660M$i7-2667M$i7-2669M$i7-2670QM$i7-2675QM$i7-2677M$i7-2685QM$i7-2689M$i7-2700K$i7-2710QE$i7-2715QE$i7-2720QM$i7-2740QM$i7-2760QM$i7-2820QM$i7-2840QM$i7-2860QM$i7-2920XM$i7-2960XM$i7-3517U$i7-3517UE$i7-3520M$i7-3537U$i7-3540M$i7-3555LE$i7-3610QE$i7-3610QM$i7-3612QE$i7-3612QM$i7-3615QE$i7-3615QM$i7-3630QM$i7-3632QM$i7-3635QM$i7-3667U$i7-3687U$i7-3689Y$i7-3720QM$i7-3740QM$i7-3770$i7-3770K$i7-3770S$i7-3770T$i7-3820$i7-3820QM$i7-3840QM$i7-3920XM$i7-3930K$i7-3940XM$i7-3960X$i7-3970X$i7-4500U$i7-4510U$i7-4550U$i7-4558U$i7-4578U$i7-4600M$i7-4600U$i7-4610M$i7-4610Y$i7-4650U$i7-4700EC$i7-4700EQ$i7-4700HQ$i7-4700MQ$i7-4701EQ$i7-4702EC$i7-4702HQ$i7-4702MQ$i7-4710HQ$i7-4710MQ$i7-4712HQ$i7-4712MQ$i7-4720HQ$i7-4722HQ$i7-4750HQ$i7-4760HQ$i7-4765T$i7-4770$i7-4770HQ$i7-4770K$i7-4770R$i7-4770S$i7-4770T$i7-4770TE$i7-4771$i7-4785T$i7-4790$i7-4790K$i7-4790S$i7-4790T$i7-4800MQ$i7-4810MQ$i7-4820K$i7-4850EQ$i7-4850HQ$i7-4860EQ$i7-4860HQ$i7-4870HQ$i7-4900MQ$i7-4910MQ$i7-4930K$i7-4930MX$i7-4940MX$i7-4950HQ$i7-4960HQ$i7-4960X$i7-4980HQ$i7-5500U$i7-5550U$i7-5557U$i7-5600U$i7-5650U$i7-5700EQ$i7-5700HQ$i7-5750HQ$i7-5775C$i7-5775R$i7-5820K$i7-5850EQ$i7-5850HQ$i7-5930K$i7-5950HQ$i7-5960X$i7-610E$i7-620LE$i7-620LM$i7-620M$i7-620UE$i7-620UM$i7-640LM$i7-640M$i7-640UM$i7-6498DU$i7-6500U$i7-6560U$i7-6567U$i7-6600U$i7-660LM$i7-660UE$i7-660UM$i7-6650U$i7-6660U$i7-6700$i7-6700HQ$i7-6700K$i7-6700T$i7-6700TE$i7-6770HQ$i7-6785R$i7-6800K$i7-680UM$i7-6820EQ$i7-6820HK$i7-6820HQ$i7-6822EQ$i7-6850K$i7-6870HQ$i7-6900K$i7-6920HQ$i7-6950X$i7-6970HQ$i7-720QM$i7-740QM$i7-7500U$i7-7510U$i7-7560U$i7-7567U$i7-7600U$i7-7660U$i7-7700$i7-7700HQ$i7-7700K$i7-7700T$i7-7740X$i7-7800X$i7-7820EQ$i7-7820HK$i7-7820HQ$i7-7820X$i7-7920HQ$i7-7Y75$i7-8086K$i7-820QM$i7-840QM$i7-8500Y$i7-8550U$i7-8557U$i7-8559U$i7-8565U$i7-8569U$i7-860$i7-860S$i7-8650U$i7-8665U$i7-8665UE$i7-8670$i7-8670T$i7-870$i7-8700$i7-8700B$i7-8700K$i7-8700T$i7-8705G$i7-8706G$i7-8709G$i7-870S$i7-8750H$i7-875K$i7-880$i7-8809G$i7-8850H$i7-920$i7-920XM$i7-930$i7-940$i7-940XM$i7-950$i7-960$i7-965$i7-970$i7-9700$i7-9700E$i7-9700F$i7-9700K$i7-9700KF$i7-9700T$i7-9700TE$i7-975$i7-9750H$i7-9750HF$i7-980$i7-9800X$i7-980X$i7-9850H$i7-9850HE$i7-9850HL$i7-990X$i9-10850K$i9-10885H$i9-10900$i9-10900E$i9-10900F $i9-10900K$i9-10900KF$i9-10900T$i9-10900TE$i9-10900X$i9-10910$i9-10920X$i9-10940X$i9-10980HK$i9-10980XE$i9-11900$i9-11900F$i9-11900H$i9-11900K$i9-11900KB$i9-11900KF$i9-11900T$i9-11950H$i9-11980HK$i9-12900$i9-12900F$i9-12900K$i9-12900KF$i9-12900KS$i9-12900T$i9-13900$i9-13900E$i9-13900F$i9-13900HX$i9-13900K$i9-13900KF$i9-13900KS$i9-13900T$i9-13900TE$i9-13950HX$i9-13980HX$i9-14900$i9-14900F$i9-14900HX$i9-14900K$i9-14900KF$i9-14900KS$i9-14900T$i9-7900X$i9-7920X$i9-7940X$i9-7960X$i9-7980XE$i9-8950HK$i9-9820X$i9-9880H$i9-9900$i9-9900K$i9-9900KF$i9-9900KS$i9-9900T$i9-9900X$i9-9920X$i9-9940X$i9-9960X$i9-9980HK$i9-9980XE$i9-9990XE
API String ID: 31276548-3532574369
Opcode ID: 26273d34f2e1964aaa2b671129edb9b6a78f06b02724a089fd0c747b47b128c4
Instruction ID: 53a6480ab32f3936ba7fcee081ec178b060efa4d9f38284ad801291a624f1635
Opcode Fuzzy Hash: 26273d34f2e1964aaa2b671129edb9b6a78f06b02724a089fd0c747b47b128c4
Instruction Fuzzy Hash: 9E54E662509AC6A8DB31EF69D8441EAB374FB5134CFC00176E75D0AA6EDF389349C7A0

Function 00007FF7B9D2C0A0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 00007FF7B9D2C0AC
CreateMutexA.KERNEL32 ref: 00007FF7B9D2C0BD
GetLastError.KERNEL32 ref: 00007FF7B9D2C0C6
CloseHandle.KERNEL32 ref: 00007FF7B9D2C0D6
SetLastError.KERNEL32 ref: 00007FF7B9D2C0EA
CreateMutexA.KERNEL32 ref: 00007FF7B9D2C0FB
GetLastError.KERNEL32 ref: 00007FF7B9D2C104
CloseHandle.KERNEL32 ref: 00007FF7B9D2C114
SetLastError.KERNEL32 ref: 00007FF7B9D2C128
CreateMutexA.KERNEL32 ref: 00007FF7B9D2C139
GetLastError.KERNEL32 ref: 00007FF7B9D2C142
CloseHandle.KERNEL32 ref: 00007FF7B9D2C152
SetLastError.KERNEL32 ref: 00007FF7B9D2C18E
CreateMutexA.KERNEL32 ref: 00007FF7B9D2C19F
GetLastError.KERNEL32 ref: 00007FF7B9D2C1A8
CloseHandle.KERNEL32 ref: 00007FF7B9D2C1B8

Strings

Frz_State, xrefs: 00007FF7B9D2C194
Virtual PC, xrefs: 00007FF7B9D2C160
Sandboxie, xrefs: 00007FF7B9D2C1D2
MicrosoftVirtualPC7UserServiceMakeSureWe'reTheOnlyOneMutex, xrefs: 00007FF7B9D2C12E
SBIE_BOXED_ServiceInitComplete_Mutex1, xrefs: 00007FF7B9D2C0F0
Sandboxie_SingleInstanceMutex_Control, xrefs: 00007FF7B9D2C0B2

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleMutex
String ID: Frz_State$MicrosoftVirtualPC7UserServiceMakeSureWe'reTheOnlyOneMutex$SBIE_BOXED_ServiceInitComplete_Mutex1$Sandboxie$Sandboxie_SingleInstanceMutex_Control$Virtual PC
API String ID: 3777024946-2155102297
Opcode ID: 27b00dbb08ddb40b86d5f533a0947734df896d575dc76daad9bb050b0e5fb976
Instruction ID: 0c8c501a6d7216c516300b8b2c58b48d3e97e82abea50419ebfa241179f57590
Opcode Fuzzy Hash: 27b00dbb08ddb40b86d5f533a0947734df896d575dc76daad9bb050b0e5fb976
Instruction Fuzzy Hash: 7E313121A08A4382FB55AF2AE5450B9F371AFA6751FC94435DB2F0666DDF3CD489C320

Function 00007FF7B9D223A0 Relevance: 36.9, APIs: 7, Strings: 14, Instructions: 150
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF7B9D22403
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B9D22419
GetKeyboardLayout.USER32 ref: 00007FF7B9D22510
GetLocaleInfoA.KERNEL32 ref: 00007FF7B9D2252C
LoadLibraryA.KERNEL32 ref: 00007FF7B9D225C5
GetProcAddress.KERNEL32 ref: 00007FF7B9D225FD
GetProcAddress.KERNEL32 ref: 00007FF7B9D22611

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D2254E
C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp, xrefs: 00007FF7B9D223E7
xinput9_1_0.dll, xrefs: 00007FF7B9D2258F
io.BackendPlatformUserData == nullptr && "Already initialized a platform backend!", xrefs: 00007FF7B9D223EE
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D223BC
xinput1_2.dll, xrefs: 00007FF7B9D2259B
i >= 0 && i < Size, xrefs: 00007FF7B9D22555
xinput1_3.dll, xrefs: 00007FF7B9D22583
xinput1_4.dll, xrefs: 00007FF7B9D22577
XInputGetState, xrefs: 00007FF7B9D22603
xinput1_1.dll, xrefs: 00007FF7B9D225A7
XInputGetCapabilities, xrefs: 00007FF7B9D225EF
imgui_impl_win32, xrefs: 00007FF7B9D224D0
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7B9D223C3

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: AddressPerformanceProcQuery$CounterFrequencyInfoKeyboardLayoutLibraryLoadLocale
String ID: C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$XInputGetCapabilities$XInputGetState$i >= 0 && i < Size$imgui_impl_win32$io.BackendPlatformUserData == nullptr && "Already initialized a platform backend!"$xinput1_1.dll$xinput1_2.dll$xinput1_3.dll$xinput1_4.dll$xinput9_1_0.dll
API String ID: 2839060773-805143068
Opcode ID: d01679f2044470887c6f6f794e798d5041f9b7315f37bd5cac1d6eb523e7c933
Instruction ID: ee9b25a565b17a58f653f966cdfadab44d237bed9e51cf69b5cf959a2d4d6e73
Opcode Fuzzy Hash: d01679f2044470887c6f6f794e798d5041f9b7315f37bd5cac1d6eb523e7c933
Instruction Fuzzy Hash: FF719F32A08F8286D714AF1AE9842A9F3B4FB66784F845136DB9D43769EF3CE055C710

Function 00007FF7B9D4030C Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 442
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHBrowseForFolder.SHELL32 ref: 00007FF7B9D404A9
SHGetPathFromIDList.SHELL32 ref: 00007FF7B9D404D6
CoTaskMemFree.COMBASE ref: 00007FF7B9D405AA
RemoveDirectoryA.KERNEL32 ref: 00007FF7B9D40C22
CreateDirectoryA.KERNEL32 ref: 00007FF7B9D40C32
MessageBoxA.USER32 ref: 00007FF7B9D40C57

Strings

..., xrefs: 00007FF7B9D4044D
Loader, xrefs: 00007FF7B9D405E7
C:\Users\user\Desktop\Fortexternal, xrefs: 00007FF7B9D404E4, 00007FF7B9D404F7, 00007FF7B9D40513, 00007FF7B9D4056B, 00007FF7B9D40B5D, 00007FF7B9D40C1B, 00007FF7B9D40C2B
destinatinal folder, xrefs: 00007FF7B9D40AF5
Install, xrefs: 00007FF7B9D40C04
P, xrefs: 00007FF7B9D40496
Fortexternal, xrefs: 00007FF7B9D405BB
-d, xrefs: 00007FF7B9D409EE
Failed to create setup directory, xrefs: 00007FF7B9D40C49
Fail, xrefs: 00007FF7B9D40C42
choose install folder, xrefs: 00007FF7B9D40487
Fortexternal, xrefs: 00007FF7B9D4054C

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Directory$BrowseCreateFolderFreeFromListMessagePathRemoveTask
String ID: Loader$...$C:\Users\user\Desktop\Fortexternal$Fail$Failed to create setup directory$Fortexternal$Fortexternal$Install$P$choose install folder$destinatinal folder$-d
API String ID: 4103403243-590595139
Opcode ID: 6f603ba20749aa914c1cea6a61e7e423d9026db803c61033dc8e04d9030ed907
Instruction ID: fab0086651e4c197916d06b6964d316de236aca325a58e5509f3bda981e6cf0e
Opcode Fuzzy Hash: 6f603ba20749aa914c1cea6a61e7e423d9026db803c61033dc8e04d9030ed907
Instruction Fuzzy Hash: 4D32333190D68695D661FF2BE4953AAF370FFAA344F804231EB9D526A9DF2CE144CB10

Function 00007FF7B9D22F30 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 182
keyboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32 ref: 00007FF7B9D22FB0
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B9D22FEC
GetForegroundWindow.USER32 ref: 00007FF7B9D23045
ClientToScreen.USER32 ref: 00007FF7B9D2307D
SetCursorPos.USER32 ref: 00007FF7B9D2308F
GetCursorPos.USER32 ref: 00007FF7B9D230A9
ScreenToClient.USER32 ref: 00007FF7B9D230BB
GetKeyState.USER32 ref: 00007FF7B9D230FD
GetKeyState.USER32 ref: 00007FF7B9D23144
GetKeyState.USER32 ref: 00007FF7B9D2318B
GetKeyState.USER32 ref: 00007FF7B9D231D2

Strings

bd != nullptr && "Context or backend not initialized? Did you call ImGui_ImplWin32_Init()?", xrefs: 00007FF7B9D22F61
C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp, xrefs: 00007FF7B9D22F5A, 00007FF7B9D23031
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D22F80
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7B9D22F87
bd->hWnd != 0, xrefs: 00007FF7B9D23038

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: State$Client$CursorScreen$CounterForegroundPerformanceQueryRectWindow
String ID: C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$bd != nullptr && "Context or backend not initialized? Did you call ImGui_ImplWin32_Init()?"$bd->hWnd != 0
API String ID: 1576454153-990843061
Opcode ID: 1a851b407499fdf4f0adc91023c1835da07401580244c1beda1895c94ec5f366
Instruction ID: 60bd5ecab215ea104e96b7756cc46dc706c5135de4ee21d10dbb6cf185a739a9
Opcode Fuzzy Hash: 1a851b407499fdf4f0adc91023c1835da07401580244c1beda1895c94ec5f366
Instruction Fuzzy Hash: 99916321A0868646F711AF3ED5443B9F7B1EFA6B84F848131DB6D0659DDF6CE484CB20

Function 00007FF7B9D292C0 Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF7B9D292E1
VerSetConditionMask.NTDLL ref: 00007FF7B9D2938C
VerSetConditionMask.NTDLL ref: 00007FF7B9D2939D
VerSetConditionMask.NTDLL ref: 00007FF7B9D293AE
VerifyVersionInfoW.KERNEL32 ref: 00007FF7B9D293D2
GetPhysicallyInstalledSystemMemory.KERNEL32 ref: 00007FF7B9D293EC

Strings

VBOX_DEFAULT: disk = , xrefs: 00007FF7B9D2940A
util::get_disk_size(: , xrefs: 00007FF7B9D29344
VBOX_DEFAULT: less than windows 10 detected, xrefs: 00007FF7B9D2943D
VBOX_DEFAULT: windows 10 detected, xrefs: 00007FF7B9D29448
VBOX_DEFAULT: ram = , xrefs: 00007FF7B9D29419
disk size = , xrefs: 00007FF7B9D29325
failed to fetch size in GB, xrefs: 00007FF7B9D2933D
private util::get_disk_size( function: , xrefs: 00007FF7B9D2932C
VBOX_DEFAULT: windows 11 detected, xrefs: 00007FF7B9D29476
VBOX_DEFAULT: returned false due to lack of precondition spec comparisons, xrefs: 00007FF7B9D294A0

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ConditionMask$DiskFreeInfoInstalledMemoryPhysicallySpaceSystemVerifyVersion
String ID: VBOX_DEFAULT: disk = $VBOX_DEFAULT: less than windows 10 detected$VBOX_DEFAULT: ram = $VBOX_DEFAULT: returned false due to lack of precondition spec comparisons$VBOX_DEFAULT: windows 10 detected$VBOX_DEFAULT: windows 11 detected$disk size = $failed to fetch size in GB$private util::get_disk_size( function: $util::get_disk_size(:
API String ID: 4053933355-2927710238
Opcode ID: 444f4b3d8dfc6f5bdb356be75933f179318a91f7f8d5d026a69a314893e1cd55
Instruction ID: 86e4c50d1d760b76767c3b0d72098a7b1d3090faf79a3494a6148c33bac6a34a
Opcode Fuzzy Hash: 444f4b3d8dfc6f5bdb356be75933f179318a91f7f8d5d026a69a314893e1cd55
Instruction Fuzzy Hash: 91519F31A0C94681EA60AF2AE9943F9F371AFB6744FC50131D72D4769EDE2CE546C720

Function 00007FF7B9D3CC55 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumDeviceDrivers.KERNEL32 ref: 00007FF7B9D3CCAB
K32GetDeviceDriverBaseNameA.KERNEL32 ref: 00007FF7B9D3CCFB
00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7B9D3CD15
00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7B9D3CD2A

Strings

Failed to retrieve driver name, xrefs: 00007FF7B9D3CD88
VBoxMouse, xrefs: 00007FF7B9D3CD1E
VBoxSF, xrefs: 00007FF7B9D3CCD5
VBoxGuest, xrefs: 00007FF7B9D3CD09
Failed to enumerate device drivers, xrefs: 00007FF7B9D3CCB5
VirtualBox, xrefs: 00007FF7B9D3CD53

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C6125630Device$BaseDriverDriversEnumName
String ID: Failed to enumerate device drivers$Failed to retrieve driver name$VBoxGuest$VBoxMouse$VBoxSF$VirtualBox
API String ID: 3567762800-3078892907
Opcode ID: 90a3e4c33f94c635e720873c97f934764c488f4557d138a16aabaae0a6f2359e
Instruction ID: 19b534efe878f95454014c66e43ab68f42edf5180f78834c5bbf57e18d9b6684
Opcode Fuzzy Hash: 90a3e4c33f94c635e720873c97f934764c488f4557d138a16aabaae0a6f2359e
Instruction Fuzzy Hash: 7E31862161CA4291E620BF2AE8402FAF770FBA6781FD44132EB6D4769DDF2CD505C760

Function 00007FF7B9D3F8A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.NTDLL ref: 00007FF7B9D3FAE0

Strings

E, xrefs: 00007FF7B9D3FA86

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: NtdllProc_Window
String ID: E
API String ID: 4255912815-3568589458
Opcode ID: 1ad859f8c57e6c78a272c00c503d588111b95484246697c7da939e1954086c46
Instruction ID: 8d05f828c2e5996c8ec9bb64112e9bf2818af829136c194851457e8c2c322fab
Opcode Fuzzy Hash: 1ad859f8c57e6c78a272c00c503d588111b95484246697c7da939e1954086c46
Instruction Fuzzy Hash: DF516032A1C6858AE760AF1DE44037AB6B1EB96752F600536E7AD827ACDF3CD444CB11

Function 00007FF7B9D298D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

FindWindowA.USER32 ref: 00007FF7B9D298DF
FindWindowA.USER32 ref: 00007FF7B9D298F1

Strings

VBoxTrayToolWnd, xrefs: 00007FF7B9D298E8
VirtualBox, xrefs: 00007FF7B9D29907
VBoxTrayToolWndClass, xrefs: 00007FF7B9D298D8

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: FindWindow
String ID: VBoxTrayToolWnd$VBoxTrayToolWndClass$VirtualBox
API String ID: 134000473-3809131585
Opcode ID: 3c25875c7485bb330419359499db5cac49334f68e8649cfc72c9f1c8758dc657
Instruction ID: b412702c0b65099c80083835e88c64686ed04ae0a7718e037bcde23a69f8bb1f
Opcode Fuzzy Hash: 3c25875c7485bb330419359499db5cac49334f68e8649cfc72c9f1c8758dc657
Instruction Fuzzy Hash: 1FF09061E19A0681EF057F1AE8802B8F370BF79350FC91032C62E0536AAE2CD255C720

Function 00007FF7B9D21EF0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D2217D

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D21F19
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7B9D21F20
, xrefs: 00007FF7B9D21FDD

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: $C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"
API String ID: 1173767890-1764846569
Opcode ID: 14a1451ba78aab33cfd0f593b19aab8bdf8ff21bda43410788da136f7ce55d94
Instruction ID: c4e47a7e389e26d1e5e896fff7f694511fdee2c6ed921b4eabaffe1cdb2c18b6
Opcode Fuzzy Hash: 14a1451ba78aab33cfd0f593b19aab8bdf8ff21bda43410788da136f7ce55d94
Instruction Fuzzy Hash: 15916C32705A8586EB149F2AD4907ADB7B1FB96B88F848136EF5E43B68DF38D445C310

Function 00007FF7B9D2A000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7B9D2A013
CoCreateInstance.COMBASE ref: 00007FF7B9D2A04C
CoCreateInstance.COMBASE ref: 00007FF7B9D2A0A7

Strings

audio_device_random_name, xrefs: 00007FF7B9D2A061

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: CreateInstance$Initialize
String ID: audio_device_random_name
API String ID: 1108742289-3294949786
Opcode ID: fedb208af53d85e8c6c1e999e092dbade612422bdc59ea04c8a6dfe3d800c9d2
Instruction ID: d10f85e8499c150c6c1381cc6b955455f71c7785ec65c6fb69989477ca9f2bd8
Opcode Fuzzy Hash: fedb208af53d85e8c6c1e999e092dbade612422bdc59ea04c8a6dfe3d800c9d2
Instruction Fuzzy Hash: ED516E32704A8189EB619F2AD8403E97374FB95BA8F854132DB6D47B98DF39D689C310

Function 0000018CD09D6BC0 Relevance: 6.7, APIs: 4, Instructions: 693processCOMMON

Download Yara Rule

APIs

Part of subcall function 0000018CD09D9CF0: char_traits.LIBCPMTD ref: 0000018CD09D9D1D

std::_Fac_node::_Fac_node.LIBCPMTD ref: 0000018CD09D712F
CreateToolhelp32Snapshot.KERNEL32 ref: 0000018CD09D71A4
Process32FirstW.KERNEL32 ref: 0000018CD09D722B
Process32NextW.KERNEL32 ref: 0000018CD09D738B

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Process32$CreateFac_nodeFac_node::_FirstNextSnapshotToolhelp32char_traitsstd::_
String ID:
API String ID: 4114415025-0
Opcode ID: 0e28d821a7523c60772c4aee17a231d3837b35d2e31c4f8f5b205ac97deacb30
Instruction ID: 1e142295141c2f50026800315a9b26343578cd67c5f5fdfd902713a986de0f04
Opcode Fuzzy Hash: 0e28d821a7523c60772c4aee17a231d3837b35d2e31c4f8f5b205ac97deacb30
Instruction Fuzzy Hash: E13253312689484FE755FB7CC4657EBB2D2FB98341F808A3A604AC31D2ED719A45C7E1

Function 0000018CD09E44B3 Relevance: 6.4, APIs: 4, Instructions: 371fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09E44BB
FindFirstFileA.KERNEL32 ref: 0000018CD09E44CB

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyFileFindFirstQueue::StructuredWork
String ID:
API String ID: 552646416-0
Opcode ID: 7b1fa44f4a88086dce291a085c1b898288ff1f4fcbe6db60c2b4e76e7d46c797
Instruction ID: 68e7f257e9082b1ad46e7201db979c30f30904e15a9bf62f0d8187f852f0428e
Opcode Fuzzy Hash: 7b1fa44f4a88086dce291a085c1b898288ff1f4fcbe6db60c2b4e76e7d46c797
Instruction Fuzzy Hash: C0E1C131159A488FE7A5FB68C4557DFB3E1FB99341F408A2DA08EC3192DE309A45CBD2

Function 00007FF7B9D3C810 Relevance: 5.1, Strings: 4, Instructions: 53COMMON

Download Yara Rule

Strings

VMW, xrefs: 00007FF7B9D3C890
VMware, xrefs: 00007FF7B9D3C86A
VMware-, xrefs: 00007FF7B9D3C853
VMware Fusion, xrefs: 00007FF7B9D3C8A7

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: VMW$VMware$VMware Fusion$VMware-
API String ID: 0-2166300588
Opcode ID: d399dcbddb338200642cf53888f6994871618082e4c106394048f9f6e84efd4c
Instruction ID: 818ee8a8c86ada2cbf5316750fcd619f68052a5b06b249b99d2ce3ec52b13de1
Opcode Fuzzy Hash: d399dcbddb338200642cf53888f6994871618082e4c106394048f9f6e84efd4c
Instruction Fuzzy Hash: AB21212261C94291EA10BF6AD4500B9F330FFA2364BC05332E67E466FEDE5CD605C720

Function 0000018CD0A05B00 Relevance: 4.7, APIs: 3, Instructions: 164encryptionCOMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD0A05B96
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD0A05C14
CryptUnprotectData.CRYPT32 ref: 0000018CD0A05C6D

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$CryptDataUnprotect
String ID:
API String ID: 3418212865-0
Opcode ID: cd13dd898b514859b615aacead6fd89a882e7807fe1a6e13c5a8fa8d01e1d26e
Instruction ID: e1049a451a5cf6dba7587542c7f1ec3191f712d28437e6b1dfb248ff8b6d8069
Opcode Fuzzy Hash: cd13dd898b514859b615aacead6fd89a882e7807fe1a6e13c5a8fa8d01e1d26e
Instruction Fuzzy Hash: 29519B70558B888FE7A4EF68C4497DEB7E1FB99341F40892DA08DC3261DF749984CB92

Function 00007FF7B9D21660 Relevance: 2.9, Strings: 2, Instructions: 374COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D218A2, 00007FF7B9D21A41, 00007FF7B9D21A8F
i >= 0 && i < Size, xrefs: 00007FF7B9D218A9, 00007FF7B9D21A48, 00007FF7B9D21A96

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 0-1817040388
Opcode ID: a4772ff7831cf6c1a17793acfc865a631a73c3e4e2c2ab5072f563c7e195b329
Instruction ID: 649140b8b16fc48cb8900bfa3a1284769fd1dde109798d66998595cfe78116e7
Opcode Fuzzy Hash: a4772ff7831cf6c1a17793acfc865a631a73c3e4e2c2ab5072f563c7e195b329
Instruction Fuzzy Hash: FA026736604B9586DB20DF2AD4846AEB7B4FB89B88F828232DF5D57758CF38D545CB00

Function 00007FF7B9D28330 Relevance: 2.5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

Strings

threads = , xrefs: 00007FF7B9D2833F
THREADCOUNT: , xrefs: 00007FF7B9D28346

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: THREADCOUNT: $threads =
API String ID: 0-3051102645
Opcode ID: cc5bfb0b2930e7841634c32bbbf54cbc33499b5c790ca7d8d408d8ead483724a
Instruction ID: d61e7556af45ef00e13095bb2aabe91470ef1d49ef89457020146966355c6eaa
Opcode Fuzzy Hash: cc5bfb0b2930e7841634c32bbbf54cbc33499b5c790ca7d8d408d8ead483724a
Instruction Fuzzy Hash: BA01F925B1410343FB313B2AC804779B2A0AF72701FD01070CA2DC6AD6EE1EE5819760

Function 00007FF7B9D228E0 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738a0b8ec5ca8bc5cbd8091cb8aa9a4d90ed87dbe06c7893d721e284d2ef8229
Instruction ID: 25355140da1cb9ae8dc318853ec57c9d6600781b45bb687e7072d2d660b3b949
Opcode Fuzzy Hash: 738a0b8ec5ca8bc5cbd8091cb8aa9a4d90ed87dbe06c7893d721e284d2ef8229
Instruction Fuzzy Hash: 71021C12D1867681F716AE3A94413F9B3A18F7B344F588732FF69369DDDB1C64828220

Function 00007FF7B9D3B530 Relevance: 56.4, APIs: 11, Strings: 21, Instructions: 365
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyW.ADVAPI32 ref: 00007FF7B9D3B603
RegQueryValueExW.ADVAPI32 ref: 00007FF7B9D3B63D
RegQueryValueExA.ADVAPI32 ref: 00007FF7B9D3B675
RegOpenKeyW.ADVAPI32 ref: 00007FF7B9D3B735
GetLastError.KERNEL32 ref: 00007FF7B9D3B741
RegQueryValueExW.ADVAPI32 ref: 00007FF7B9D3B78E
GetLastError.KERNEL32 ref: 00007FF7B9D3B79A
RegQueryValueExA.ADVAPI32 ref: 00007FF7B9D3B7E5
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D3B867
GetLastError.KERNEL32 ref: 00007FF7B9D3BA4F
GetLastError.KERNEL32 ref: 00007FF7B9D3BA5E

Strings

NETTITUDE_VM_MEMORY: --> Memory region found: , xrefs: 00007FF7B9D3B893
Microsoft Hyper-V, xrefs: 00007FF7B9D3BA25
Hardware\ResourceMap\System Resources\Loader Reserved, xrefs: 00007FF7B9D3B56E
NETTITUDE_VM_MEMORY: Could not get reg key: , xrefs: 00007FF7B9D3B753, 00007FF7B9D3BA64
NETTITUDE_VM_MEMORY: Could not query hardware key: , xrefs: 00007FF7B9D3B7AC, 00007FF7B9D3BA55
NETTITUDE_VM_MEMORY: unknown brand, but likely VM (returned true), xrefs: 00007FF7B9D3B9D9
NETTITUDE_VM_MEMORY: Vbox detected, xrefs: 00007FF7B9D3B9EC
VirtualBox, xrefs: 00007FF7B9D3B9F8
Hardware\ResourceMap\System Resources\Reserved, xrefs: 00007FF7B9D3B55F
NETTITUDE_VM_MEMORY: Could not find memory region, returning 0., xrefs: 00007FF7B9D3BA7C
NETTITUDE_VM_MEMORY: no VM detected, xrefs: 00007FF7B9D3B99B
NETTITUDE_VM_MEMORY: Memory allocation failed for regions[i]., xrefs: 00007FF7B9D3BA46
/ , xrefs: 00007FF7B9D3B74A, 00007FF7B9D3B7A3, 00007FF7B9D3BA6E
- , xrefs: 00007FF7B9D3B88C
NETTITUDE_VM_MEMORY: Hyper-V detected, xrefs: 00007FF7B9D3BA19
NETTITUDE_VM_MEMORY: unknown error, returned false, xrefs: 00007FF7B9D3B938, 00007FF7B9D3B978
NETTITUDE_VM_MEMORY: No regions parsed, freeing allocated memory., xrefs: 00007FF7B9D3B858
Hardware\ResourceMap\System Resources\Physical Memory, xrefs: 00007FF7B9D3B549
.Translated, xrefs: 00007FF7B9D3B554
.Raw, xrefs: 00007FF7B9D3B579
NETTITUDE_VM_MEMORY: Reading data from , xrefs: 00007FF7B9D3B5CE

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ErrorLastQueryValue$Open$00007C610F020
String ID: - $ / $.Raw$.Translated$Hardware\ResourceMap\System Resources\Loader Reserved$Hardware\ResourceMap\System Resources\Physical Memory$Hardware\ResourceMap\System Resources\Reserved$Microsoft Hyper-V$NETTITUDE_VM_MEMORY: --> Memory region found: $NETTITUDE_VM_MEMORY: Could not find memory region, returning 0.$NETTITUDE_VM_MEMORY: Could not get reg key: $NETTITUDE_VM_MEMORY: Could not query hardware key: $NETTITUDE_VM_MEMORY: Hyper-V detected$NETTITUDE_VM_MEMORY: Memory allocation failed for regions[i].$NETTITUDE_VM_MEMORY: No regions parsed, freeing allocated memory.$NETTITUDE_VM_MEMORY: Reading data from $NETTITUDE_VM_MEMORY: Vbox detected$NETTITUDE_VM_MEMORY: no VM detected$NETTITUDE_VM_MEMORY: unknown brand, but likely VM (returned true)$NETTITUDE_VM_MEMORY: unknown error, returned false$VirtualBox
API String ID: 3145750536-3801651236
Opcode ID: b6dfc162a5adb2757c6c38429e54f5d4930d2c041717ae3a57232a86bf0d82c5
Instruction ID: 07d9c607134ba4d18e21eb5d7b76708e75963506417380f270cd5e0c2c9f2fdc
Opcode Fuzzy Hash: b6dfc162a5adb2757c6c38429e54f5d4930d2c041717ae3a57232a86bf0d82c5
Instruction Fuzzy Hash: B2F17032A18A4286E710AF3AE8406BCB3B4FB66749F844231DB6D57B58DF3CE555C360

Function 00007FF7B9D271B0 Relevance: 56.3, APIs: 13, Strings: 19, Instructions: 299
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF7B9D271F6
RegQueryValueExA.ADVAPI32 ref: 00007FF7B9D27248
RegCloseKey.ADVAPI32 ref: 00007FF7B9D27256

Strings

SMBIOS_string(): ret = error 2, xrefs: 00007FF7B9D2725C
SMBIOS: x2 = , xrefs: 00007FF7B9D27509
SMBIOS: x4 = , xrefs: 00007FF7B9D27573
SUN MICROSYSTEMS, xrefs: 00007FF7B9D273F6
SMBIOS_string(): p = nullptr, xrefs: 00007FF7B9D272D1
SMBIOS: x5 = , xrefs: 00007FF7B9D275A8
SYSTEM\CurrentControlSet\Services\mssmbios\Data, xrefs: 00007FF7B9D271E8
SMBIOS_string(): ret = error 3, xrefs: 00007FF7B9D2732A
SMBiosData, xrefs: 00007FF7B9D2723D, 00007FF7B9D27306
SMBIOS: x1 = , xrefs: 00007FF7B9D274D4
KVM, xrefs: 00007FF7B9D271BE
VIRTUALBOX, xrefs: 00007FF7B9D273C6
VBOXVER, xrefs: 00007FF7B9D27436
SMBIOS_string(): ret = error, xrefs: 00007FF7B9D27200
INNOTEK GMBH, xrefs: 00007FF7B9D27386
SMBIOS_string(): length = 0, xrefs: 00007FF7B9D2728D
VIRTUAL MACHINE, xrefs: 00007FF7B9D27476
SMBIOS: x3 = , xrefs: 00007FF7B9D2753E
Apple VZ, xrefs: 00007FF7B9D271B8

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Apple VZ$INNOTEK GMBH$KVM$SMBIOS: x1 = $SMBIOS: x2 = $SMBIOS: x3 = $SMBIOS: x4 = $SMBIOS: x5 = $SMBIOS_string(): length = 0$SMBIOS_string(): p = nullptr$SMBIOS_string(): ret = error$SMBIOS_string(): ret = error 2$SMBIOS_string(): ret = error 3$SMBiosData$SUN MICROSYSTEMS$SYSTEM\CurrentControlSet\Services\mssmbios\Data$VBOXVER$VIRTUAL MACHINE$VIRTUALBOX
API String ID: 3677997916-3307376029
Opcode ID: a9bc8dadc612e16e6fdf3cde058f2e6fcd6038ae532abe61841d0cd3c05ff1f7
Instruction ID: 5d679307f20d52a1485ca9d59bdeb5ab44ea8c2a9ba1f1e1e3717f32140c3fbf
Opcode Fuzzy Hash: a9bc8dadc612e16e6fdf3cde058f2e6fcd6038ae532abe61841d0cd3c05ff1f7
Instruction Fuzzy Hash: A2D11C21B0990295EB10BF6BD5802FDB3B0AF66B84FC10571DE2D57AADEE2CE505C760

Function 00007FF7B9D27660 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 165
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF7B9D276A0
RegQueryValueExA.ADVAPI32 ref: 00007FF7B9D276F2
RegCloseKey.ADVAPI32 ref: 00007FF7B9D27700

Strings

AcpiData_string(): length = 0, xrefs: 00007FF7B9D27737
AcpiData, xrefs: 00007FF7B9D276E7, 00007FF7B9D277AC
VRTUAL MICROSFT, xrefs: 00007FF7B9D27836
AcpiData_string(): ret = error 2, xrefs: 00007FF7B9D27706
AcpiData_string(): ret = error, xrefs: 00007FF7B9D276AA
AcpiData: x1 = , xrefs: 00007FF7B9D27876
SYSTEM\CurrentControlSet\Services\mssmbios\Data, xrefs: 00007FF7B9D27692
AcpiData_string(): p = nullptr, xrefs: 00007FF7B9D27777
KVM, xrefs: 00007FF7B9D2766A
AcpiData_string(): ret = error 3, xrefs: 00007FF7B9D277D0

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: AcpiData$AcpiData: x1 = $AcpiData_string(): length = 0$AcpiData_string(): p = nullptr$AcpiData_string(): ret = error$AcpiData_string(): ret = error 2$AcpiData_string(): ret = error 3$KVM$SYSTEM\CurrentControlSet\Services\mssmbios\Data$VRTUAL MICROSFT
API String ID: 3677997916-3042907882
Opcode ID: 20ec5670a66950e12626a9c13c278c8c0255b12ade70cd0f0768e6a0fc490ebb
Instruction ID: 302513e583754a19833f6d66ea6268724b82871990f4036febbfaae7894b0ff4
Opcode Fuzzy Hash: 20ec5670a66950e12626a9c13c278c8c0255b12ade70cd0f0768e6a0fc490ebb
Instruction Fuzzy Hash: 51713C21A0860295EB10BF3BD9802B9F770BF66784FC50531DB2E46AADEE3CE445C760

Function 00007FF7B9D2B100 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B9D271B0: RegOpenKeyExA.ADVAPI32 ref: 00007FF7B9D271F6

type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D2B16A
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D2B17E
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D2B192
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D2B1A6
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D2B1BA

Strings

VBOXVER, xrefs: 00007FF7B9D2B19A
INNOTEK GMBH, xrefs: 00007FF7B9D2B15E
SUN MICROSYSTEMS, xrefs: 00007FF7B9D2B186
MSSMBIOS: string = , xrefs: 00007FF7B9D2B152
VIRTUAL MACHINE, xrefs: 00007FF7B9D2B1AE
MSSMBIOS: empty, returned false, xrefs: 00007FF7B9D2B12D
VirtualBox, xrefs: 00007FF7B9D2B1DC
VIRTUALBOX, xrefs: 00007FF7B9D2B172

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: type_info::_name_internal_method$Open
String ID: INNOTEK GMBH$MSSMBIOS: empty, returned false$MSSMBIOS: string = $SUN MICROSYSTEMS$VBOXVER$VIRTUAL MACHINE$VIRTUALBOX$VirtualBox
API String ID: 1080555486-4127251607
Opcode ID: 9ec9407c6f65c8af4d10c59307482d27e90b1076899fe592d823de57c343396b
Instruction ID: ca4a24f2904540cc6355d1edc7f5ef5792c9914f4203030d8f79fc06098a6604
Opcode Fuzzy Hash: 9ec9407c6f65c8af4d10c59307482d27e90b1076899fe592d823de57c343396b
Instruction Fuzzy Hash: 7C31052190864691EA10BF2AE4910FAF370FF76784FC10276E79D476AEDE6CE505C760

Function 00007FF7B9D2BB20 Relevance: 16.6, APIs: 11, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B9D2BB31
OpenProcessToken.ADVAPI32 ref: 00007FF7B9D2BB44
GetTokenInformation.ADVAPI32 ref: 00007FF7B9D2BB70
GetLastError.KERNEL32 ref: 00007FF7B9D2BB7E
GetTokenInformation.ADVAPI32 ref: 00007FF7B9D2BBBB
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FF7B9D2BBC8
GetSidSubAuthority.ADVAPI32 ref: 00007FF7B9D2BBD9
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FF7B9D2BBE2
GetSidSubAuthority.ADVAPI32 ref: 00007FF7B9D2BBF3
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D2BC0A
CloseHandle.KERNEL32 ref: 00007FF7B9D2BC15

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Authority$Token$CountInformationProcess$00007C610CloseCurrentErrorF020HandleLastOpen
String ID:
API String ID: 4236439666-0
Opcode ID: 0e9de6c67c5272300d538b00a48be2e9738f150e2bddf2c2297e410be8e05af5
Instruction ID: 5b9243543afec56e6a439661d7a6e4f47bf708e8a891f83ff4ebed3e63b33487
Opcode Fuzzy Hash: 0e9de6c67c5272300d538b00a48be2e9738f150e2bddf2c2297e410be8e05af5
Instruction Fuzzy Hash: F8314436608A4182EB10AF2AF450279B3B0FBE6B85F954435DB9D4376CDE7DD848DB20

Function 00007FF7B9D3E3D0 Relevance: 15.5, APIs: 10, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7B9D3E528

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 57846c25743a0b82caa57dc460932768b05ec52e152d084034ccb2339f9c4b20
Instruction ID: 63d62befe80d23c6ac97f0a4fb02c76ed5906e94ced818428513cbb21c9a0838
Opcode Fuzzy Hash: 57846c25743a0b82caa57dc460932768b05ec52e152d084034ccb2339f9c4b20
Instruction Fuzzy Hash: C842B236609BC585DAA0EB1AE4943EAB3A4F7D9B80F404536DB9D83B69DF3CD054CB10

Function 00007FF7B9D3FAF0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7B9D3FB31
RegisterClassExA.USER32 ref: 00007FF7B9D3FB8A
GetSystemMetrics.USER32 ref: 00007FF7B9D3FB92
GetSystemMetrics.USER32 ref: 00007FF7B9D3FBAB
CreateWindowExA.USER32 ref: 00007FF7B9D3FC1D
ShowWindow.USER32 ref: 00007FF7B9D3FC36
UpdateWindow.USER32 ref: 00007FF7B9D3FC43

Strings

class001, xrefs: 00007FF7B9D3FB6A, 00007FF7B9D3FC14

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Window$MetricsSystem$ClassCreateHandleModuleRegisterShowUpdate
String ID: class001
API String ID: 3666473625-3656631403
Opcode ID: 45c8efa166face23d994d3120d950bd694bc15de08feefc70920a91f998e5cdb
Instruction ID: ff16720713136b6e335ddc526123f7bf9719c6566c56e7548af612a82df283d7
Opcode Fuzzy Hash: 45c8efa166face23d994d3120d950bd694bc15de08feefc70920a91f998e5cdb
Instruction Fuzzy Hash: EC312470908B4289F340EF18F854319BBB1FB66326F900139E69E46A78DF7DE048C761

Function 00007FF7B9D425F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 00007FF7B9D4284D

Strings

Welcome to , xrefs: 00007FF7B9D427CA
v2.1.1 Setup!Before starting the installation, select the folder where the files will be installed, xrefs: 00007FF7B9D427DE
FrghcZrah, xrefs: 00007FF7B9D4260B
Fortexternal, xrefs: 00007FF7B9D427C3, 00007FF7B9D4280A
A, xrefs: 00007FF7B9D426D6
v2.1.1 Setup, xrefs: 00007FF7B9D42803

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Message
String ID: v2.1.1 Setup$ v2.1.1 Setup!Before starting the installation, select the folder where the files will be installed$A$Fortexternal$FrghcZrah$Welcome to
API String ID: 2030045667-1735258037
Opcode ID: 502e21ed95d8edbbd08a0e21f9844908fc788f407ae1fdbb593d33140f28ae37
Instruction ID: 5686775359f12e829b5e0de6c5274f4ee1d965338e0451218270b0b712ec50ce
Opcode Fuzzy Hash: 502e21ed95d8edbbd08a0e21f9844908fc788f407ae1fdbb593d33140f28ae37
Instruction Fuzzy Hash: A071442160DB8681E660FF1AE4912AEF770EBA6740F804575E7DD4376EDE2CD154CB20

Function 0000018CD0A57C70 Relevance: 7.7, APIs: 5, Instructions: 166processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000018CD0A57C9D
Process32NextW.KERNEL32 ref: 0000018CD0A57D1F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A57D8C
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A57DC5
Process32NextW.KERNEL32 ref: 0000018CD0A57E6E

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyNextProcess32Queue::StructuredWork$CreateSnapshotToolhelp32
String ID:
API String ID: 2993956496-0
Opcode ID: cda064d539c10c29528c2b050225b0f33b3c6188d9bddf336ad214a47eda79a8
Instruction ID: 0dbd5a67a1b61314119bbc41e9f78141e4531219eec71b23e7a17a14290bb408
Opcode Fuzzy Hash: cda064d539c10c29528c2b050225b0f33b3c6188d9bddf336ad214a47eda79a8
Instruction Fuzzy Hash: 4851F030118B888FE3A5FB68C4597DEB7E1FB94341F408A2DA48ED3191DE749A45CBD2

Function 0000018CD0A0C10B Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 0000018CD09D9D50: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D9D6D

Part of subcall function 0000018CD09D9CF0: char_traits.LIBCPMTD ref: 0000018CD09D9D1D

type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A0C197

Strings

, xrefs: 0000018CD0A0C3A1
(, xrefs: 0000018CD0A0C2C1
6, xrefs: 0000018CD0A0C2B6

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkchar_traitstype_info::_name_internal_method
String ID: $($6
API String ID: 3658640466-549421847
Opcode ID: b273bf499dd8d0ebcba23f5732f8c2a60209c198f2955c00c5a6569d793ba4f8
Instruction ID: e7f654c2a2aa8152281ac1a3eb0be8c70268547d50f19c1963fd580ea501d4be
Opcode Fuzzy Hash: b273bf499dd8d0ebcba23f5732f8c2a60209c198f2955c00c5a6569d793ba4f8
Instruction Fuzzy Hash: 32B10E705187888FE7A4EF28D45879AB7E1FBD8301F10892DE48ED3261DF749985CB42

Function 00007FF7B9D29860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00007FF7B9D29888

Strings

MEMORY: ram size (GB) = , xrefs: 00007FF7B9D29893
MEMORY: minimum ram size (GB) = , xrefs: 00007FF7B9D298A4
@, xrefs: 00007FF7B9D29871

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @$MEMORY: minimum ram size (GB) = $MEMORY: ram size (GB) =
API String ID: 1890195054-3825315669
Opcode ID: cb95737e2131167ce7c116ff6f5570ef34a38f14c5e268c17c826d7782230c28
Instruction ID: d4eadaa35327fd992133a36df3e54fcffba3e6cf0dde7f3e55b967d9df03fa82
Opcode Fuzzy Hash: cb95737e2131167ce7c116ff6f5570ef34a38f14c5e268c17c826d7782230c28
Instruction Fuzzy Hash: F3F01D12D2868182E620EB25E4513AAA320FBF9308F915335E78D1156A9F7CD294CB04

Function 00007FF7B9D3FC80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

00007FF8A8DA5F50.D3D9 ref: 00007FF7B9D3FC8B
00007FF8C6120A60.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7B9D3FD26

Strings

@, xrefs: 00007FF7B9D3FD6E

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007$C6120
String ID: @
API String ID: 1426610437-2766056989
Opcode ID: 991ffe63f21f85b24b5298cd2c75ca9fb1720fe7d4a8edb26be3e52ca2e0c382
Instruction ID: 7daf679317ad8e2610b44c2b21493669c7b6750720b03669b506932f5ee8da50
Opcode Fuzzy Hash: 991ffe63f21f85b24b5298cd2c75ca9fb1720fe7d4a8edb26be3e52ca2e0c382
Instruction Fuzzy Hash: DD31693090C6468AF640AF19F844375BBB1BB26366FD00436E76E876A8DF7DE0148B21

Function 00007FF7B9D3BE40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22timeCOMMON

Download Yara Rule

APIs

BuildCommDCBAndTimeoutsA.KERNEL32 ref: 00007FF7B9D3BE71

Strings

DEVICE_STRING: BuildCommDCBAndTimeouts failed, xrefs: 00007FF7B9D3BE82
jhl46745fghb, xrefs: 00007FF7B9D3BE5C

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: BuildCommTimeouts
String ID: DEVICE_STRING: BuildCommDCBAndTimeouts failed$jhl46745fghb
API String ID: 767211813-2821685329
Opcode ID: b9c1969fa602e22e9fa53414d89f50a7e380734bfafa6d15187410cb725ead4d
Instruction ID: a6155f83c4833885669161f768d5107db6b3af4ecf957b4dc693caa00ddb3bab
Opcode Fuzzy Hash: b9c1969fa602e22e9fa53414d89f50a7e380734bfafa6d15187410cb725ead4d
Instruction Fuzzy Hash: CFF05462D1868192D750AF25E8410A6B370FBF6304FD01336E7DD41518EF2CD294CB10

Function 00007FF7B9D294C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21stringshareCOMMON

Download Yara Rule

APIs

WNetGetProviderNameA.MPR ref: 00007FF7B9D294E8
lstrcmpi.KERNEL32 ref: 00007FF7B9D294FC

Strings

VirtualBox Shared Folders, xrefs: 00007FF7B9D294F2

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: NameProviderlstrcmpi
String ID: VirtualBox Shared Folders
API String ID: 764303764-2247368375
Opcode ID: 9666dd2d35de983f44a068dfddf259965da6d4e777f6586b3461f0ca28601bb3
Instruction ID: 03896649d486d73002f879f414585211ac2e1ac46af6330ea0a8917ac34fe953
Opcode Fuzzy Hash: 9666dd2d35de983f44a068dfddf259965da6d4e777f6586b3461f0ca28601bb3
Instruction Fuzzy Hash: 08E06D60B1824242EB446F66A8542B6B3619F6A782F842034DA6E0639ADE2CD0888660

Function 0000018CD0A300B0 Relevance: 4.7, APIs: 3, Instructions: 233fileCOMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A30150

Part of subcall function 0000018CD09E6960: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09E698B
Part of subcall function 0000018CD09E6960: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09E699A

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A301B6
CreateFileA.KERNEL32 ref: 0000018CD0A301E2

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CreateFiletype_info::_name_internal_method
String ID:
API String ID: 645652700-0
Opcode ID: e248a6b82cf4aec8662e0933d984d0cfbcd3271811f0d44bcce99a8d166e2ec9
Instruction ID: ea6bdb1a55cc647f5245e0c0583334443953b0d412348f9b643c733bb49c982c
Opcode Fuzzy Hash: e248a6b82cf4aec8662e0933d984d0cfbcd3271811f0d44bcce99a8d166e2ec9
Instruction Fuzzy Hash: B9813F30219A488FE7A4FB6CC855BDAB6E1FB99350F408B6DA08DC32D1DE78D941C791

Function 0000018CD0A44F30 Relevance: 4.7, APIs: 3, Instructions: 168fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A44FC3
CreateFileA.KERNEL32 ref: 0000018CD0A44FF2
ReadFile.KERNEL32 ref: 0000018CD0A4511B

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: File$Concurrency::details::CreateEmptyQueue::ReadStructuredWork
String ID:
API String ID: 586831839-0
Opcode ID: 8022de37f145b5f9bb6a0e8e3bf41ff14ad3d21cfc4c3bdd9297373e77cd7af7
Instruction ID: 65fcd22cf3b4031f7565db21093ecfcf352e8ddfda35395406f6b8a612be4ff3
Opcode Fuzzy Hash: 8022de37f145b5f9bb6a0e8e3bf41ff14ad3d21cfc4c3bdd9297373e77cd7af7
Instruction Fuzzy Hash: 22514E34218A488FD7A4FB7CC448B9AB7E1FB99315F404A6DE09DC32A2CB74D841CB52

Function 00007FF7B9D75666 Relevance: 4.6, APIs: 3, Instructions: 108COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7B9D756A4
__scrt_release_startup_lock.LIBCMT ref: 00007FF7B9D75712
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7B9D75765

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 1152625263-0
Opcode ID: 9c9967786d22e20120ddc5396a9452d7846eb8e5bf762a6f8b1123a6b460551d
Instruction ID: 64883bc54c66f34983068ca54186fbd9c1bebd25b31938395143f682918200a5
Opcode Fuzzy Hash: 9c9967786d22e20120ddc5396a9452d7846eb8e5bf762a6f8b1123a6b460551d
Instruction Fuzzy Hash: E2412925E0820796FA14BF6E94516B9B2B19F63384FC44435EB3D0B2DBDE6CE8058372

Function 0000018CD09D4320 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D434C
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D435E

Part of subcall function 0000018CD09D4FA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D4FBD

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D439B

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: bef93216a5cdc46df89385e4b30e3914c4be7f6043964fe147bc280cc6ba4d5d
Instruction ID: 7f207ca27bcadd4ba02be41f0eb460b60b9ab40248a6268743a7eb419b9d2a73
Opcode Fuzzy Hash: bef93216a5cdc46df89385e4b30e3914c4be7f6043964fe147bc280cc6ba4d5d
Instruction Fuzzy Hash: 8F31EC30558B889FD794FF58D495B9AB7E1FB95341F408A2EB08AC32A1DF309544CB92

Function 0000018CD0A30C20 Relevance: 4.6, APIs: 3, Instructions: 80fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A30C66
CreateFileA.KERNEL32 ref: 0000018CD0A30C95
ReadFile.KERNEL32 ref: 0000018CD0A30CC4

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: File$Concurrency::details::CreateEmptyQueue::ReadStructuredWork
String ID:
API String ID: 586831839-0
Opcode ID: 6c2901cf9fae4a6ee5c2c46fe4ed0039bd8d4d1fe78faa1283bd7f7b9a450a4e
Instruction ID: fc1f2cd3060f0dc3d716b7e1d8250ae3d29e13863b6c54b15d1ee2cf45e829ba
Opcode Fuzzy Hash: 6c2901cf9fae4a6ee5c2c46fe4ed0039bd8d4d1fe78faa1283bd7f7b9a450a4e
Instruction Fuzzy Hash: E821F670618B488FDB94EF5CC498B9ABBE0FB99345F50892DE089C3361DB75D944CB82

Function 0000018CD0A30B80 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A30BA7
CreateFileA.KERNEL32 ref: 0000018CD0A30BD6
ReadFile.KERNEL32 ref: 0000018CD0A30BFE

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: File$Concurrency::details::CreateEmptyQueue::ReadStructuredWork
String ID:
API String ID: 586831839-0
Opcode ID: 30b54bdd398c5e0e108ebc44df4760cb55c0c9a6a79d4b406b6f7accacbe0ef0
Instruction ID: 89a142275c10d3a9bed9c9aacf0fc0dcc95519f6517623906b3c3e47e17d6504
Opcode Fuzzy Hash: 30b54bdd398c5e0e108ebc44df4760cb55c0c9a6a79d4b406b6f7accacbe0ef0
Instruction Fuzzy Hash: E1011374618B498FD744EF28C45875ABBE0FB99344F50092CF18AC32A0CB79D945CB82

Function 00007FF7B9D3FEB0 Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32 ref: 00007FF7B9D3FEC9
TranslateMessage.USER32 ref: 00007FF7B9D3FED8
DispatchMessageA.USER32 ref: 00007FF7B9D3FEE3

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 53c80a60326bf4277902b5ba57e075ee2f45383e5c27a6bacf064c3df014f86e
Instruction ID: 6f91fc57465a334385e812a926949f9bfde998f4f142ec2eaf782fcacba97607
Opcode Fuzzy Hash: 53c80a60326bf4277902b5ba57e075ee2f45383e5c27a6bacf064c3df014f86e
Instruction Fuzzy Hash: 5201712292C09282F3507F2EA400679BA70AFB3342FE05031F7AE4159DCF2CD4088B20

Function 00007FF7B9D04DB0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D04F6B

Strings

gfff, xrefs: 00007FF7B9D04DF0

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: gfff
API String ID: 1173767890-1553575800
Opcode ID: 7fefd649bd36ccc6316c0ddbd6f5b51fba6c1e4e566970a254f26842b6cc1820
Instruction ID: 36d84ff06f350d7dc9613a4e0dd33340b3a393710242a3f2ac979d3694b146fe
Opcode Fuzzy Hash: 7fefd649bd36ccc6316c0ddbd6f5b51fba6c1e4e566970a254f26842b6cc1820
Instruction Fuzzy Hash: 67518623708A8586D7059F3D99112ADFBB2FB99B80F898236DB5883799DB3CD151C700

Function 00007FF7B9D2AF10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D2AFFD

Strings

BIOS_SERIAL: , xrefs: 00007FF7B9D2AF91

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: type_info::_name_internal_method
String ID: BIOS_SERIAL:
API String ID: 3713626258-1489451444
Opcode ID: 44a71360ac8d893b8848fb34471b87a8009112b1bcacbd30c2d0b8509466b465
Instruction ID: 5dbe21c6f6d11836e471ce62c141c58a5919e75dbe1b83e3bda1ed454a00a3fd
Opcode Fuzzy Hash: 44a71360ac8d893b8848fb34471b87a8009112b1bcacbd30c2d0b8509466b465
Instruction Fuzzy Hash: 24313C2261848291DA60BF2AD4512EAF331EFA3354FC05672E7BD476EEEE1CD508C760

Function 00007FF7B9D26D10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetSystemFirmwareTable.KERNEL32 ref: 00007FF7B9D26D71

Strings

BMSR, xrefs: 00007FF7B9D26D6C

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: FirmwareSystemTable
String ID: BMSR
API String ID: 3847969577-2095607670
Opcode ID: 763e229d690b17c50dfee65e3deef3462a3de6819e9c59d9d29a4c6483e7faf9
Instruction ID: fd3163827311e2e3d6b7f1e21c0c5cbd34ba2350df16888c848ee8f8f05a5755
Opcode Fuzzy Hash: 763e229d690b17c50dfee65e3deef3462a3de6819e9c59d9d29a4c6483e7faf9
Instruction Fuzzy Hash: 76F03015A5540162E700BFBEC8526E97270EFB7705FC62870DB5D863BA9D18D974C330

Function 00007FF7B9D3D230 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B9D27660: RegOpenKeyExA.ADVAPI32 ref: 00007FF7B9D276A0

type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D3D24A

Strings

VRTUAL MICROSFT, xrefs: 00007FF7B9D3D240

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Opentype_info::_name_internal_method
String ID: VRTUAL MICROSFT
API String ID: 2371418967-238242141
Opcode ID: 1a0dc0d8de081a98e062db0fba3825bcadd818b63835f4682ed62964f601ee65
Instruction ID: 7c3fa93c17b2d34869d9ce74a6573f80ff1d652acffa5bf7baf817b2bf1cfab0
Opcode Fuzzy Hash: 1a0dc0d8de081a98e062db0fba3825bcadd818b63835f4682ed62964f601ee65
Instruction Fuzzy Hash: 50D05B41E1465551E910FB2AA4510B9B3B47B75341FC00171EAAD4539A5E1CD1589630

Function 00007FF7B9D25530 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF7B9D25631
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF7B9D256F8

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardware
String ID:
API String ID: 264382594-0
Opcode ID: 915c349a786ca2335b097b90c917e13e1d2de0ea33939b1e0949c16fa7b5d77b
Instruction ID: b1ae93b243956833f991ad93f7d2f3a4cc3e40e7acb58a31c0a3774fc23879c9
Opcode Fuzzy Hash: 915c349a786ca2335b097b90c917e13e1d2de0ea33939b1e0949c16fa7b5d77b
Instruction Fuzzy Hash: A9518E22A18AC489E711EF39D8512ED7370FBAA388F805132EB5D5BA5EDF24D684C750

Function 0000018CD0A30AA0 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A30AC0
CreateFileA.KERNEL32 ref: 0000018CD0A30AEF

Part of subcall function 0000018CD09D9D50: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D9D6D

Part of subcall function 0000018CD0A300B0: type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A30150
Part of subcall function 0000018CD0A300B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A301B6
Part of subcall function 0000018CD0A300B0: CreateFileA.KERNEL32 ref: 0000018CD0A301E2

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CreateFile$type_info::_name_internal_method
String ID:
API String ID: 2627539804-0
Opcode ID: 66dc4352644fb39c41e32687cb154f41af14c51800980190c7ef5b3828ae6510
Instruction ID: 2ef8188aa6f0e32d6bdd763da8f57b2c0175329b645007c394f0cbb4d2d2153b
Opcode Fuzzy Hash: 66dc4352644fb39c41e32687cb154f41af14c51800980190c7ef5b3828ae6510
Instruction Fuzzy Hash: B3115E70518B498FE794EF6CC44876AB7E1FB99341F40892DA08DC3261CF78C9458B42

Function 0000018CD0A0F730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A0F73E
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0000018CD09EA822), ref: 0000018CD0A0F746

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: AttributesConcurrency::details::EmptyFileQueue::StructuredWork
String ID:
API String ID: 2598825241-0
Opcode ID: 2f5f73432490f0b7bb0ee4a828737b59b857389238a0ee4c57c708ff50b01084
Instruction ID: 080c04fe6e79028c53ed6c1b2bb43f39fdc28f66edeeaa5a9890829e6f4b836b
Opcode Fuzzy Hash: 2f5f73432490f0b7bb0ee4a828737b59b857389238a0ee4c57c708ff50b01084
Instruction Fuzzy Hash: 4DF06D3441C7848BD304EB69C50435ABBE0AB88399F044B6DF4CCE22E1CA38CA40CBA7

Function 00007FF7B9D75268 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B9D75298

Part of subcall function 00007FF7B9D75A98: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B9D75AA1

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B9D7529E

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 4bf44a644cbdaa5e12bb263f9c12021ee5affa79afd5f6ded76c6f993f72c016
Instruction ID: 3d9d76d67d9c518e931e1a9c799c4c8e8e25dc24f73243104f52e3cce9dacfdf
Opcode Fuzzy Hash: 4bf44a644cbdaa5e12bb263f9c12021ee5affa79afd5f6ded76c6f993f72c016
Instruction Fuzzy Hash: E2E0BD40E0920B15FD683AAB14060B8B2600F3B3B1E9C1B30AF7D052CBAE1CF4958272

Function 00007FF7B9D3D8A0 Relevance: 1.7, APIs: 1, Instructions: 199libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7B9D3DAEE

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0687a482410035a8978432453c5d728bbb6bc986c65ef01f96900fa291c08832
Instruction ID: a919241730823e1b7e0de777e489b40152dae234ab15e72e1e760a4fe31e87f4
Opcode Fuzzy Hash: 0687a482410035a8978432453c5d728bbb6bc986c65ef01f96900fa291c08832
Instruction Fuzzy Hash: 69A1A336619B8486DA60CF1EE49032AB7B4F7C9B94F504126EB8E87B68DF3CD454CB10

Function 00007FF7B9D3D3C0 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

bool_.LIBCPMTD ref: 00007FF7B9D3D42C

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: bool_
String ID:
API String ID: 931319990-0
Opcode ID: 4808edcfb64220a5ceca033581b3eb4bd5ab40c4be1c6dc991171f04a6153b90
Instruction ID: eec3ec4cd6a9454794213fe4017ad5e34da7e638804d2f85c2f34110a8f32af2
Opcode Fuzzy Hash: 4808edcfb64220a5ceca033581b3eb4bd5ab40c4be1c6dc991171f04a6153b90
Instruction Fuzzy Hash: A2718202A0C19254EB00BF6A84501F9BB72AF73399FC44472EB6D476AEDE2CE545C730

Function 0000018CD0A76E8C Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000018CD0A76EBC

Part of subcall function 0000018CD0A77968: std::bad_alloc::bad_alloc.LIBCMT ref: 0000018CD0A77971

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: f48cfa7930f0ddce42e58cf789f45ebcf1c87a0612e1877a4db9259442bbaab9
Instruction ID: bbca68a1504601c9c6f1de39b0f1926f0ace813f7f60d082a278eb6a3517951f
Opcode Fuzzy Hash: f48cfa7930f0ddce42e58cf789f45ebcf1c87a0612e1877a4db9259442bbaab9
Instruction Fuzzy Hash: 6E014B342219094AFAD8B3FD89D57F931D5ABC83C2F54C638942EC65D2ED748A4483F0

Function 00007FF7B9D5B8F0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B9D5B913

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 324b028164ce659bd4321cdfed0d5a05db046116a268a26fbb4cf24176ffb005
Instruction ID: 73a493c99669f2e21e3bcc9c4d76a31abe46fdfeebfd9e628d9652e1eea0348b
Opcode Fuzzy Hash: 324b028164ce659bd4321cdfed0d5a05db046116a268a26fbb4cf24176ffb005
Instruction Fuzzy Hash: 85010062619F4681DA60AF2EE44032AF3B4FB99798F801331EAED4279CDF2CD5518B14

Function 0000018CD0A7690C Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,0000018CD0A0EE2E), ref: 0000018CD0A76910

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 2151f04ad4f3028fd56626963d94714cc72099908dd723b388d2c0e007f8948f
Instruction ID: cce09a252f698750fe000f85c55629cee26cc31baaa818e605636d318cb77cbe
Opcode Fuzzy Hash: 2151f04ad4f3028fd56626963d94714cc72099908dd723b388d2c0e007f8948f
Instruction Fuzzy Hash: 90C08C20A2280A8AEA443BBA4C4926136D0A348242F88C024C80CC0150FD2E82E083A6

Non-executed Functions

Function 00007FF7B9D289A0 Relevance: 75.2, Strings: 60, Instructions: 215COMMON

Download Yara Rule

Strings

Virtual PC, xrefs: 00007FF7B9D28B9F, 00007FF7B9D28BB6, 00007FF7B9D28BCD, 00007FF7B9D28BE4, 00007FF7B9D28BFB
HKLM\SYSTEM\ControlSet001\Services\vmicexchange, xrefs: 00007FF7B9D28A56
HKLM\SYSTEM\ControlSet001\Services\vpcuhub, xrefs: 00007FF7B9D28BDD
HKLM\SYSTEM\CurrentControlSet\Services\SbieDrv, xrefs: 00007FF7B9D28A84
HKLM\SYSTEM\ControlSet001\Services\vmicheartbeat, xrefs: 00007FF7B9D28A11
HKLM\SOFTWARE\Microsoft\VirtualMachine, xrefs: 00007FF7B9D289E3
HKLM\SYSTEM\ControlSet001\Services\vpcbus, xrefs: 00007FF7B9D28BAF
HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_IDE_Hard_Drive*, xrefs: 00007FF7B9D28D1F
HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE*, xrefs: 00007FF7B9D28AB2
HKLM\SOFTWARE\Wine, xrefs: 00007FF7B9D28D64
HKLM\SYSTEM\ControlSet001\Services\VMTools, xrefs: 00007FF7B9D28C7E
HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_IDE_CD*, xrefs: 00007FF7B9D28CF1
HKLM\SYSTEM\ControlSet001\Services\xensvc, xrefs: 00007FF7B9D28E05
HKLM\SYSTEM\ControlSet001\Services\xenvdb, xrefs: 00007FF7B9D28E1C
HKLM\SYSTEM\ControlSet001\Services\vmx86, xrefs: 00007FF7B9D28CDA
HKLM\SYSTEM\ControlSet001\Services\vmicvss, xrefs: 00007FF7B9D28A28
HKLM\SYSTEM\ControlSet001\Services\VBoxMouse, xrefs: 00007FF7B9D28B3C
HKLM\Software\Classes\Folder\shell\sandbox, xrefs: 00007FF7B9D289B1
VMware, xrefs: 00007FF7B9D28C12, 00007FF7B9D28C29, 00007FF7B9D28C40, 00007FF7B9D28C57, 00007FF7B9D28C6E, 00007FF7B9D28C85, 00007FF7B9D28C9C, 00007FF7B9D28CB3, 00007FF7B9D28CCA, 00007FF7B9D28CE1, 00007FF7B9D28CF8, 00007FF7B9D28D0F, 00007FF7B9D28D26, 00007FF7B9D28D3D
HKLM\SYSTEM\ControlSet001\Services\vpc-s3, xrefs: 00007FF7B9D28BC6
HKLM\HARDWARE\ACPI\RSDT\xen, xrefs: 00007FF7B9D28DA9
HKLM\SYSTEM\ControlSet001\Services\xenevtchn, xrefs: 00007FF7B9D28DC0
HKLM\SYSTEM\ControlSet001\Services\VBoxSF, xrefs: 00007FF7B9D28B6A
Sandboxie, xrefs: 00007FF7B9D28A8B, 00007FF7B9D28AA2
HKLM\SYSTEM\ControlSet001\Services\vmware, xrefs: 00007FF7B9D28CAC
HKLM\SYSTEM\ControlSet001\Services\xennet6, xrefs: 00007FF7B9D28DEE
HKCU\SOFTWARE\Wine, xrefs: 00007FF7B9D28D4D
HKLM\SYSTEM\ControlSet001\Services\VBoxService, xrefs: 00007FF7B9D28B53
HKLM\SYSTEM\ControlSet001\Services\xennet, xrefs: 00007FF7B9D28DD7
VirtualBox, xrefs: 00007FF7B9D28AB9, 00007FF7B9D28AD0, 00007FF7B9D28AE7, 00007FF7B9D28AFE, 00007FF7B9D28B15, 00007FF7B9D28B2C, 00007FF7B9D28B43, 00007FF7B9D28B5A, 00007FF7B9D28B71, 00007FF7B9D28B88
HKLM\SYSTEM\ControlSet001\Services\vmicshutdown, xrefs: 00007FF7B9D28A3F
HKLM\SOFTWARE\VMware, Inc.\VMware Tools, xrefs: 00007FF7B9D28C39
HKLM\SYSTEM\ControlSet001\Services\VMMEMCTL, xrefs: 00007FF7B9D28C95
HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters, xrefs: 00007FF7B9D289FA
HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_5333*, xrefs: 00007FF7B9D28B98
HKLM\SYSTEM\ControlSet001\Services\VBoxGuest, xrefs: 00007FF7B9D28B25
Parallels, xrefs: 00007FF7B9D28A74
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie, xrefs: 00007FF7B9D28A9B
score = , xrefs: 00007FF7B9D28E38
HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_SATA_CD*, xrefs: 00007FF7B9D28D08
HKLM\HARDWARE\ACPI\DSDT\VBOX__, xrefs: 00007FF7B9D28AC9
HKLM\HARDWARE\ACPI\FADT\VBOX__, xrefs: 00007FF7B9D28AE0
HKCU\SOFTWARE\VMware, Inc.\VMware Tools, xrefs: 00007FF7B9D28C22
HKLM\SYSTEM\ControlSet001\Services\msvmmouf, xrefs: 00007FF7B9D28BF4
HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_1AB8*, xrefs: 00007FF7B9D28A6D
Xen HVM, xrefs: 00007FF7B9D28D82, 00007FF7B9D28D99, 00007FF7B9D28DB0, 00007FF7B9D28DC7, 00007FF7B9D28DDE, 00007FF7B9D28DF5, 00007FF7B9D28E0C, 00007FF7B9D28E23
HKLM\SYSTEM\ControlSet001\Services\vmmouse, xrefs: 00007FF7B9D28C67
HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_SATA_Hard_Drive*, xrefs: 00007FF7B9D28D36
HKLM\HARDWARE\ACPI\FADT\xen, xrefs: 00007FF7B9D28D92
Microsoft Hyper-V, xrefs: 00007FF7B9D289D3, 00007FF7B9D289EA, 00007FF7B9D28A01, 00007FF7B9D28A18, 00007FF7B9D28A2F, 00007FF7B9D28A46, 00007FF7B9D28A5D
HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD*, xrefs: 00007FF7B9D28C0B
HKLM\SYSTEM\ControlSet001\Services\vmdebug, xrefs: 00007FF7B9D28C50
Wine, xrefs: 00007FF7B9D28D54, 00007FF7B9D28D6B
HKLM\SOFTWARE\Microsoft\Hyper-V, xrefs: 00007FF7B9D289CC
HKLM\HARDWARE\ACPI\DSDT\xen, xrefs: 00007FF7B9D28D7B
REGISTRY: , xrefs: 00007FF7B9D28E3F
HKLM\SYSTEM\ControlSet001\Services\vmci, xrefs: 00007FF7B9D28CC3
HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions, xrefs: 00007FF7B9D28B0E
HKLM\HARDWARE\ACPI\RSDT\VBOX__, xrefs: 00007FF7B9D28AF7
HKLM\SYSTEM\ControlSet001\Services\VBoxVideo, xrefs: 00007FF7B9D28B81

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ByteCharMultiProcessWide$CloseCurrentOpenWow64
String ID: HKCU\SOFTWARE\VMware, Inc.\VMware Tools$HKCU\SOFTWARE\Wine$HKLM\HARDWARE\ACPI\DSDT\VBOX__$HKLM\HARDWARE\ACPI\DSDT\xen$HKLM\HARDWARE\ACPI\FADT\VBOX__$HKLM\HARDWARE\ACPI\FADT\xen$HKLM\HARDWARE\ACPI\RSDT\VBOX__$HKLM\HARDWARE\ACPI\RSDT\xen$HKLM\SOFTWARE\Microsoft\Hyper-V$HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters$HKLM\SOFTWARE\Microsoft\VirtualMachine$HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie$HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions$HKLM\SOFTWARE\VMware, Inc.\VMware Tools$HKLM\SOFTWARE\Wine$HKLM\SYSTEM\ControlSet001\Services\VBoxGuest$HKLM\SYSTEM\ControlSet001\Services\VBoxMouse$HKLM\SYSTEM\ControlSet001\Services\VBoxSF$HKLM\SYSTEM\ControlSet001\Services\VBoxService$HKLM\SYSTEM\ControlSet001\Services\VBoxVideo$HKLM\SYSTEM\ControlSet001\Services\VMMEMCTL$HKLM\SYSTEM\ControlSet001\Services\VMTools$HKLM\SYSTEM\ControlSet001\Services\msvmmouf$HKLM\SYSTEM\ControlSet001\Services\vmci$HKLM\SYSTEM\ControlSet001\Services\vmdebug$HKLM\SYSTEM\ControlSet001\Services\vmicexchange$HKLM\SYSTEM\ControlSet001\Services\vmicheartbeat$HKLM\SYSTEM\ControlSet001\Services\vmicshutdown$HKLM\SYSTEM\ControlSet001\Services\vmicvss$HKLM\SYSTEM\ControlSet001\Services\vmmouse$HKLM\SYSTEM\ControlSet001\Services\vmware$HKLM\SYSTEM\ControlSet001\Services\vmx86$HKLM\SYSTEM\ControlSet001\Services\vpc-s3$HKLM\SYSTEM\ControlSet001\Services\vpcbus$HKLM\SYSTEM\ControlSet001\Services\vpcuhub$HKLM\SYSTEM\ControlSet001\Services\xenevtchn$HKLM\SYSTEM\ControlSet001\Services\xennet$HKLM\SYSTEM\ControlSet001\Services\xennet6$HKLM\SYSTEM\ControlSet001\Services\xensvc$HKLM\SYSTEM\ControlSet001\Services\xenvdb$HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_IDE_CD*$HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_SATA_CD*$HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_IDE_Hard_Drive*$HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_SATA_Hard_Drive*$HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD*$HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_1AB8*$HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_5333*$HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE*$HKLM\SYSTEM\CurrentControlSet\Services\SbieDrv$HKLM\Software\Classes\Folder\shell\sandbox$Microsoft Hyper-V$Parallels$REGISTRY: $Sandboxie$VMware$Virtual PC$VirtualBox$Wine$Xen HVM$score =
API String ID: 2040592378-2191361335
Opcode ID: e85c2424b1ab99701af1e4dab88bfcfa493d5b91f49b8bc877289667c10c0c82
Instruction ID: a19593c8d40bb16393f399d359540589bf1b6071ee8c63bc0eb170ccc879ed6e
Opcode Fuzzy Hash: e85c2424b1ab99701af1e4dab88bfcfa493d5b91f49b8bc877289667c10c0c82
Instruction Fuzzy Hash: 16D19451918A5BA4EA00FF6AD8850F4F735EB32348BC05572E22D164AFDE7CE15EC3A0

Function 00007FF7B9D2B220 Relevance: 72.9, Strings: 58, Instructions: 361COMMON

Download Yara Rule

Strings

DisplayName, xrefs: 00007FF7B9D2B82E
HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0, xrefs: 00007FF7B9D2B498, 00007FF7B9D2B696
VMWARE, xrefs: 00007FF7B9D2B645
VIRTUAL, xrefs: 00007FF7B9D2B4FC
Service, xrefs: 00007FF7B9D2B928, 00007FF7B9D2B949
VBOX, xrefs: 00007FF7B9D2B43F
HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0, xrefs: 00007FF7B9D2B475, 00007FF7B9D2B677
PARALLELS, xrefs: 00007FF7B9D2B36F
SystemManufacturer, xrefs: 00007FF7B9D2B420
Identifier, xrefs: 00007FF7B9D2B3CB, 00007FF7B9D2B446, 00007FF7B9D2B469, 00007FF7B9D2B48C, 00007FF7B9D2B64F, 00007FF7B9D2B66B, 00007FF7B9D2B68A
vmware tools, xrefs: 00007FF7B9D2B824
SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000, xrefs: 00007FF7B9D2B860, 00007FF7B9D2B886, 00007FF7B9D2B8AC, 00007FF7B9D2B8C8
vmx*, xrefs: 00007FF7B9D2B896
CoInstallers32, xrefs: 00007FF7B9D2B854
vmx_svga, xrefs: 00007FF7B9D2B93F
InfSection, xrefs: 00007FF7B9D2B8A0
DriverDesc, xrefs: 00007FF7B9D2B87A
HARDWARE\Description\System\BIOS, xrefs: 00007FF7B9D2B42C, 00007FF7B9D2B50F, 00007FF7B9D2B719, 00007FF7B9D2B99E
VIRTUALBOX, xrefs: 00007FF7B9D2B4D2
Anubis, xrefs: 00007FF7B9D2B2A2, 00007FF7B9D2B2C5
76487-337-8429955-22614, xrefs: 00007FF7B9D2B288
VMware, xrefs: 00007FF7B9D2B63E
SystemBiosVersion, xrefs: 00007FF7B9D2B242, 00007FF7B9D2B376, 00007FF7B9D2B3E2, 00007FF7B9D2B4AF, 00007FF7B9D2B6A9, 00007FF7B9D2B6D2
INTEL - 6040000, xrefs: 00007FF7B9D2B6C8
QEMU, xrefs: 00007FF7B9D2B3BC
HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0, xrefs: 00007FF7B9D2B3D2, 00007FF7B9D2B452, 00007FF7B9D2B65B
VideoBiosVersion, xrefs: 00007FF7B9D2B265, 00007FF7B9D2B399, 00007FF7B9D2B401, 00007FF7B9D2B4D9, 00007FF7B9D2B6EE
BOCHS, xrefs: 00007FF7B9D2B237
SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings, xrefs: 00007FF7B9D2B8E7
55274-640-2673064-23950, xrefs: 00007FF7B9D2B322
Bochs, xrefs: 00007FF7B9D2B255, 00007FF7B9D2B278
CWSandbox, xrefs: 00007FF7B9D2B2EF, 00007FF7B9D2B312
VirtualBox, xrefs: 00007FF7B9D2B459, 00007FF7B9D2B47C, 00007FF7B9D2B49F, 00007FF7B9D2B4C2, 00007FF7B9D2B4EC, 00007FF7B9D2B516, 00007FF7B9D2B539, 00007FF7B9D2B55C, 00007FF7B9D2B57F, 00007FF7B9D2B5A2, 00007FF7B9D2B5C5, 00007FF7B9D2B5E8, 00007FF7B9D2B60B, 00007FF7B9D2B62E
*vmx*, xrefs: 00007FF7B9D2B84A
SYSTEM\CurrentControlSet\Control\Video\{GUID}\Video, xrefs: 00007FF7B9D2B92F, 00007FF7B9D2B955
VMware*, xrefs: 00007FF7B9D2B870
Parallels, xrefs: 00007FF7B9D2B389, 00007FF7B9D2B3AC
SYSTEM\CurrentControlSet\Control\SystemInformation, xrefs: 00007FF7B9D2B604, 00007FF7B9D2B627, 00007FF7B9D2B906
76487-644-3177037-23510, xrefs: 00007FF7B9D2B2D5
ProductID, xrefs: 00007FF7B9D2B28F, 00007FF7B9D2B2B2, 00007FF7B9D2B2DC, 00007FF7B9D2B2FF, 00007FF7B9D2B329, 00007FF7B9D2B34C
HARDWARE\Description\System, xrefs: 00007FF7B9D2B24E, 00007FF7B9D2B271, 00007FF7B9D2B382, 00007FF7B9D2B3A5, 00007FF7B9D2B3EE, 00007FF7B9D2B40D, 00007FF7B9D2B4BB, 00007FF7B9D2B4E5, 00007FF7B9D2B6B5, 00007FF7B9D2B6DE, 00007FF7B9D2B6FA
SystemProductName, xrefs: 00007FF7B9D2B503, 00007FF7B9D2B5F8, 00007FF7B9D2B61B, 00007FF7B9D2B70D, 00007FF7B9D2B8FA, 00007FF7B9D2B992
Xen, xrefs: 00007FF7B9D2B98B
Xen HVM, xrefs: 00007FF7B9D2B9A5
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF7B9D2B2BE, 00007FF7B9D2B30B, 00007FF7B9D2B358
SYSTEM\ControlSet002\Services\Disk\Enum, xrefs: 00007FF7B9D2B578, 00007FF7B9D2B59B, 00007FF7B9D2B7B4, 00007FF7B9D2B7D3
vm3dmp, xrefs: 00007FF7B9D2B919
DeviceDesc, xrefs: 00007FF7B9D2B526, 00007FF7B9D2B56C, 00007FF7B9D2B5B2, 00007FF7B9D2B76A, 00007FF7B9D2B7A8, 00007FF7B9D2B7E6
JoeBox, xrefs: 00007FF7B9D2B33C, 00007FF7B9D2B35F
FriendlyName, xrefs: 00007FF7B9D2B549, 00007FF7B9D2B58F, 00007FF7B9D2B5D5, 00007FF7B9D2B789, 00007FF7B9D2B7C7, 00007FF7B9D2B805
VMware SVGA*, xrefs: 00007FF7B9D2B965
SYSTEM\ControlSet001\Services\Disk\Enum, xrefs: 00007FF7B9D2B532, 00007FF7B9D2B555, 00007FF7B9D2B738, 00007FF7B9D2B757, 00007FF7B9D2B776, 00007FF7B9D2B795
Device Description, xrefs: 00007FF7B9D2B8DB, 00007FF7B9D2B96F
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00007FF7B9D2B29B, 00007FF7B9D2B2E8, 00007FF7B9D2B335
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00007FF7B9D2B83A
SYSTEM\CurrentControlSet\Control\Video\{GUID}\0000, xrefs: 00007FF7B9D2B97B
ProviderName, xrefs: 00007FF7B9D2B8BC
SYSTEM\ControlSet003\Services\Disk\Enum, xrefs: 00007FF7B9D2B5BE, 00007FF7B9D2B5E1, 00007FF7B9D2B7F2, 00007FF7B9D2B811

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID: *vmx*$55274-640-2673064-23950$76487-337-8429955-22614$76487-644-3177037-23510$Anubis$BOCHS$Bochs$CWSandbox$CoInstallers32$Device Description$DeviceDesc$DisplayName$DriverDesc$FriendlyName$HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0$HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0$HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0$HARDWARE\Description\System$HARDWARE\Description\System\BIOS$INTEL - 6040000$Identifier$InfSection$JoeBox$PARALLELS$Parallels$ProductID$ProviderName$QEMU$SOFTWARE\Microsoft\Windows NT\CurrentVersion$SOFTWARE\Microsoft\Windows\CurrentVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000$SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings$SYSTEM\ControlSet001\Services\Disk\Enum$SYSTEM\ControlSet002\Services\Disk\Enum$SYSTEM\ControlSet003\Services\Disk\Enum$SYSTEM\CurrentControlSet\Control\SystemInformation$SYSTEM\CurrentControlSet\Control\Video\{GUID}\0000$SYSTEM\CurrentControlSet\Control\Video\{GUID}\Video$Service$SystemBiosVersion$SystemManufacturer$SystemProductName$VBOX$VIRTUAL$VIRTUALBOX$VMWARE$VMware$VMware SVGA*$VMware*$VideoBiosVersion$VirtualBox$Xen$Xen HVM$vm3dmp$vmware tools$vmx*$vmx_svga
API String ID: 1607946009-4064539418
Opcode ID: 97abb3deae978862e83e7b7f832f591df8230e406a9332269c8b4cb15a5ce5ba
Instruction ID: 4c47ae5dcc103285ac6cfcd0d6061bb1f9169ee91df0c2982da324e07c225825
Opcode Fuzzy Hash: 97abb3deae978862e83e7b7f832f591df8230e406a9332269c8b4cb15a5ce5ba
Instruction Fuzzy Hash: 8622A465518A47E0E710FF6AE8940E4F374FB66748BC51237E66C429AE9F3CE249C360

Function 00007FF7B9D29000 Relevance: 64.9, APIs: 4, Strings: 33, Instructions: 158COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF7B9D29176
GetLastError.KERNEL32 ref: 00007FF7B9D29181
GetFileAttributesA.KERNEL32 ref: 00007FF7B9D29264
GetLastError.KERNEL32 ref: 00007FF7B9D2926F

Strings

C:\windows\System32\vboxoglfeedbackspu.dll, xrefs: 00007FF7B9D2913A
C:\windows\System32\vboxdisp.dll, xrefs: 00007FF7B9D290ED
C:\windows\System32\vboxoglpackspu.dll, xrefs: 00007FF7B9D290C1
C:\windows\System32\Drivers\VMToolsHook.dll, xrefs: 00007FF7B9D2906E
Cuckoo, xrefs: 00007FF7B9D2927E
vbox, xrefs: 00007FF7B9D291A6
C:\windows\System32\Drivers\vm3dver.dll, xrefs: 00007FF7B9D29056
c:\windows\system32\vboxoglarrayspu.dll, xrefs: 00007FF7B9D29145
C:\windows\System32\vboxmrxnp.dll, xrefs: 00007FF7B9D29103
C:\windows\System32\Drivers\VBoxSF.sys, xrefs: 00007FF7B9D290AA
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\agent.pyw, xrefs: 00007FF7B9D2925D
VirtualBox, xrefs: 00007FF7B9D2920E
C:\windows\System32\Drivers\vmGuestLib.dll, xrefs: 00007FF7B9D2907A
VM_FILES: vmware score: , xrefs: 00007FF7B9D291ED
C:\windows\System32\Drivers\vm3dgl.dll, xrefs: 00007FF7B9D29032
C:\windows\System32\vboxhook.dll, xrefs: 00007FF7B9D290F8
VM_FILES: vbox score: , xrefs: 00007FF7B9D291FD
C:\windows\System32\vboxservice.exe, xrefs: 00007FF7B9D290D7
C:\windows\System32\Drivers\Vmmouse.sys, xrefs: 00007FF7B9D29026
C:\windows\System32\Drivers\VBoxVideo.sys, xrefs: 00007FF7B9D290B6
C:\windows\System32\vboxoglcrutil.dll, xrefs: 00007FF7B9D290E2
C:\windows\System32\Drivers\VBoxMouse.sys, xrefs: 00007FF7B9D29092
C:\windows\System32\vboxoglerrorspu.dll, xrefs: 00007FF7B9D2912F
C:\windows\System32\VBoxControl.exe, xrefs: 00007FF7B9D29124
VMware, xrefs: 00007FF7B9D2922F
C:\windows\System32\vboxoglpassthroughspu.dll, xrefs: 00007FF7B9D290CC
C:\windows\System32\Drivers\vmhgfs.dll, xrefs: 00007FF7B9D29086
C:\windows\System32\Drivers\VmGuestLibJava.dll, xrefs: 00007FF7B9D2904A
C:\windows\System32\Drivers\vmdum.dll, xrefs: 00007FF7B9D2903E
C:\windows\System32\Drivers\VBoxGuest.sys, xrefs: 00007FF7B9D2909E
C:\windows\System32\vboxtray.exe, xrefs: 00007FF7B9D29119
C:\windows\System32\vboxogl.dll, xrefs: 00007FF7B9D2910E
C:\windows\System32\Drivers\vmtray.dll, xrefs: 00007FF7B9D29062

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\agent.pyw$C:\windows\System32\Drivers\VBoxGuest.sys$C:\windows\System32\Drivers\VBoxMouse.sys$C:\windows\System32\Drivers\VBoxSF.sys$C:\windows\System32\Drivers\VBoxVideo.sys$C:\windows\System32\Drivers\VMToolsHook.dll$C:\windows\System32\Drivers\VmGuestLibJava.dll$C:\windows\System32\Drivers\Vmmouse.sys$C:\windows\System32\Drivers\vm3dgl.dll$C:\windows\System32\Drivers\vm3dver.dll$C:\windows\System32\Drivers\vmGuestLib.dll$C:\windows\System32\Drivers\vmdum.dll$C:\windows\System32\Drivers\vmhgfs.dll$C:\windows\System32\Drivers\vmtray.dll$C:\windows\System32\VBoxControl.exe$C:\windows\System32\vboxdisp.dll$C:\windows\System32\vboxhook.dll$C:\windows\System32\vboxmrxnp.dll$C:\windows\System32\vboxogl.dll$C:\windows\System32\vboxoglcrutil.dll$C:\windows\System32\vboxoglerrorspu.dll$C:\windows\System32\vboxoglfeedbackspu.dll$C:\windows\System32\vboxoglpackspu.dll$C:\windows\System32\vboxoglpassthroughspu.dll$C:\windows\System32\vboxservice.exe$C:\windows\System32\vboxtray.exe$Cuckoo$VM_FILES: vbox score: $VM_FILES: vmware score: $VMware$VirtualBox$c:\windows\system32\vboxoglarrayspu.dll$vbox
API String ID: 1799206407-1685961488
Opcode ID: 0290174d5ff5d2f8cfe651e3e3c6f03ece69e05dce5d414d17742285d3968f14
Instruction ID: 473ae50fc34038b06127b5df9c5a9bc328566d2760db313910d466b8b469c708
Opcode Fuzzy Hash: 0290174d5ff5d2f8cfe651e3e3c6f03ece69e05dce5d414d17742285d3968f14
Instruction Fuzzy Hash: 23811035909B0595EA11AF2AE8841FAF3B4FF66354BD00236DA6D1276EEF3CD544C360

Function 00007FF7B9D18C90 Relevance: 51.2, APIs: 1, Strings: 26, Instructions: 3919COMMON

Download Yara Rule

Strings

callback_data.Buf == callback_buf, xrefs: 00007FF7B9D1B783
buf[0] != 0, xrefs: 00007FF7B9D1B4BC
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF7B9D18D26, 00007FF7B9D18D4E, 00007FF7B9D18D76, 00007FF7B9D19346, 00007FF7B9D19798, 00007FF7B9D19B3E, 00007FF7B9D19BC5, 00007FF7B9D19D09, 00007FF7B9D19DFC, 00007FF7B9D1A215, 00007FF7B9D1B477, 00007FF7B9D1B4B5, 00007FF7B9D1B5A4, 00007FF7B9D1B77C, 00007FF7B9D1B79F, 00007FF7B9D1B7C2, 00007FF7B9D1B869, 00007FF7B9D1BA94, 00007FF7B9D1BB51, 00007FF7B9D1BF4E
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D19D2D, 00007FF7B9D19E20, 00007FF7B9D1A13F
@, xrefs: 00007FF7B9D1CCBA
idx <= obj->TextLen, xrefs: 00007FF7B9D19D10, 00007FF7B9D19E03
state && state->ID == id, xrefs: 00007FF7B9D1979F
apply_new_text_length >= 0, xrefs: 00007FF7B9D1BA9B
callback_data.BufTextLen == (int)strlen(callback_data.Buf), xrefs: 00007FF7B9D1B870
password_font->Glyphs.empty() && password_font->IndexAdvanceX.empty() && password_font->IndexLookup.empty(), xrefs: 00007FF7B9D19B45
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7B9D1BEA2, 00007FF7B9D1C75D
#SCROLLY, xrefs: 00007FF7B9D193C1, 00007FF7B9D193F0, 00007FF7B9D1CA36
callback != 0, xrefs: 00007FF7B9D1934D, 00007FF7B9D1B5AB
apply_new_text_length <= buf_size, xrefs: 00007FF7B9D1BB58
font->ContainerAtlas->TexID == _CmdHeader.TextureId, xrefs: 00007FF7B9D1BEA9, 00007FF7B9D1C764
!((flags & ImGuiInputTextFlags_CallbackCompletion) && (flags & ImGuiInputTextFlags_AllowTabInput)), xrefs: 00007FF7B9D18D7D
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D19832, 00007FF7B9D198A1, 00007FF7B9D198DE, 00007FF7B9D19920, 00007FF7B9D1995D, 00007FF7B9D199A8, 00007FF7B9D1A30D, 00007FF7B9D1A3A3, 00007FF7B9D1A4C1, 00007FF7B9D1A56F, 00007FF7B9D1A601, 00007FF7B9D1A69D, 00007FF7B9D1A744, 00007FF7B9D1A7EB, 00007FF7B9D1A825, 00007FF7B9D1A8D3, 00007FF7B9D1CC9F
callback_data.BufSize == state->BufCapacity, xrefs: 00007FF7B9D1B7A6
!((flags & ImGuiInputTextFlags_CallbackHistory) && (flags & ImGuiInputTextFlags_Multiline)), xrefs: 00007FF7B9D18D55
state != 0, xrefs: 00007FF7B9D19BCC, 00007FF7B9D1A21C, 00007FF7B9D1B47E, 00007FF7B9D1BF55
i >= 0 && i < Size, xrefs: 00007FF7B9D19D34, 00007FF7B9D19E27, 00007FF7B9D1A146
%*s%.*s, xrefs: 00007FF7B9D1CBA0
callback_data.Flags == flags, xrefs: 00007FF7B9D1B7C9
IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease))), xrefs: 00007FF7B9D19839, 00007FF7B9D198A8, 00007FF7B9D198E5, 00007FF7B9D19927, 00007FF7B9D19964, 00007FF7B9D199AF, 00007FF7B9D1A314, 00007FF7B9D1A3AA, 00007FF7B9D1A4C8, 00007FF7B9D1A576, 00007FF7B9D1A608, 00007FF7B9D1A6A4, 00007FF7B9D1A74B, 00007FF7B9D1A7F2, 00007FF7B9D1A82C, 00007FF7B9D1A8DA
g.DragDropActive || g.ActiveId == id || g.ActiveId == 0 || g.ActiveIdPreviousFrame == id || (g.CurrentMultiSelect != 0 && g.BoxSel, xrefs: 00007FF7B9D1CCA6
buf != 0 && buf_size >= 0, xrefs: 00007FF7B9D18D2D

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: __swprintf_l
String ID: !((flags & ImGuiInputTextFlags_CallbackCompletion) && (flags & ImGuiInputTextFlags_AllowTabInput))$!((flags & ImGuiInputTextFlags_CallbackHistory) && (flags & ImGuiInputTextFlags_Multiline))$#SCROLLY$%*s%.*s$@$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease)))$apply_new_text_length <= buf_size$apply_new_text_length >= 0$buf != 0 && buf_size >= 0$buf[0] != 0$callback != 0$callback_data.Buf == callback_buf$callback_data.BufSize == state->BufCapacity$callback_data.BufTextLen == (int)strlen(callback_data.Buf)$callback_data.Flags == flags$font->ContainerAtlas->TexID == _CmdHeader.TextureId$g.DragDropActive || g.ActiveId == id || g.ActiveId == 0 || g.ActiveIdPreviousFrame == id || (g.CurrentMultiSelect != 0 && g.BoxSel$i >= 0 && i < Size$idx <= obj->TextLen$password_font->Glyphs.empty() && password_font->IndexAdvanceX.empty() && password_font->IndexLookup.empty()$state != 0$state && state->ID == id
API String ID: 1488884202-4266151527
Opcode ID: 82cd260ef1dabcd9373d28b51aedf79a5ac843dbdd558c274ca8d5a90aca09bf
Instruction ID: 298112eaf0b1188ce00e933027080a071dbff54ee82b05e3f81ccb53772c945d
Opcode Fuzzy Hash: 82cd260ef1dabcd9373d28b51aedf79a5ac843dbdd558c274ca8d5a90aca09bf
Instruction Fuzzy Hash: AB93D133A08695CAE710EF3AD0447B9B7B0EF66748F858235DB6857699CB3CE445CB20

Function 00007FF7B9CDCA10 Relevance: 46.5, APIs: 1, Strings: 25, Instructions: 1049COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDD684

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9CDCA8F, 00007FF7B9CDCAC3, 00007FF7B9CDCB00, 00007FF7B9CDCD1A, 00007FF7B9CDCE3A, 00007FF7B9CDD4EE, 00007FF7B9CDD525, 00007FF7B9CDD558, 00007FF7B9CDD6F3, 00007FF7B9CDD7D7
g.Viewports.Size == 1, xrefs: 00007FF7B9CDCCFE
(Debug Log: Auto-disabled some ImGuiDebugLogFlags after 2 frames), xrefs: 00007FF7B9CDDBA2
GetCurrentWindowRead()->Flags & ImGuiWindowFlags_Tooltip, xrefs: 00007FF7B9CDD99C
g.CurrentWindow->IsFallbackWindow == true, xrefs: 00007FF7B9CDDC26
g.Font->IsLoaded(), xrefs: 00007FF7B9CDCE74
Right, xrefs: 00007FF7B9CDD91B
g.MovingWindow && g.MovingWindow->RootWindow, xrefs: 00007FF7B9CDD2D0
Debug##Default, xrefs: 00007FF7B9CDDBCA
GImGui != 0, xrefs: 00007FF7B9CDD315
Size > 0, xrefs: 00007FF7B9CDD7DE
it >= Data && it < Data + Size, xrefs: 00007FF7B9CDCB07
Click %s Button to break in debugger! (remap w/ Ctrl+Shift), xrefs: 00007FF7B9CDD951
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CDCA4D, 00007FF7B9CDCCF7, 00007FF7B9CDCE6D, 00007FF7B9CDD17D, 00007FF7B9CDD2C9, 00007FF7B9CDD30E, 00007FF7B9CDD995, 00007FF7B9CDDC1F
g.WindowsFocusOrder.Size <= g.Windows.Size, xrefs: 00007FF7B9CDD184
i >= 0 && i < Size, xrefs: 00007FF7B9CDCA96, 00007FF7B9CDCACA, 00007FF7B9CDCD21, 00007FF7B9CDCE41, 00007FF7B9CDD4F5, 00007FF7B9CDD52C, 00007FF7B9CDD55F, 00007FF7B9CDD6FA
gfff, xrefs: 00007FF7B9CDDD14
HoveredId: 0x%08X, xrefs: 00007FF7B9CDD8F7
Press ESC to abort picking., xrefs: 00007FF7B9CDD903
Middle, xrefs: 00007FF7B9CDD927
333?, xrefs: 00007FF7B9CDD8DE
NewFrame(): ClearActiveID() because it isn't marked alive anymore!, xrefs: 00007FF7B9CDCFC3
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7B9CDCA54
Remap w/ Ctrl+Shift: click anywhere to select new mouse button., xrefs: 00007FF7B9CDD93B
Left, xrefs: 00007FF7B9CDD90F

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: (Debug Log: Auto-disabled some ImGuiDebugLogFlags after 2 frames)$333?$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$Click %s Button to break in debugger! (remap w/ Ctrl+Shift)$Debug##Default$GImGui != 0$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$GetCurrentWindowRead()->Flags & ImGuiWindowFlags_Tooltip$HoveredId: 0x%08X$Left$Middle$NewFrame(): ClearActiveID() because it isn't marked alive anymore!$Press ESC to abort picking.$Remap w/ Ctrl+Shift: click anywhere to select new mouse button.$Right$Size > 0$g.CurrentWindow->IsFallbackWindow == true$g.Font->IsLoaded()$g.MovingWindow && g.MovingWindow->RootWindow$g.Viewports.Size == 1$g.WindowsFocusOrder.Size <= g.Windows.Size$gfff$i >= 0 && i < Size$it >= Data && it < Data + Size
API String ID: 1173767890-8291574
Opcode ID: f02d1fda5102dd22a55de268a6e8f6e89d39165ce032e9aadadad75d88d34809
Instruction ID: b7d750656ef8890873e97b15ae349ac8c40b1d7d37e6186c85c8ff07e7a86099
Opcode Fuzzy Hash: f02d1fda5102dd22a55de268a6e8f6e89d39165ce032e9aadadad75d88d34809
Instruction Fuzzy Hash: 18C29332A046C689E721EF39C8482E8B7B1EF66748F844235DB1D5BA9DDF38E545C720

Function 00007FF7B9D27A80 Relevance: 44.1, APIs: 18, Strings: 7, Instructions: 304windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7B9D27AD1
FormatMessageW.KERNEL32 ref: 00007FF7B9D27AFB
LocalFree.KERNEL32 ref: 00007FF7B9D27B15
GetLastError.KERNEL32 ref: 00007FF7B9D27B9B
FormatMessageW.KERNEL32 ref: 00007FF7B9D27BC5
LocalFree.KERNEL32 ref: 00007FF7B9D27BDF

Strings

. Error: , xrefs: 00007FF7B9D27B3D, 00007FF7B9D27C07
EvtNext failed. Error: , xrefs: 00007FF7B9D27F12
Failed to query event log: , xrefs: 00007FF7B9D27BE6
Failed to open event log: , xrefs: 00007FF7B9D27B1C
Apple VZ, xrefs: 00007FF7B9D27A92
EvtRender failed. Error: , xrefs: 00007FF7B9D27DF2, 00007FF7B9D27E82
KVM, xrefs: 00007FF7B9D27A98

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: . Error: $Apple VZ$EvtNext failed. Error: $EvtRender failed. Error: $Failed to open event log: $Failed to query event log: $KVM
API String ID: 1365068426-3889524599
Opcode ID: dcca9dbbbcdbbf84783423117cc8c4eb3f99a4f042ec37c8c2d0e3c348cfd4fc
Instruction ID: 1c4afd9e9b609f4944e9af5208c104ab27356cbc851bc9da54d7f94048c8b5ca
Opcode Fuzzy Hash: dcca9dbbbcdbbf84783423117cc8c4eb3f99a4f042ec37c8c2d0e3c348cfd4fc
Instruction Fuzzy Hash: B5D16421B1860296EB10BF7AE4501EDB3B1BFA6788F801135DE1E57BADDE3CD5088760

Function 00007FF7B9D051F0 Relevance: 41.9, APIs: 9, Strings: 14, Instructions: 1603COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D06B7F
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D06C05

Strings

src_tmp.GlyphsList.Size == src_tmp.GlyphsCount, xrefs: 00007FF7B9D05953
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D053B9, 00007FF7B9D053DE, 00007FF7B9D05464, 00007FF7B9D0550A, 00007FF7B9D05612, 00007FF7B9D05B5E, 00007FF7B9D05BA1, 00007FF7B9D05BE6, 00007FF7B9D05D28, 00007FF7B9D0629D, 00007FF7B9D065DD, 00007FF7B9D06738
src_range[0] <= src_range[1] && "Invalid range: is your glyph range array persistent? it is zero-terminated?", xrefs: 00007FF7B9D05561
font_offset >= 0 && "FontData is incorrect, or FontNo cannot be found.", xrefs: 00007FF7B9D054CC
cfg.DstFont && (!cfg.DstFont->IsLoaded() || cfg.DstFont->ContainerAtlas == atlas), xrefs: 00007FF7B9D05421
n < (Storage.Size << 5), xrefs: 00007FF7B9D05757, 00007FF7B9D057B3, 00007FF7B9D057E5
font->ConfigData == font_config, xrefs: 00007FF7B9D066C1
i >= 0 && i < Size, xrefs: 00007FF7B9D053C0, 00007FF7B9D053E5, 00007FF7B9D0546B, 00007FF7B9D05511, 00007FF7B9D05619, 00007FF7B9D05B65, 00007FF7B9D05BA8, 00007FF7B9D05BED, 00007FF7B9D05D2F, 00007FF7B9D062A4, 00007FF7B9D065E4, 00007FF7B9D0673F
atlas->ConfigData.Size > 0, xrefs: 00007FF7B9D05235
src_tmp.DstIndex != -1, xrefs: 00007FF7B9D05679
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7B9D0522E, 00007FF7B9D0541A, 00007FF7B9D054C5, 00007FF7B9D0555A, 00007FF7B9D0565F, 00007FF7B9D05680, 00007FF7B9D0594C, 00007FF7B9D05D5C, 00007FF7B9D066BA
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D05750, 00007FF7B9D057AC, 00007FF7B9D057DE
0 && "stbtt_InitFont(): failed to parse FontData. It is correct and complete? Check FontDataSize.", xrefs: 00007FF7B9D05658
glyph_index_in_font != 0, xrefs: 00007FF7B9D05D63

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: 0 && "stbtt_InitFont(): failed to parse FontData. It is correct and complete? Check FontDataSize."$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$atlas->ConfigData.Size > 0$cfg.DstFont && (!cfg.DstFont->IsLoaded() || cfg.DstFont->ContainerAtlas == atlas)$font->ConfigData == font_config$font_offset >= 0 && "FontData is incorrect, or FontNo cannot be found."$glyph_index_in_font != 0$i >= 0 && i < Size$n < (Storage.Size << 5)$src_range[0] <= src_range[1] && "Invalid range: is your glyph range array persistent? it is zero-terminated?"$src_tmp.DstIndex != -1$src_tmp.GlyphsList.Size == src_tmp.GlyphsCount
API String ID: 1173767890-2192739418
Opcode ID: 96b0dfe9140b930bccd7aed212bd33166b950b9ed14a6fa3c5e2e89d2cd8041f
Instruction ID: 2aa06d9b793701a55e14f18333292ea12498c5c9aad2a7b42517ffef845efa89
Opcode Fuzzy Hash: 96b0dfe9140b930bccd7aed212bd33166b950b9ed14a6fa3c5e2e89d2cd8041f
Instruction Fuzzy Hash: E2F20332B04A8586E754EF3AD4942BDB7B0FB6A784F848236CB5D53698DF38E485C710

Function 00007FF7B9D26290 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 00007FF7B9D262D7

Strings

ROOT\CIMV2, xrefs: 00007FF7B9D263C8
wmi: Failed to create IWbemLocator object. Error code = , xrefs: 00007FF7B9D2638C
wmi: Failed to initialize COM library. Error code = , xrefs: 00007FF7B9D262E3
wmi: Failed to initialize security. Error code = , xrefs: 00007FF7B9D2633C
wmi: Could not set proxy blanket. Error code = , xrefs: 00007FF7B9D264EE
wmi: Could not connect to WMI server. Error code = , xrefs: 00007FF7B9D2647E

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Initialize
String ID: ROOT\CIMV2$wmi: Could not connect to WMI server. Error code = $wmi: Could not set proxy blanket. Error code = $wmi: Failed to create IWbemLocator object. Error code = $wmi: Failed to initialize COM library. Error code = $wmi: Failed to initialize security. Error code =
API String ID: 2538663250-3651282067
Opcode ID: 07aabd199c2f918b609de0f2fd532f7c939ce648409a3e1c3c300f98da9fab6d
Instruction ID: 27a81353caf9398dad64809226a73406e50f7fb79609ac6f1188bd5a8111b326
Opcode Fuzzy Hash: 07aabd199c2f918b609de0f2fd532f7c939ce648409a3e1c3c300f98da9fab6d
Instruction Fuzzy Hash: 9B719021A0C74286FB10AF2AE844279B7B1BFA2714FD54136D76E436ADDF3CE4548321

Function 00007FF7B9CD9F90 Relevance: 26.8, APIs: 10, Strings: 5, Instructions: 530COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA1A9
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA27F
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA376
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA407
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA4BC
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA565
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA5F6
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA6B5
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA784
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDA889

Strings

Forgot to shutdown Platform backend?, xrefs: 00007FF7B9CD9FA9
Forgot to shutdown Renderer backend?, xrefs: 00007FF7B9CD9FE7
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CD9FC9, 00007FF7B9CDA007
(g.IO.BackendRendererUserData == 0) && "Forgot to shutdown Renderer backend?", xrefs: 00007FF7B9CDA00E
(g.IO.BackendPlatformUserData == 0) && "Forgot to shutdown Platform backend?", xrefs: 00007FF7B9CD9FD0

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: (g.IO.BackendPlatformUserData == 0) && "Forgot to shutdown Platform backend?"$(g.IO.BackendRendererUserData == 0) && "Forgot to shutdown Renderer backend?"$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Forgot to shutdown Platform backend?$Forgot to shutdown Renderer backend?
API String ID: 1173767890-2716422499
Opcode ID: e710cf4975665eba8ef502011303f7698251cc1cabcda06ac13f65d1524e8938
Instruction ID: add41b62743457ca9a8c5c11239714f9ead8290d29b38379439f9840cc85c58d
Opcode Fuzzy Hash: e710cf4975665eba8ef502011303f7698251cc1cabcda06ac13f65d1524e8938
Instruction Fuzzy Hash: 4E427132604A9292D709EF38D5981FCB3B5FB65B88F884136DB2D47668DF38E566C310

Function 00007FF7B9D0C3F0 Relevance: 24.4, Strings: 19, Instructions: 617COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D0C557, 00007FF7B9D0C722, 00007FF7B9D0CADD, 00007FF7B9D0CB2E, 00007FF7B9D0CE78, 00007FF7B9D0CEBE
table->RowPosY2 == inner_window->DC.CursorPos.y, xrefs: 00007FF7B9D0C5D4
table != 0 && "Only call EndTable() if BeginTable() returns true!", xrefs: 00007FF7B9D0C44D
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7B9D0C446, 00007FF7B9D0C498, 00007FF7B9D0C4C0, 00007FF7B9D0C5CD, 00007FF7B9D0CB5E, 00007FF7B9D0CBAA, 00007FF7B9D0CCE5, 00007FF7B9D0CE1D, 00007FF7B9D0CE40
p >= Buf.Data && p < Buf.Data + Buf.Size, xrefs: 00007FF7B9D0CF47
(inner_window->IDStack.back() == table_instance->TableInstanceID) && "Mismatching PushID/PopID!", xrefs: 00007FF7B9D0CB65
inner_window == g.CurrentWindow, xrefs: 00007FF7B9D0C49F
Calling PopStyleColor() too many times!, xrefs: 00007FF7B9D0C3F7
g.TablesTempDataStacked > 0, xrefs: 00007FF7B9D0CE47
i >= 0 && i < Size, xrefs: 00007FF7B9D0C55E, 00007FF7B9D0CE7F, 00007FF7B9D0CEC5
Mismatching PushID/PopID!, xrefs: 00007FF7B9D0CB0F
g.CurrentWindow == outer_window && g.CurrentTable == table, xrefs: 00007FF7B9D0CE24
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D0C69E, 00007FF7B9D0C81E, 00007FF7B9D0C9B3, 00007FF7B9D0CA3D, 00007FF7B9D0CF40
(table->Flags & ImGuiTableFlags_ScrollX) == 0, xrefs: 00007FF7B9D0CCEC
Too many PopItemWidth!, xrefs: 00007FF7B9D0CB83
(outer_window->DC.ItemWidthStack.Size >= temp_data->HostBackupItemWidthStackSize) && "Too many PopItemWidth!", xrefs: 00007FF7B9D0CBB1
Size > 0, xrefs: 00007FF7B9D0C729, 00007FF7B9D0CAE4, 00007FF7B9D0CB35
outer_window == inner_window || outer_window == inner_window->ParentWindow, xrefs: 00007FF7B9D0C4C7
p >= Data && p < DataEnd, xrefs: 00007FF7B9D0C6A5, 00007FF7B9D0C825, 00007FF7B9D0C9BA, 00007FF7B9D0CA44

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: (inner_window->IDStack.back() == table_instance->TableInstanceID) && "Mismatching PushID/PopID!"$(outer_window->DC.ItemWidthStack.Size >= temp_data->HostBackupItemWidthStackSize) && "Too many PopItemWidth!"$(table->Flags & ImGuiTableFlags_ScrollX) == 0$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$Calling PopStyleColor() too many times!$Mismatching PushID/PopID!$Size > 0$Too many PopItemWidth!$g.CurrentWindow == outer_window && g.CurrentTable == table$g.TablesTempDataStacked > 0$i >= 0 && i < Size$inner_window == g.CurrentWindow$outer_window == inner_window || outer_window == inner_window->ParentWindow$p >= Buf.Data && p < Buf.Data + Buf.Size$p >= Data && p < DataEnd$table != 0 && "Only call EndTable() if BeginTable() returns true!"$table->RowPosY2 == inner_window->DC.CursorPos.y
API String ID: 0-2342475368
Opcode ID: 45c77d2f516a469fa9ef2d4cb687c748369bd6c669e9bcc41d1548d532d9591b
Instruction ID: 0bd69ce5d775911961261ff842fc27769054282dcca4a8be888566938c427b96
Opcode Fuzzy Hash: 45c77d2f516a469fa9ef2d4cb687c748369bd6c669e9bcc41d1548d532d9591b
Instruction Fuzzy Hash: A572A132A0868696E755EF3BC4943B9B370FF26744FC48632DB29121A9DF38B595C720

Function 00007FF7B9D23902 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 232keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 00007FF7B9D23924
GetKeyState.USER32 ref: 00007FF7B9D23962
GetKeyState.USER32 ref: 00007FF7B9D23998
GetKeyState.USER32 ref: 00007FF7B9D239CE
GetKeyState.USER32 ref: 00007FF7B9D239E0
GetKeyState.USER32 ref: 00007FF7B9D23AB1
GetKeyState.USER32 ref: 00007FF7B9D23AED
GetKeyState.USER32 ref: 00007FF7B9D23B3D
GetKeyState.USER32 ref: 00007FF7B9D23B79
GetKeyState.USER32 ref: 00007FF7B9D23BC9
GetKeyState.USER32 ref: 00007FF7B9D23C05

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D23A8F
ImGui::IsNamedKey(key), xrefs: 00007FF7B9D23A96

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: State
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$ImGui::IsNamedKey(key)
API String ID: 1649606143-1336968070
Opcode ID: bd2f05e04a2c8d0c8861a65a94c17d306ba4c5702b3adbb7328accb9aa38bf8d
Instruction ID: 5c4606c38133d4d392e61aedc58195479b576d0cb41f4df07a4fbef4fe59a301
Opcode Fuzzy Hash: bd2f05e04a2c8d0c8861a65a94c17d306ba4c5702b3adbb7328accb9aa38bf8d
Instruction Fuzzy Hash: F791F610E5C6A602FA60AF3FD4053F9F2A19F73B44F9A0235DF7A165DD8E1DA4828270

Function 00007FF7B9D27FA0 Relevance: 20.1, Strings: 16, Instructions: 125COMMON

Download Yara Rule

Strings

hvisor, xrefs: 00007FF7B9D28033
kvm, xrefs: 00007FF7B9D27FDB
matches: , xrefs: 00007FF7B9D28113
vbox, xrefs: 00007FF7B9D27FF1
hypervisor, xrefs: 00007FF7B9D28028
vmware, xrefs: 00007FF7B9D28049
monitor, xrefs: 00007FF7B9D28007
virtualbox, xrefs: 00007FF7B9D27FFC
BRAND_KEYWORDS: , xrefs: 00007FF7B9D280C7, 00007FF7B9D2811A
virtual, xrefs: 00007FF7B9D27FE6
hyperv, xrefs: 00007FF7B9D2801D
qemu, xrefs: 00007FF7B9D27FD0
QEMU, xrefs: 00007FF7B9D28130
match = , xrefs: 00007FF7B9D280C0
parallels, xrefs: 00007FF7B9D2803E
bhyve, xrefs: 00007FF7B9D28012

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: BRAND_KEYWORDS: $QEMU$bhyve$hvisor$hyperv$hypervisor$kvm$match = $matches: $monitor$parallels$qemu$vbox$virtual$virtualbox$vmware
API String ID: 0-1897347801
Opcode ID: 1b1cd338fb0eb8f71c49efb816668da34af78be018e59446d354a8d81aa3f5c4
Instruction ID: aac09a3f75f05a2c426c4691656b9a36f0860c136e3f81cb67eab84c9021174a
Opcode Fuzzy Hash: 1b1cd338fb0eb8f71c49efb816668da34af78be018e59446d354a8d81aa3f5c4
Instruction Fuzzy Hash: C0512632B05A0299FB10FF29E5901EDB374AF62348FC04172DB1D567AEEE28E559C360

Function 00007FF7B9D2AD10 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 111COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D2AD8A
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D2ADDE

Strings

cAMD, xrefs: 00007FF7B9D2ADC7
AMD Athlon(tm) processor, xrefs: 00007FF7B9D2ADD3
BOCHS_CPU: neither AMD or Intel detected, returned false, xrefs: 00007FF7B9D2AD5E
Bochs, xrefs: 00007FF7B9D2ADA3, 00007FF7B9D2ADF3
Intel(R) Pentium(R) 4 CPU , xrefs: 00007FF7B9D2AD7F
BOCHS_CPU: technique 2 found, xrefs: 00007FF7B9D2ADE7
CPUID function: highest leaf = , xrefs: 00007FF7B9D2AE27
BOCHS_CPU: technique 1 found, xrefs: 00007FF7B9D2AD97
cAMD, xrefs: 00007FF7B9D2AD56

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: type_info::_name_internal_method
String ID: Intel(R) Pentium(R) 4 CPU $AMD Athlon(tm) processor$BOCHS_CPU: neither AMD or Intel detected, returned false$BOCHS_CPU: technique 1 found$BOCHS_CPU: technique 2 found$Bochs$CPUID function: highest leaf = $cAMD$cAMD
API String ID: 3713626258-514869974
Opcode ID: c4f6ddda1db51a852bd7bf5d3f9ccb1d72ed558d5744552a8d700ab699f6a0aa
Instruction ID: 4cad73d1ea1aa086caae9c775e3cf3f5ac38541280646b4ea778b35ed14520cb
Opcode Fuzzy Hash: c4f6ddda1db51a852bd7bf5d3f9ccb1d72ed558d5744552a8d700ab699f6a0aa
Instruction Fuzzy Hash: 05418521B1860745FB60AF2ED4502FDB2B1EF72304FC54672D72D466EEEE2CE8018220

Function 00007FF7B9D2A200 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B9D2A247
IsWow64Process.KERNEL32 ref: 00007FF7B9D2A258
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7B9D2A280
SHGetSpecialFolderPathA.SHELL32 ref: 00007FF7B9D2A29B
PathCombineA.SHLWAPI ref: 00007FF7B9D2A2B3
GetFileAttributesA.KERNEL32 ref: 00007FF7B9D2A2BE
GetLastError.KERNEL32 ref: 00007FF7B9D2A2C9

Strings

qemu-ga, xrefs: 00007FF7B9D2A224
%ProgramW6432%, xrefs: 00007FF7B9D2A279
QEMU, xrefs: 00007FF7B9D2A2F4
SPICE Guest Tools, xrefs: 00007FF7B9D2A230

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: PathProcess$AttributesCombineCurrentEnvironmentErrorExpandFileFolderLastSpecialStringsWow64
String ID: %ProgramW6432%$QEMU$SPICE Guest Tools$qemu-ga
API String ID: 1711094772-2663136182
Opcode ID: eda1ff3d653b8ee62d53a4540f86061dcf81ef4d56883ac6fc837417efba449d
Instruction ID: 4d41dd5fa57e2ba9ef111daef1356d0463dd9dbbb110f818c09b42d412958e62
Opcode Fuzzy Hash: eda1ff3d653b8ee62d53a4540f86061dcf81ef4d56883ac6fc837417efba449d
Instruction Fuzzy Hash: 7B312D31A0CA8281EB60AF1AF5843EAF371FFA6745F811232D76D426A9DF2DD549C710

Function 00007FF7B9D2A350 Relevance: 18.8, Strings: 15, Instructions: 88COMMON

Download Yara Rule

Strings

Virtual PC, xrefs: 00007FF7B9D2A437
joeboxcontrol.exe, xrefs: 00007FF7B9D2A368
Xen HVM, xrefs: 00007FF7B9D2A411
JoeBox, xrefs: 00007FF7B9D2A4A9
joeboxserver.exe, xrefs: 00007FF7B9D2A354
vboxservice.exe, xrefs: 00007FF7B9D2A3A4
xenservice.exe, xrefs: 00007FF7B9D2A3EC
VirtualBox, xrefs: 00007FF7B9D2A45D
vboxtray.exe, xrefs: 00007FF7B9D2A3B8
prl_cc.exe, xrefs: 00007FF7B9D2A37C
vmsrvc.exe, xrefs: 00007FF7B9D2A3CC
prl_tools.exe, xrefs: 00007FF7B9D2A390
Parallels, xrefs: 00007FF7B9D2A483
xsvc_depriv.exe, xrefs: 00007FF7B9D2A3FC
vmusrvc.exe, xrefs: 00007FF7B9D2A3DC

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: CloseHandle$00007BaseEnumModuleNameOpenProcessProcesses
String ID: JoeBox$Parallels$Virtual PC$VirtualBox$Xen HVM$joeboxcontrol.exe$joeboxserver.exe$prl_cc.exe$prl_tools.exe$vboxservice.exe$vboxtray.exe$vmsrvc.exe$vmusrvc.exe$xenservice.exe$xsvc_depriv.exe
API String ID: 1600142199-990303504
Opcode ID: e0ee4f88ed984b301cbc6ee641c30ef5083f2e35460fcdc7db1eba79355223ff
Instruction ID: ba0ac2dc08136bfb313ffeac3e6ea1e8943b9519c71d602ccbb2fd92e1b740cd
Opcode Fuzzy Hash: e0ee4f88ed984b301cbc6ee641c30ef5083f2e35460fcdc7db1eba79355223ff
Instruction Fuzzy Hash: 3041EA61918A0295EA40BF1EE9850E4F370FFB2344FC11072E76E176AEAE1DE54BD721

Function 00007FF7B9D283C0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 178COMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI ref: 00007FF7B9D28406
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D28414
GetAdaptersInfo.IPHLPAPI ref: 00007FF7B9D28447
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D28474

Strings

VMware, xrefs: 00007FF7B9D285DD
:XX:XX:XX, xrefs: 00007FF7B9D2851A
MAC: , xrefs: 00007FF7B9D28538
Xen HVM, xrefs: 00007FF7B9D28617
Parallels, xrefs: 00007FF7B9D28651
VirtualBox, xrefs: 00007FF7B9D2855D

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007AdaptersC610F020Info
String ID: :XX:XX:XX$MAC: $Parallels$VMware$VirtualBox$Xen HVM
API String ID: 338110142-3565230121
Opcode ID: 08fbcd48aac4b610eda1f0c05757de4d93a9f00e16efd355253b407467908370
Instruction ID: 798173df3add370ad53000af4448f324545931a5c74832287b037d8fe927f42a
Opcode Fuzzy Hash: 08fbcd48aac4b610eda1f0c05757de4d93a9f00e16efd355253b407467908370
Instruction Fuzzy Hash: C9816431A0C64285FA61BF2AD9442FAF270AF76792FC01132DB6D062ADDE7CE445C660

Function 00007FF7B9D3CA00 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 154COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7B9D3CA56

Strings

virtualbox, xrefs: 00007FF7B9D3CBBA
VMware, xrefs: 00007FF7B9D3CB96
SELECT * FROM Win32_VideoController, xrefs: 00007FF7B9D3CA7C
Microsoft Hyper-V, xrefs: 00007FF7B9D3CC0A
vmware, xrefs: 00007FF7B9D3CB80
hyper-v, xrefs: 00007FF7B9D3CBF4
VideoProcessor, xrefs: 00007FF7B9D3CA39
Failed to initialize WMI., xrefs: 00007FF7B9D3CA19
VirtualBox, xrefs: 00007FF7B9D3CBD0

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: Failed to initialize WMI.$Microsoft Hyper-V$SELECT * FROM Win32_VideoController$VMware$VideoProcessor$VirtualBox$hyper-v$virtualbox$vmware
API String ID: 1114552684-2253898243
Opcode ID: bdf1193b327a63dce10e523defad2de63e158b277271f13fc74a341a1459cbd1
Instruction ID: 659c1e874ee145c515d97d19888a77b572badb6ee08cedc2b88e7c9071f3b2b0
Opcode Fuzzy Hash: bdf1193b327a63dce10e523defad2de63e158b277271f13fc74a341a1459cbd1
Instruction Fuzzy Hash: 97615421B0994299EB10BF79D4512FCB330AB62358FC05572DB2D566EEEE28E549C360

Function 00007FF7B9CF4970 Relevance: 15.0, APIs: 10, Instructions: 50clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF7B9CF497B
MultiByteToWideChar.KERNEL32 ref: 00007FF7B9CF49AE
GlobalAlloc.KERNEL32 ref: 00007FF7B9CF49C2
GlobalLock.KERNEL32 ref: 00007FF7B9CF49D3
MultiByteToWideChar.KERNEL32 ref: 00007FF7B9CF49F2
GlobalUnlock.KERNEL32 ref: 00007FF7B9CF49FB
EmptyClipboard.USER32 ref: 00007FF7B9CF4A01
SetClipboardData.USER32 ref: 00007FF7B9CF4A0F
GlobalFree.KERNEL32 ref: 00007FF7B9CF4A1D
CloseClipboard.USER32 ref: 00007FF7B9CF4A23

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ClipboardGlobal$ByteCharMultiWide$AllocCloseDataEmptyFreeLockOpenUnlock
String ID:
API String ID: 1965520120-0
Opcode ID: ddac952bdf465bc812f978c303b5201274ca128694e58479c887ede966713472
Instruction ID: c670dedf43f7a10593d192dc3cd99130518afee39ca2f065c22c282dd9889dff
Opcode Fuzzy Hash: ddac952bdf465bc812f978c303b5201274ca128694e58479c887ede966713472
Instruction Fuzzy Hash: D8118120A08A4242E7147F2AB958229B3B1EF6AFD2F494139DB6D477ACEE3DD0044310

Function 00007FF7B9CE9AC0 Relevance: 14.3, Strings: 11, Instructions: 524COMMON

Download Yara Rule

Strings

n >= 0 && n < BITCOUNT, xrefs: 00007FF7B9CE9D93, 00007FF7B9CE9E77
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9CE9B74, 00007FF7B9CE9F3E, 00007FF7B9CEA10E, 00007FF7B9CEA1C1
it >= Data && it < Data + Size && it_last >= it && it_last <= Data + Size, xrefs: 00007FF7B9CEA1C8
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9CE9D8C, 00007FF7B9CE9E70
0 && "Unknown event!", xrefs: 00007FF7B9CEA06A
Processed, xrefs: 00007FF7B9CEA0F9
Remaining, xrefs: 00007FF7B9CEA125
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CE9C43, 00007FF7B9CE9D34, 00007FF7B9CEA063
button >= 0 && button < ImGuiMouseButton_COUNT, xrefs: 00007FF7B9CE9C4A
key != ImGuiKey_None, xrefs: 00007FF7B9CE9D3B
i >= 0 && i < Size, xrefs: 00007FF7B9CE9B7B, 00007FF7B9CE9F45, 00007FF7B9CEA115

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: 0 && "Unknown event!"$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$Processed$Remaining$button >= 0 && button < ImGuiMouseButton_COUNT$i >= 0 && i < Size$it >= Data && it < Data + Size && it_last >= it && it_last <= Data + Size$key != ImGuiKey_None$n >= 0 && n < BITCOUNT
API String ID: 0-1923509833
Opcode ID: bff4301216f3b10055755607e284237826dbdeccc18815828e82c50d498f34c4
Instruction ID: 94fbd0a58c5181a408e38e244f19cca5614ebfb1403b6009c926554b21bfc88b
Opcode Fuzzy Hash: bff4301216f3b10055755607e284237826dbdeccc18815828e82c50d498f34c4
Instruction Fuzzy Hash: 1C42F822B086C296EB28AF3995543B9B7B0FB23744F944035DBAE47689DB3CF454D710

Function 00007FF7B9D0A8E0 Relevance: 13.8, Strings: 10, Instructions: 1289COMMON

Download Yara Rule

Strings

!is_visible, xrefs: 00007FF7B9D0B8C9
table->LeftMostEnabledColumn >= 0 && table->RightMostEnabledColumn >= 0, xrefs: 00007FF7B9D0AD68
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D0B2DD
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D0AA49, 00007FF7B9D0AA8A, 00007FF7B9D0AB88, 00007FF7B9D0AE19, 00007FF7B9D0AF34, 00007FF7B9D0AF81, 00007FF7B9D0B11D, 00007FF7B9D0B23F, 00007FF7B9D0B271, 00007FF7B9D0B4F9, 00007FF7B9D0B531, 00007FF7B9D0B665, 00007FF7B9D0BA40, 00007FF7B9D0BA7A, 00007FF7B9D0BB0F, 00007FF7B9D0BDD4, 00007FF7B9D0BE06
table->IsLayoutLocked == false, xrefs: 00007FF7B9D0A95B
#ContextMenu, xrefs: 00007FF7B9D0BD29
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7B9D0A954, 00007FF7B9D0AC08, 00007FF7B9D0AD61, 00007FF7B9D0B8C2
column->IndexWithinEnabledSet <= column->DisplayOrder, xrefs: 00007FF7B9D0AC0F
p >= Data && p < DataEnd, xrefs: 00007FF7B9D0AA50, 00007FF7B9D0AA91, 00007FF7B9D0AB8F, 00007FF7B9D0AE20, 00007FF7B9D0AF3B, 00007FF7B9D0AF88, 00007FF7B9D0B124, 00007FF7B9D0B246, 00007FF7B9D0B278, 00007FF7B9D0B500, 00007FF7B9D0B538, 00007FF7B9D0B66C, 00007FF7B9D0BA47, 00007FF7B9D0BA81, 00007FF7B9D0BB16, 00007FF7B9D0BDDB, 00007FF7B9D0BE0D
i >= 0 && i < Size, xrefs: 00007FF7B9D0B2E4

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: !is_visible$#ContextMenu$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$column->IndexWithinEnabledSet <= column->DisplayOrder$i >= 0 && i < Size$p >= Data && p < DataEnd$table->IsLayoutLocked == false$table->LeftMostEnabledColumn >= 0 && table->RightMostEnabledColumn >= 0
API String ID: 0-1387518580
Opcode ID: 63af59109a4f8b4c60df7e6cb6873a884d23e3046744a99c53ee0ca69ab41881
Instruction ID: 0286eaad7603de1152bfa34501d47d3650fba4125e31140edaf243c805e883c5
Opcode Fuzzy Hash: 63af59109a4f8b4c60df7e6cb6873a884d23e3046744a99c53ee0ca69ab41881
Instruction Fuzzy Hash: DEE2D132A0868596E755AF3BC1553B8B771FF6A744F888331DB28235A9DB2CF4A4C710

Function 00007FF7B9D286C0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF7B9D286C9
Sleep.KERNEL32 ref: 00007FF7B9D286F4
GetCursorPos.USER32 ref: 00007FF7B9D286FF

Strings

CURSOR: pos1.y = , xrefs: 00007FF7B9D286E3, 00007FF7B9D28719
CURSOR: pos2.y = , xrefs: 00007FF7B9D28739
CURSOR: pos2.x = , xrefs: 00007FF7B9D28729
CURSOR: pos1.x = , xrefs: 00007FF7B9D286D3, 00007FF7B9D28709

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Cursor$Sleep
String ID: CURSOR: pos1.x = $CURSOR: pos1.y = $CURSOR: pos2.x = $CURSOR: pos2.y =
API String ID: 1847515627-2191314906
Opcode ID: f4b1383c65662a2307b205bd194011208cdb1f174e64e2adece3044991d442c0
Instruction ID: 4e006a27a93bd1ca39edc05672b95c1b817afe5527a6cde1ed50fd670ef70e21
Opcode Fuzzy Hash: f4b1383c65662a2307b205bd194011208cdb1f174e64e2adece3044991d442c0
Instruction Fuzzy Hash: 3311BC21B2854786EA40FF56E88046AF331EBB1701FC15171F26F4266DDE6CE9468B50

Function 00007FF7B9CF0DC0 Relevance: 10.5, Strings: 8, Instructions: 475COMMON

Download Yara Rule

Strings

[nav] NavMoveRequestForward %d, xrefs: 00007FF7B9CF0EA9
<NULL>, xrefs: 00007FF7B9CF1122
!scoring_rect.IsInverted(), xrefs: 00007FF7B9CF15E4
g.NavMoveDir != ImGuiDir_None && g.NavMoveClipDir != ImGuiDir_None, xrefs: 00007FF7B9CF0E64
[nav] NavInitRequest: from move, window "%s", layer=%d, xrefs: 00007FF7B9CF1130
g.NavMoveFlags & ImGuiNavMoveFlags_Forwarded, xrefs: 00007FF7B9CF0E8D
[nav] NavMoveRequest: clamp NavRectRel for gamepad move, xrefs: 00007FF7B9CF12AF
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CF0E5D, 00007FF7B9CF0E86, 00007FF7B9CF15DD

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: !scoring_rect.IsInverted()$<NULL>$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$[nav] NavInitRequest: from move, window "%s", layer=%d$[nav] NavMoveRequest: clamp NavRectRel for gamepad move$[nav] NavMoveRequestForward %d$g.NavMoveDir != ImGuiDir_None && g.NavMoveClipDir != ImGuiDir_None$g.NavMoveFlags & ImGuiNavMoveFlags_Forwarded
API String ID: 0-1751011103
Opcode ID: 0a0fe391b60e8c2522fd3ad116b7e5731f51a08326d4deb65e0f9ea16ad04866
Instruction ID: 0ef05ec1760961929b33c2cef967ed4b0e903f3bfd792cfae7e94c51fc44fef3
Opcode Fuzzy Hash: 0a0fe391b60e8c2522fd3ad116b7e5731f51a08326d4deb65e0f9ea16ad04866
Instruction Fuzzy Hash: 9332C722D18AC942E352AF3A80553F8B370EF7B794F589731DF64261E9EF2871958710

Function 00007FF7B9CFC2B0 Relevance: 10.4, Strings: 8, Instructions: 438COMMON

Download Yara Rule

Strings

e->ey >= y_top, xrefs: 00007FF7B9CFC349
dx >= 0, xrefs: 00007FF7B9CFC59A
dy >= 0, xrefs: 00007FF7B9CFC577
fabsf(area) <= 1.01f, xrefs: 00007FF7B9CFC74A
x >= 0 && x < len, xrefs: 00007FF7B9CFC4CE
e->sy <= y_bottom && e->ey >= y_top, xrefs: 00007FF7B9CFC40F
C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7B9CFC342, 00007FF7B9CFC408, 00007FF7B9CFC4C7, 00007FF7B9CFC570, 00007FF7B9CFC593, 00007FF7B9CFC743, 00007FF7B9CFC76F
sy1 > y_final-0.01f, xrefs: 00007FF7B9CFC776

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$dx >= 0$dy >= 0$e->ey >= y_top$e->sy <= y_bottom && e->ey >= y_top$fabsf(area) <= 1.01f$sy1 > y_final-0.01f$x >= 0 && x < len
API String ID: 0-3568222241
Opcode ID: 2e6a8859283b3d3cd8d11c8571f10789304f4235f4396e56a555a3f3518eb24d
Instruction ID: e03800be6f20d8a2a4d376fc56be6e7040c3e96ccf35fa71fad4e4dfb9ad1bc3
Opcode Fuzzy Hash: 2e6a8859283b3d3cd8d11c8571f10789304f4235f4396e56a555a3f3518eb24d
Instruction Fuzzy Hash: 2F120A22E18B8D81E212AF3754861B5F270AF7F3C4F589732FB58715B6EF2871859610

Function 00007FF7B9D0F9D0 Relevance: 9.0, Strings: 7, Instructions: 237COMMON

Download Yara Rule

Strings

(0) && "Calling PopItemFlag() too many times!", xrefs: 00007FF7B9D0FD3A
Calling PopItemFlag() too many times!, xrefs: 00007FF7B9D0FD1D
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D0FA4C, 00007FF7B9D0FADE, 00007FF7B9D0FB7C, 00007FF7B9D0FC89
*Missing Text*, xrefs: 00007FF7B9D0FA76
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D0FD33
<Unknown>, xrefs: 00007FF7B9D0FCB9
p >= Data && p < DataEnd, xrefs: 00007FF7B9D0FA53, 00007FF7B9D0FAE5, 00007FF7B9D0FB83, 00007FF7B9D0FC90

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: (0) && "Calling PopItemFlag() too many times!"$*Missing Text*$<Unknown>$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$Calling PopItemFlag() too many times!$p >= Data && p < DataEnd
API String ID: 0-3275063505
Opcode ID: 64f8e874fa66ce1179747330a39de5691e524e97183f20bb34d8ecf4e9c5c960
Instruction ID: 09f051288d0b8e4b524abfa5e140f00aeee80e13a3dd3c84315f2788d00a4eeb
Opcode Fuzzy Hash: 64f8e874fa66ce1179747330a39de5691e524e97183f20bb34d8ecf4e9c5c960
Instruction Fuzzy Hash: 1AB1B432A0864281EB94AF1ED5656A9BBB1FB62784FA40035CF6D0369DDF3CE455C720

Function 00007FF7B9D3D0B0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7B9D3D0F3

Part of subcall function 00007FF7B9D26540: SysAllocString.OLEAUT32 ref: 00007FF7B9D265B1
Part of subcall function 00007FF7B9D26540: SysAllocString.OLEAUT32 ref: 00007FF7B9D26602
Part of subcall function 00007FF7B9D26540: SysFreeString.OLEAUT32 ref: 00007FF7B9D2666A
Part of subcall function 00007FF7B9D26540: SysFreeString.OLEAUT32 ref: 00007FF7B9D266AA

Strings

Model, xrefs: 00007FF7B9D3D0CC
QEMU, xrefs: 00007FF7B9D3D1A1
SELECT Model FROM Win32_DiskDrive, xrefs: 00007FF7B9D3D120
QEMU_HDD: model = , xrefs: 00007FF7B9D3D1BE

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: String$AllocFree$Fac_nodeFac_node::_std::_
String ID: Model$QEMU$QEMU_HDD: model = $SELECT Model FROM Win32_DiskDrive
API String ID: 535470966-302833579
Opcode ID: 67da60177cdbf4f65368f33503cefdb6f4b06a15d5e39991f963891d9950ee15
Instruction ID: fabfd2ebc630152705965bbedcc8fe1af3e22a657f368c6356f476460b2b114a
Opcode Fuzzy Hash: 67da60177cdbf4f65368f33503cefdb6f4b06a15d5e39991f963891d9950ee15
Instruction Fuzzy Hash: CD41642260D58251EA20BF2AD4513F9F370EBA2344FC44532E76D466EEEE2CD949CB60

Function 00007FF7B9CF0220 Relevance: 8.1, Strings: 6, Instructions: 635COMMON

Download Yara Rule

Strings

[nav] NavInitRequest: ApplyResult: NavID 0x%08X in Layer %d Window "%s", xrefs: 00007FF7B9CF0437
g.NavWindow != 0, xrefs: 00007FF7B9CF0B11
g.NavMoveDir == ImGuiDir_None, xrefs: 00007FF7B9CF09E0
g.NavActivateDownId == g.NavActivateId, xrefs: 00007FF7B9CF093B
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CF0545, 00007FF7B9CF0934, 00007FF7B9CF09D9, 00007FF7B9CF0B0A
g.NavLayer == ImGuiNavLayer_Main || g.NavLayer == ImGuiNavLayer_Menu, xrefs: 00007FF7B9CF054C

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$[nav] NavInitRequest: ApplyResult: NavID 0x%08X in Layer %d Window "%s"$g.NavActivateDownId == g.NavActivateId$g.NavLayer == ImGuiNavLayer_Main || g.NavLayer == ImGuiNavLayer_Menu$g.NavMoveDir == ImGuiDir_None$g.NavWindow != 0
API String ID: 0-2167808928
Opcode ID: 730fbb488950118501c7b1eccb123621c722712a2f79662ab0aa810ea15e7909
Instruction ID: 96f318e8c424c56ac9818fbb2b572fe9a24cbf34844c4e217efc0ef69c91d13c
Opcode Fuzzy Hash: 730fbb488950118501c7b1eccb123621c722712a2f79662ab0aa810ea15e7909
Instruction Fuzzy Hash: 0372D732D086C149F795EF39C0583B9A7B1EB67F48F984235CB68072D9EB786489C721

Function 00007FF7B9D125E0 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF7B9D12794
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D128FF, 00007FF7B9D12C51, 00007FF7B9D12CF9
button >= 0 && button < ((int)(sizeof(g.IO.MouseDown) / sizeof(*(g.IO.MouseDown)))), xrefs: 00007FF7B9D12C2F
id != 0, xrefs: 00007FF7B9D1279B
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D12C28
button >= 0 && button < ImGuiMouseButton_COUNT, xrefs: 00007FF7B9D12906, 00007FF7B9D12C58, 00007FF7B9D12D00

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$button >= 0 && button < ((int)(sizeof(g.IO.MouseDown) / sizeof(*(g.IO.MouseDown))))$button >= 0 && button < ImGuiMouseButton_COUNT$id != 0
API String ID: 0-2768765550
Opcode ID: bb6ddeecd25b92e5f7e364dd3b79bfc53df98904499643741cfc3f907409a507
Instruction ID: ae46c32a60bb06ff933b8ef939b719fc942754ae916e88c1c5115684b22d66f9
Opcode Fuzzy Hash: bb6ddeecd25b92e5f7e364dd3b79bfc53df98904499643741cfc3f907409a507
Instruction Fuzzy Hash: 6222E233E0829686EA65AE3E91443B9F6B1AF63344F844135DF79172DDCF2EB4918720

Function 00007FF7B9CE0BB0 Relevance: 7.2, Strings: 5, Instructions: 977COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9CE130D, 00007FF7B9CE137B, 00007FF7B9CE1503, 00007FF7B9CE1544, 00007FF7B9CE1586, 00007FF7B9CE15C0, 00007FF7B9CE1627, 00007FF7B9CE165C, 00007FF7B9CE1687, 00007FF7B9CE16B9
5, xrefs: 00007FF7B9CE122E
#RESIZE, xrefs: 00007FF7B9CE0D42
idx == 0 || idx == 1, xrefs: 00007FF7B9CE1314, 00007FF7B9CE1382, 00007FF7B9CE150A, 00007FF7B9CE154B, 00007FF7B9CE158D, 00007FF7B9CE15C7, 00007FF7B9CE162E, 00007FF7B9CE1663, 00007FF7B9CE168E, 00007FF7B9CE16C0
6, xrefs: 00007FF7B9CE1207

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: #RESIZE$5$6$C:\Users\55yar\Desktop\imgui-master\imgui.h$idx == 0 || idx == 1
API String ID: 0-650503096
Opcode ID: 741f8bda65aad3a9c9b5dc4ed83b082e9bb0bc5be9c0013f7e0179b5161037e5
Instruction ID: 0424ed1b39e4a1c9c3f547e99f5badc24528bc80557d1eada478c9538a4e1865
Opcode Fuzzy Hash: 741f8bda65aad3a9c9b5dc4ed83b082e9bb0bc5be9c0013f7e0179b5161037e5
Instruction Fuzzy Hash: 8BB21832D08A8985E352EF3B94492B9B370EF6B344F58D731EB59235A9DB38B094D710

Function 00007FF7B9D10130 Relevance: 6.4, Strings: 5, Instructions: 140COMMON

Download Yara Rule

Strings

settings->ID == table->ID, xrefs: 00007FF7B9D101EE
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D101AF
settings->ColumnsCount == table->ColumnsCount && settings->ColumnsCountMax >= settings->ColumnsCount, xrefs: 00007FF7B9D10217
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7B9D101E7, 00007FF7B9D10210
p >= begin() && p < end(), xrefs: 00007FF7B9D101B6

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$p >= begin() && p < end()$settings->ColumnsCount == table->ColumnsCount && settings->ColumnsCountMax >= settings->ColumnsCount$settings->ID == table->ID
API String ID: 0-2168725360
Opcode ID: 9adbc2c648a18549cea2c583e776e9c5202d2ad48166e75ee436596c5d349f57
Instruction ID: 7c728c3066551a0bd0ec8cae2532bed8b08524ae67267e9f7febd15283f7d8c3
Opcode Fuzzy Hash: 9adbc2c648a18549cea2c583e776e9c5202d2ad48166e75ee436596c5d349f57
Instruction Fuzzy Hash: 8661F233908681C6D751EF2AE4852A9B7B0FB23744F84C836DB99472A9DB3CE549C710

Function 00007FF7B9D75AB8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B9D75AE4
GetCurrentThreadId.KERNEL32 ref: 00007FF7B9D75AF2
GetCurrentProcessId.KERNEL32 ref: 00007FF7B9D75AFE
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B9D75B0E

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: dc113855c5987b390799b8814ac2335886f250b2a85423b1ced125c36652f311
Instruction ID: 3e91e8ed9b6e3f939a7683b9bf5a86366dbe07754a2e8837940aaa63f716ba5e
Opcode Fuzzy Hash: dc113855c5987b390799b8814ac2335886f250b2a85423b1ced125c36652f311
Instruction Fuzzy Hash: 44114826B18B058AEB009F65E8442B873B4FB2A758F840A35DB2D867A8DF3CD1648350

Function 00007FF7B9CF2600 Relevance: 5.6, Strings: 4, Instructions: 628COMMON

Download Yara Rule

Strings

shared_mods != 0, xrefs: 00007FF7B9CF2AB3
##NavUpdateWindowing, xrefs: 00007FF7B9CF26E6
GImGui != 0, xrefs: 00007FF7B9CF2CD7, 00007FF7B9CF2D33
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CF2AAC, 00007FF7B9CF2CD0, 00007FF7B9CF2D2C

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: ##NavUpdateWindowing$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0$shared_mods != 0
API String ID: 0-1670481530
Opcode ID: c526906264538ce628bf3dec74475090834308bf39a31140afb304da841db08e
Instruction ID: 11af95ac5e9bee86e4dda43f26a47fe6a255e33ec40566f7b0690b2633fae1cd
Opcode Fuzzy Hash: c526906264538ce628bf3dec74475090834308bf39a31140afb304da841db08e
Instruction Fuzzy Hash: 5462D632A0878656F759AF3981583B9A6B0FF66744F884135CB6D132D9EF3CB498C720

Function 00007FF7B9D139E0 Relevance: 5.4, Strings: 4, Instructions: 420COMMON

Download Yara Rule

Strings

ImMax(size_contents_v, size_visible_v) > 0.0f, xrefs: 00007FF7B9D13C00
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF7B9D13BF9
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D13D1A, 00007FF7B9D13D52
idx == 0 || idx == 1, xrefs: 00007FF7B9D13D21, 00007FF7B9D13D59

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$ImMax(size_contents_v, size_visible_v) > 0.0f$idx == 0 || idx == 1
API String ID: 0-3128625980
Opcode ID: 8e625ba1bd8d6d3cc11652240c30ecf25a4db8a1435511de9599326dab57ea7e
Instruction ID: 6dbdefd6b650d667f0022a37d86638b7101676f9acbce03e070bfa0b56290b3d
Opcode Fuzzy Hash: 8e625ba1bd8d6d3cc11652240c30ecf25a4db8a1435511de9599326dab57ea7e
Instruction Fuzzy Hash: 6812D823D187D986E212AA3B94412B5F360AF7F784F5CC732FE6832569DB29B4C18610

Function 00007FF7B9D15600 Relevance: 5.3, Strings: 4, Instructions: 302COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D158A3
#ComboPopup, xrefs: 00007FF7B9D15831
##v, xrefs: 00007FF7B9D1566E, 00007FF7B9D15ACF
i >= 0 && i < Size, xrefs: 00007FF7B9D158AA

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: ##v$#ComboPopup$C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 0-2429816084
Opcode ID: 61090898f7784bd1a5068f51309e07eba19288cc8d7907dc8844e8ee1049ceb3
Instruction ID: 34b460d6719f74a7768c02f66f6988ec1fa7c75585da18001026ac3e747cf48a
Opcode Fuzzy Hash: 61090898f7784bd1a5068f51309e07eba19288cc8d7907dc8844e8ee1049ceb3
Instruction Fuzzy Hash: A2E1B433A147998AE711EF3B94402E9B370FF6A348F949732EB18365A9DF38A055D710

Function 00007FF7B9D2BC60 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

qemu-ga.exe, xrefs: 00007FF7B9D2BC6A
vdservice.exe, xrefs: 00007FF7B9D2BC82
vdagent.exe, xrefs: 00007FF7B9D2BC76
QEMU, xrefs: 00007FF7B9D2BCD2

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: BaseCloseEnumHandleModuleNameOpenProcessProcesses
String ID: QEMU$qemu-ga.exe$vdagent.exe$vdservice.exe
API String ID: 747937883-2473040482
Opcode ID: 2157efd84984ff52bcd16b679f8b32bd26c1ad4b9833d70dd2479d6b20a8e465
Instruction ID: 80c1b3c9dd4604fec4ac546763c3415d13e633ff964bc8e3f1842a889e4e85a5
Opcode Fuzzy Hash: 2157efd84984ff52bcd16b679f8b32bd26c1ad4b9833d70dd2479d6b20a8e465
Instruction Fuzzy Hash: 7B012122608A4185EE11AF2AF5400EAF370FFA6794BC40236DB9D0776AEF6CD554C720

Function 00007FF7B9D1EF10 Relevance: 4.1, Strings: 3, Instructions: 301COMMON

Download Yara Rule

Strings

(0) && "Calling PopItemFlag() too many times!", xrefs: 00007FF7B9D1F4CB
Calling PopItemFlag() too many times!, xrefs: 00007FF7B9D1F4AE
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D1F4C4

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: (0) && "Calling PopItemFlag() too many times!"$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Calling PopItemFlag() too many times!
API String ID: 0-102052167
Opcode ID: b3bfc9296a2d6e4074767208fffc206923f82dee4f2b72aabca544986ee9bf7e
Instruction ID: a0c1d51f0f6122073dd94cfb9ab4ed89b56cba20f03e0b99f102f1bf92f46fa8
Opcode Fuzzy Hash: b3bfc9296a2d6e4074767208fffc206923f82dee4f2b72aabca544986ee9bf7e
Instruction Fuzzy Hash: F0E1D9329186D985E326AF3A90413F9B370FF6A344F548332EB59271A9DF3DA495C710

Function 00007FF7B9CFDDE0 Relevance: 3.3, APIs: 2, Instructions: 255COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CFE13F
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CFE1C0

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID:
API String ID: 1173767890-0
Opcode ID: 7d0dd63dcc4704c500bbbdd7d2277ab7569ffe89a62477874b5941f220371acf
Instruction ID: 5c347515d2ef75bdf37e948ad1c991e94958ad497680c4cd52df35fd18d7b0cb
Opcode Fuzzy Hash: 7d0dd63dcc4704c500bbbdd7d2277ab7569ffe89a62477874b5941f220371acf
Instruction Fuzzy Hash: 05B1D433A14AD585D321EF3990442BEF7B4FFA9B84F449332EB9552658EB38E486C710

Function 00007FF7B9D23C5B Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32 ref: 00007FF7B9D23C5D
GetLocaleInfoA.KERNEL32 ref: 00007FF7B9D23C79

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: InfoKeyboardLayoutLocale
String ID:
API String ID: 1218629382-0
Opcode ID: 77b21d223f33af8884a9fe161841b75ec4699f18136ec8b9ac9846f8f905dde7
Instruction ID: e134cfd704acf5fc3a49e3892ec131b1613b8d58ddf998e5502a9be57ff205ab
Opcode Fuzzy Hash: 77b21d223f33af8884a9fe161841b75ec4699f18136ec8b9ac9846f8f905dde7
Instruction Fuzzy Hash: 92F0A022618A8186E7629F2BA4002EAB3A4FB58794F914033CF9D53714DE3DD483C710

Function 00007FF7B9CEEE50 Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

(window->ChildFlags | g.NavWindow->ChildFlags) & ImGuiChildFlags_NavFlattened, xrefs: 00007FF7B9CEEEE4
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CEEEDD

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: (window->ChildFlags | g.NavWindow->ChildFlags) & ImGuiChildFlags_NavFlattened$C:\Users\55yar\Desktop\imgui-master\imgui.cpp
API String ID: 0-3836044477
Opcode ID: 0c51ceab6ca626247bb3e66dd72cad57c8acf5dae3556ffec34a963b390b0164
Instruction ID: 20d39eede64e93cac3f95934d449cc88c7bdb908ac3be45733ef2f991545d196
Opcode Fuzzy Hash: 0c51ceab6ca626247bb3e66dd72cad57c8acf5dae3556ffec34a963b390b0164
Instruction Fuzzy Hash: 30D1F923D08E8E81E2227B3B80460B5F3B09F7F385FA99732EF6D725A6CB1875855510

Function 00007FF7B9CFAAF0 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

!(o > b->size || o < 0), xrefs: 00007FF7B9CFBBB4
C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7B9CFBBAD

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: !(o > b->size || o < 0)$C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h
API String ID: 0-2013812653
Opcode ID: 61d3691e49be1f84e0150b5e846e2aed5a41793a3269af067d7af8f9fc16d968
Instruction ID: 7d0349b0ea6497d8e80b1ba31811a949cfef135b41a2a89320e30f8f043e50b6
Opcode Fuzzy Hash: 61d3691e49be1f84e0150b5e846e2aed5a41793a3269af067d7af8f9fc16d968
Instruction Fuzzy Hash: B1B1D333A08AC48AE701DF7E90452BDB7B0FBA9345F545335DF5922679EB38A585CB00

Function 00007FF7B9CFEBC0 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

pixels[i*stride_in_bytes] == 0, xrefs: 00007FF7B9CFEDF5
C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7B9CFEDEE

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$pixels[i*stride_in_bytes] == 0
API String ID: 0-15633718
Opcode ID: fcba2ce47abafcc763f1f8dc80c6d1a7adae2ab53a85f6e205cdd6f8cec78d60
Instruction ID: 1394209e9351e043cd6588e70fac4a3baeb3cb36753d17e788f3d8f40ef3fa5e
Opcode Fuzzy Hash: fcba2ce47abafcc763f1f8dc80c6d1a7adae2ab53a85f6e205cdd6f8cec78d60
Instruction Fuzzy Hash: 8271136360C2A647E3265B3CA85536EEEF1F79A340F9C4234EAD983F49DA2CD504CA50

Function 00007FF7B9CFE910 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

pixels[i] == 0, xrefs: 00007FF7B9CFEB54
C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7B9CFEB4D

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$pixels[i] == 0
API String ID: 0-2060079458
Opcode ID: 491ba8c0cdad3bcee9af0565b12dc5f143dba6e6e313ecbd5b1507d7f33f2637
Instruction ID: 5cf484b704be9822dcd6b571fcb1b9bd700b9a9c17c43e96119eb40063bf0f18
Opcode Fuzzy Hash: 491ba8c0cdad3bcee9af0565b12dc5f143dba6e6e313ecbd5b1507d7f33f2637
Instruction Fuzzy Hash: F171E06361C6E286C3218F3D985977EBEB1E796304F984275DB9983B88DB3DD118C710

Function 00007FF7B9D085E0 Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7B9D08628
text_end != 0, xrefs: 00007FF7B9D0862F

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$text_end != 0
API String ID: 0-48455972
Opcode ID: 3002515a1ab3bdc51a7f6a3506bfed08d6a2eb409b93287ee4929966dd13d4c3
Instruction ID: 5b832d3ea7f6f579e26edc7e28efa44cc4601450f8a9392bc39bb4d3af3ebf5d
Opcode Fuzzy Hash: 3002515a1ab3bdc51a7f6a3506bfed08d6a2eb409b93287ee4929966dd13d4c3
Instruction Fuzzy Hash: EE413821F0C24946E961EF2B9050179F661AFB7780FD98732EE6C17A9CDB3DE4818710

Function 00007FF7B9CE72F0 Relevance: 2.6, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9CE730F
Size > 0, xrefs: 00007FF7B9CE7316

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 0-1180621679
Opcode ID: 9eaacf2246e783dded85e65fbf1ba08c608659f31188253d760be90e0a045a89
Instruction ID: bbdfe1aabcf39c8d63a6e3c5e0699ce80f526189cbd00d5700e1fce98ad1e78c
Opcode Fuzzy Hash: 9eaacf2246e783dded85e65fbf1ba08c608659f31188253d760be90e0a045a89
Instruction Fuzzy Hash: 8631CE72B101E58BEB84CF66A864F7D7B60E3D6742B896121EF8017A48C63CD111CB60

Function 00007FF7B9CE7220 Relevance: 2.6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9CE7248
Size > 0, xrefs: 00007FF7B9CE724F

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 0-1180621679
Opcode ID: bb452d0373826b3bfde3a80130145f850f008f808f24efa226c10a0c1ad71441
Instruction ID: a5fbdbb0a8131020c88bb97a5712d82b24897fb2f9a3ae48936e6b137eb776ee
Opcode Fuzzy Hash: bb452d0373826b3bfde3a80130145f850f008f808f24efa226c10a0c1ad71441
Instruction Fuzzy Hash: DE110A7160569186EB08CF66E4E40BAB7B0F796782F851037EBDA07649DE3CD181C720

Function 00007FF7B9D2AC70 Relevance: 2.5, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

QEMU Virtual CPU, xrefs: 00007FF7B9D2AC98
QEMU, xrefs: 00007FF7B9D2ACC0

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: QEMU$QEMU Virtual CPU
API String ID: 0-1421318364
Opcode ID: dac9ac4cbb93561339592773e8785ddf914f9d1ee7c6d026dc8a084fac90d451
Instruction ID: 70a7ffb3ee4f691f642bbc09b2587b0f29fddfd473d8cca0cd6ecc7ad669bb9f
Opcode Fuzzy Hash: dac9ac4cbb93561339592773e8785ddf914f9d1ee7c6d026dc8a084fac90d451
Instruction Fuzzy Hash: E8016162A1854695EB20BF29E4502F9F370FBA3301FD41072D7AD466AE9E1CD589C720

Function 00007FF7B9D282B0 Relevance: 2.5, APIs: 2, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7B9D282CD
CloseHandle.KERNEL32 ref: 00007FF7B9D282E1

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: CloseHandleHeapProcess
String ID:
API String ID: 3728050799-0
Opcode ID: 6295d9721a27f4245d2f893d2c2d70af50f7c948f5cdc31f0155e9e82bda42bf
Instruction ID: 6956cd618d5a2df752ae1cbe836dadc827bec59d148119ef7caee41c204ad4b2
Opcode Fuzzy Hash: 6295d9721a27f4245d2f893d2c2d70af50f7c948f5cdc31f0155e9e82bda42bf
Instruction Fuzzy Hash: 1FF0F631F18A9146EF549BB7B68916A7621EB99BC4B58A030EF6E5370CCE3CD0D1C710

Function 0000018CD0A769C0 Relevance: 1.8, APIs: 1, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058fe484ba31c3fcbeb7b1ed2503814a888c2b2876d3fe363face192ce8f9d9f
Instruction ID: 2b448e8f8540dd54a04740df28ea1a0421183c6bcea4b0d37e40f25535b81ed5
Opcode Fuzzy Hash: 058fe484ba31c3fcbeb7b1ed2503814a888c2b2876d3fe363face192ce8f9d9f
Instruction Fuzzy Hash: 5CA16C30218A044BE769BB6C98593A933E5EBD93A6F54C73CE49EC32D1DE34DA0187D1

Function 0000018CD0A3B080 Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

@, xrefs: 0000018CD0A3B408

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6f9e5161a3611f1e4bccd8dd5d1371ccbd673557d68f10357e32b22705c5483a
Instruction ID: 6ba374687b0fdecd1a01abf4be6f309d8e6a5b76c2692c08aca7765546be5bcf
Opcode Fuzzy Hash: 6f9e5161a3611f1e4bccd8dd5d1371ccbd673557d68f10357e32b22705c5483a
Instruction Fuzzy Hash: 49E1FF7421CA888FE7A4EF58C45876AB7E1FB99345F108A2DE18EC3260DF74D885CB45

Function 00007FF7B9CF80F0 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7B9CF8326

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h
API String ID: 0-2705777111
Opcode ID: d4e523a57a7578c31a210f5ed15a645ba85c93ba7444a5218b22de89a018d3eb
Instruction ID: 892745a3d515f0470796957bf9035bb8000c9f195011631aeac1821212224232
Opcode Fuzzy Hash: d4e523a57a7578c31a210f5ed15a645ba85c93ba7444a5218b22de89a018d3eb
Instruction Fuzzy Hash: E65169A6B244B183DB209F3EC8D56BC77E0E74A742FD48576D36982F95D22DC10A9F20

Function 00007FF7B9D6F900 Relevance: .8, Instructions: 760COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711c75c16e04f05930c4c7f8d7961871963e911d2240806723824b8214e1113c
Instruction ID: 6a6d768201a1fed5343df6999fea9a7881c481c6636b64bd271f7d1a65fb931f
Opcode Fuzzy Hash: 711c75c16e04f05930c4c7f8d7961871963e911d2240806723824b8214e1113c
Instruction Fuzzy Hash: 8D829036219AC48AD774CF5AE4907AAB7A0F3C9B94F544126EA9D83B68CF3CD544CF10

Function 00007FF7B9CD8990 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1ea35e3b431f82f4f12a4b396f153b0a848afeb2d775deb7f7c878e429036a
Instruction ID: 96b16d10dadc85cc5dc03ab2f2fef415900363758a4026eb3f7ad893a9644422
Opcode Fuzzy Hash: bb1ea35e3b431f82f4f12a4b396f153b0a848afeb2d775deb7f7c878e429036a
Instruction Fuzzy Hash: FB829E73815BC187D328CF34B9981DAB7A8FB55340F105219DBF622A61DB78E1A6E708

Function 00007FF7B9D1CF70 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4a449293a40cbfe98e5d7827f8691eb49733b783b1ea7de53bf4c27f441732
Instruction ID: 0cac8432c34f8fa36db158369dc0d242b611ddeef7ef7ee2cbfad91c4f3a0e62
Opcode Fuzzy Hash: 9a4a449293a40cbfe98e5d7827f8691eb49733b783b1ea7de53bf4c27f441732
Instruction Fuzzy Hash: 3022C533E08695CAE715DF7A90403BDF7B0EB6A348F444735EF58265A9CB38A454CB20

Function 00007FF7B9CFEE70 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8666f2393c9b8f7fb7cdd93b58903e41ae95174a75f1733205bcbb53e83308ca
Instruction ID: 744756cdfb9117c1a94fea332fcafdf9b2239667a3f1c6d831fce862b8aa29ea
Opcode Fuzzy Hash: 8666f2393c9b8f7fb7cdd93b58903e41ae95174a75f1733205bcbb53e83308ca
Instruction Fuzzy Hash: 6B021532A186C086D325CF3A9041779F7B0FF6E784F148326EB9963659EB38E591CB10

Function 00007FF7B9D1E680 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60134fdaf79148bc3aed8ca8cda4530990a9437e8335a5391703faa725201ef3
Instruction ID: 42b1d62bf7770a1bdfb8452f129a4c3df8a6409c0895e77ee3ab18960567bb55
Opcode Fuzzy Hash: 60134fdaf79148bc3aed8ca8cda4530990a9437e8335a5391703faa725201ef3
Instruction Fuzzy Hash: 9BF1A83390C291C6E761AE3A91443B9BBB0EB66754F484139DFAA076D9DB39E444C730

Function 00007FF7B9CDC330 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e259183aa3cff67cceae918c74b9f2fe90d859c801d5e6c82e25a49c6e2c3e1d
Instruction ID: 9c4ce03825e9671011ad34791ed49043b32f7a877606e145da8b5670d808b4c7
Opcode Fuzzy Hash: e259183aa3cff67cceae918c74b9f2fe90d859c801d5e6c82e25a49c6e2c3e1d
Instruction Fuzzy Hash: 98D1826298D6C245EB65AE3D40182B9B7F1AF33748F984135EF691A5CFDF3CA8419230

Function 00007FF7B9D211B0 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6853595c4b8d4732684ae615c1043c40102c10e0b8c6e6ca77a3e418a474b5e
Instruction ID: 565cd9aa1216a95b57991b7fc08f408ba099503e1d46b1f1653795ca397c4d96
Opcode Fuzzy Hash: a6853595c4b8d4732684ae615c1043c40102c10e0b8c6e6ca77a3e418a474b5e
Instruction Fuzzy Hash: 57C12B36750B8982EB159F3BD454BAD6771EB9AF88F09D231CE0A17B68DF3AC1458700

Function 00007FF7B9CFD940 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ba8da47b8908073ce420befe1b0d6dc1da6f7031fe5efb319df8529ff22dd0
Instruction ID: 1e49e25f49fa8b506a0899006df9ff3b53241fe01efc9a81bb62494e06296153
Opcode Fuzzy Hash: d9ba8da47b8908073ce420befe1b0d6dc1da6f7031fe5efb319df8529ff22dd0
Instruction Fuzzy Hash: E0B1B922E38BCC41E213AA3750821F9E260AFBF3C5F6DDB23FE94756B6AB1461D15510

Function 00007FF7B9CE8630 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bac0945ec1b59e01bc3937df9c1899bef4ef3bfbc1e5e78a99121b0f70271fc8
Instruction ID: 80c83e4ba204e41931eb61f24989a182cd1d954b6fb7ef7a115d81cd371c1af7
Opcode Fuzzy Hash: bac0945ec1b59e01bc3937df9c1899bef4ef3bfbc1e5e78a99121b0f70271fc8
Instruction Fuzzy Hash: F4D1F422D0A7C189E3519F3954007F87BF4FB77B48F4D827ADB991765ACB286011AB31

Function 00007FF7B9CF1E50 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0907db7d99f817ccf87f979c67bf6fa07c3d54fa26eaabc26dc2d5595c3a1437
Instruction ID: a60f5348395a2013342b396eabdd9b2f0a43b646f2efab54e833c117966cf73e
Opcode Fuzzy Hash: 0907db7d99f817ccf87f979c67bf6fa07c3d54fa26eaabc26dc2d5595c3a1437
Instruction Fuzzy Hash: 6F913A3291868587E355AF3A80183F9B3B0FF26758F58D335DB69161D9EB3875888B10

Function 00007FF7B9D2AAD0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75347e420e246316dc48f9152a43aacf056808c60e0f7064dc43329542e8c729
Instruction ID: 4fe7a4dbf5c385882646a2e13903d323328ecc0b3294f7e272c13de61e82670b
Opcode Fuzzy Hash: 75347e420e246316dc48f9152a43aacf056808c60e0f7064dc43329542e8c729
Instruction Fuzzy Hash: A0314BF1B72B960FEF6843F267463F10D83578D7C4E10E9348A2D9BB4AE83C62A04255

Function 00007FF7B9D7A088 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f618a298c6e42848bd26529225843dfb3be44d53d8b94e0dddf4a7216d6b172d
Instruction ID: c3449bb1b69c8d9c9d5744daa7c6087e5d350599ed3b1bc2ba89e1c4f3db3d48
Opcode Fuzzy Hash: f618a298c6e42848bd26529225843dfb3be44d53d8b94e0dddf4a7216d6b172d
Instruction Fuzzy Hash: 9490025211E3D005CB034A7414609093F705043C003896087D280861838448045C8312

Function 00007FF7B9D7A1C0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffb9348e867d741892279679cf464c9aedaf3e6810820d71bb5eab8be5ba2b9
Instruction ID: a769ea24b85c7bc2aa8efcb6eece902450031447dd1405de71fe679e1a37919b
Opcode Fuzzy Hash: 0ffb9348e867d741892279679cf464c9aedaf3e6810820d71bb5eab8be5ba2b9
Instruction Fuzzy Hash: A4B01287C0C68080E143152849152C037E14F138B076A03294E30410E6294B0C018650

Function 00007FF7B9D75A0C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae5a87b9dd38dd311fd93f2a90222b4c5ac6b764f614e41fb0d48fb702329ef
Instruction ID: f622351fb2ae67666f185a4c6811b4f56e584b090d065d306cf9d043db506f3f
Opcode Fuzzy Hash: 9ae5a87b9dd38dd311fd93f2a90222b4c5ac6b764f614e41fb0d48fb702329ef
Instruction Fuzzy Hash: 56A0012291880290E604AF0AA8A0424B330AB62300B824072C62D614689E2DE401C221

Function 00007FF7B9D7A260 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbb0fd7929c574f81d366f737796e663298c908b94ddf0231a142351a2c27a93
Instruction ID: c0e9bc86d497d7104583adf69ba05f194d461dcd845eeed6fe332642fce6be0d
Opcode Fuzzy Hash: cbb0fd7929c574f81d366f737796e663298c908b94ddf0231a142351a2c27a93
Instruction Fuzzy Hash:

Function 00007FF7B9D269A0 Relevance: 40.5, APIs: 3, Strings: 20, Instructions: 218COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D26A61
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D26AB8

Strings

HYPER_X: added Hyper-V real VM, xrefs: 00007FF7B9D26CC0
HYPER_X: returned from cache, xrefs: 00007FF7B9D269C0
Microsoft-Windows-Kernel-PnP/Configuration, xrefs: 00007FF7B9D26B6D
VRTUAL MICROSFT, xrefs: 00007FF7B9D26AAD
HYPER_X: ACPI string returned true, xrefs: 00007FF7B9D26AE0
Microsoft Hyper-V, xrefs: 00007FF7B9D26CCC
HYPER_X: motherboard string match = , xrefs: 00007FF7B9D26B06
HYPER_X: SMBIOS string = , xrefs: 00007FF7B9D26A7D
HYPER_X: cached, xrefs: 00007FF7B9D26C76
Hyper-V artifact (not an actual VM), xrefs: 00007FF7B9D26C9F
HYPER_X: none detected, xrefs: 00007FF7B9D26C5B, 00007FF7B9D26CEB
VMBUS, xrefs: 00007FF7B9D26B8F
HYPER_X: eax = , xrefs: 00007FF7B9D26A01, 00007FF7B9D26B26, 00007FF7B9D26B48, 00007FF7B9D26C46
HYPER_X: ACPI string = , xrefs: 00007FF7B9D26AD4
HYPER_X: event log returned true, xrefs: 00007FF7B9D26C01
VIRTUAL MACHINE, xrefs: 00007FF7B9D26A56
HYPER_X: SMBIOS string returned true, xrefs: 00007FF7B9D26A89
Virtual_Machine, xrefs: 00007FF7B9D26B7E
HYPER_X: root partition returned true, xrefs: 00007FF7B9D26A40
HYPER_X: added Hyper-V artifact VM, xrefs: 00007FF7B9D26C93

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: type_info::_name_internal_method
String ID: HYPER_X: ACPI string = $HYPER_X: ACPI string returned true$HYPER_X: SMBIOS string = $HYPER_X: SMBIOS string returned true$HYPER_X: added Hyper-V artifact VM$HYPER_X: added Hyper-V real VM$HYPER_X: cached$HYPER_X: eax = $HYPER_X: event log returned true$HYPER_X: motherboard string match = $HYPER_X: none detected$HYPER_X: returned from cache$HYPER_X: root partition returned true$Hyper-V artifact (not an actual VM)$Microsoft Hyper-V$Microsoft-Windows-Kernel-PnP/Configuration$VIRTUAL MACHINE$VMBUS$VRTUAL MICROSFT$Virtual_Machine
API String ID: 3713626258-2448001203
Opcode ID: 8b7b6656389692ea00c31a3d5d4a5023c0e5e1630d65ec86167a23a47167b22f
Instruction ID: 4ee876286dac8b07b42d26ae2828bca4c6a67cd78a1167bcee9c98e3631db6fb
Opcode Fuzzy Hash: 8b7b6656389692ea00c31a3d5d4a5023c0e5e1630d65ec86167a23a47167b22f
Instruction Fuzzy Hash: BAA14721E0864795FB10BF7ED4902F8B771AF72344FC00172D72D526AAEE2CE94A9360

Function 00007FF7B9D2A5B0 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 107registryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7B9D2A5D0
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D2A5DE
RegOpenKeyExA.ADVAPI32 ref: 00007FF7B9D2A62C
RegQueryValueExA.ADVAPI32 ref: 00007FF7B9D2A663
RegCloseKey.ADVAPI32 ref: 00007FF7B9D2A67B

Strings

Anubis, xrefs: 00007FF7B9D2A725
ProductId, xrefs: 00007FF7B9D2A657
76487-337-8429955-22614, xrefs: 00007FF7B9D2A70C
76487-644-3177037-23510, xrefs: 00007FF7B9D2A6CC
Sandboxie, xrefs: 00007FF7B9D2A5E4
JoeBox, xrefs: 00007FF7B9D2A6A5
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF7B9D2A61E
55274-640-2673064-23950, xrefs: 00007FF7B9D2A689
CWSandbox, xrefs: 00007FF7B9D2A6E5
SbieDll.dll, xrefs: 00007FF7B9D2A5C9

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610CloseF020HandleModuleOpenQueryValue
String ID: 55274-640-2673064-23950$76487-337-8429955-22614$76487-644-3177037-23510$Anubis$CWSandbox$JoeBox$ProductId$Sandboxie$SbieDll.dll$Software\Microsoft\Windows\CurrentVersion
API String ID: 1666721718-3157568840
Opcode ID: 2170bf1ed5f06515697651022f5147bfc605e4c509faaa76d2d22398ac2f2ba3
Instruction ID: 24cba52d4a9321139e4f57f771ccca9543fb543b8ec265cfaf24c77d415676ad
Opcode Fuzzy Hash: 2170bf1ed5f06515697651022f5147bfc605e4c509faaa76d2d22398ac2f2ba3
Instruction Fuzzy Hash: 2D413E65A08A0292EB00AF1AE8441B9F370FFA6755FC51131DB6D476BDEF6CE189C720

Function 0000018CD09D4430 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 0000018CD09D4F40: _WChar_traits.LIBCPMTD ref: 0000018CD09D4F6D

Part of subcall function 0000018CD09D4680: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D46B0
Part of subcall function 0000018CD09D4680: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD09D470F
Part of subcall function 0000018CD09D4680: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D4721

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD09D4498

Strings

b, xrefs: 0000018CD09D452B
g, xrefs: 0000018CD09D44DB
o, xrefs: 0000018CD09D4526
a, xrefs: 0000018CD09D44D6
, xrefs: 0000018CD09D44FE
e, xrefs: 0000018CD09D44F4
, xrefs: 0000018CD09D4517
l, xrefs: 0000018CD09D4521
B, xrefs: 0000018CD09D451C
y, xrefs: 0000018CD09D44F9
a, xrefs: 0000018CD09D4508
t, xrefs: 0000018CD09D450D
, xrefs: 0000018CD09D44EA
KDBM, xrefs: 0000018CD09D4589
K, xrefs: 0000018CD09D44EF
a, xrefs: 0000018CD09D4512
D, xrefs: 0000018CD09D4503
i, xrefs: 0000018CD09D44E0
c, xrefs: 0000018CD09D44E5
M, xrefs: 0000018CD09D44D1

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Concurrency::details::_CriticalEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWork$Char_traits
String ID: $ $ $B$D$K$KDBM$M$a$a$a$b$c$e$g$i$l$o$t$y
API String ID: 1777712374-1292890139
Opcode ID: b161acf0dfb75114682398f380b33548e679f35f6de65db894371fe5c39b2e0f
Instruction ID: 74f1763125e77c20b6bbefc31536d7d3d0ab748c74f5c8c82171b63f36aa8e6e
Opcode Fuzzy Hash: b161acf0dfb75114682398f380b33548e679f35f6de65db894371fe5c39b2e0f
Instruction Fuzzy Hash: 8561D87060CB848FE761EB68C448B9ABBE1FBA9305F04491DE4C9C7361DBB99448CB53

Function 00007FF7B9D29CF0 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF7B9D29DC0
GetCurrentProcess.KERNEL32 ref: 00007FF7B9D29DF5
IsWow64Process.KERNEL32 ref: 00007FF7B9D29E05
Wow64DisableWow64FsRedirection.KERNEL32 ref: 00007FF7B9D29E1F
PathCombineA.SHLWAPI ref: 00007FF7B9D29E5F
GetFileAttributesA.KERNEL32 ref: 00007FF7B9D29E6C
GetLastError.KERNEL32 ref: 00007FF7B9D29E77
GetCurrentProcess.KERNEL32 ref: 00007FF7B9D29E9A
IsWow64Process.KERNEL32 ref: 00007FF7B9D29EAA
Wow64RevertWow64FsRedirection.KERNEL32 ref: 00007FF7B9D29ED4

Strings

System32\drivers\vioser.sys, xrefs: 00007FF7B9D29D73
System32\drivers\viorng.sys, xrefs: 00007FF7B9D29D5B
System32\drivers\viostor.sys, xrefs: 00007FF7B9D29D7F
System32\drivers\balloon.sys, xrefs: 00007FF7B9D29D01
System32\drivers\pvpanic.sys, xrefs: 00007FF7B9D29D2B
System32\drivers\vioscsi.sys, xrefs: 00007FF7B9D29D67
System32\drivers\vioinput.sys, xrefs: 00007FF7B9D29D4F
System32\drivers\viofs.sys, xrefs: 00007FF7B9D29D37
System32\drivers\viogpudo.sys, xrefs: 00007FF7B9D29D43
System32\drivers\netkvm.sys, xrefs: 00007FF7B9D29D17

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Wow64$Process$CurrentRedirection$AttributesCombineDirectoryDisableErrorFileLastPathRevertWindows
String ID: System32\drivers\balloon.sys$System32\drivers\netkvm.sys$System32\drivers\pvpanic.sys$System32\drivers\viofs.sys$System32\drivers\viogpudo.sys$System32\drivers\vioinput.sys$System32\drivers\viorng.sys$System32\drivers\vioscsi.sys$System32\drivers\vioser.sys$System32\drivers\viostor.sys
API String ID: 2243082510-1126929258
Opcode ID: b5e55b07b8024bf2d530526a59092f3bc797311b75eefa4fd3510bbae19e66cb
Instruction ID: d01008ea90c5aff56487abf9198bc44c12075abd57778b6ce843b12d53364293
Opcode Fuzzy Hash: b5e55b07b8024bf2d530526a59092f3bc797311b75eefa4fd3510bbae19e66cb
Instruction Fuzzy Hash: FF511031A09A8585E720AF2AE8843E9F3B4FB66754FD40136C79D466ADEF3CD544C720

Function 00007FF7B9D26E00 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7B9D270CA
GetModuleHandleA.KERNEL32 ref: 00007FF7B9D270EB
GetProcAddress.KERNEL32 ref: 00007FF7B9D27104

Strings

cE, xrefs: 00007FF7B9D26F62
aJ, xrefs: 00007FF7B9D26FC2
RtlGetVersion, xrefs: 00007FF7B9D270FA
Z), xrefs: 00007FF7B9D26EC2
cJaJ, xrefs: 00007FF7B9D27014
ntdll.dll, xrefs: 00007FF7B9D270E4
B, xrefs: 00007FF7B9D26F42
, xrefs: 00007FF7B9D26F4F
bJ, xrefs: 00007FF7B9D26FE2
98, xrefs: 00007FF7B9D26EE2
eJ, xrefs: 00007FF7B9D27042
, xrefs: 00007FF7B9D2700F
dJ, xrefs: 00007FF7B9D27022
, xrefs: 00007FF7B9D26EEF

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: AddressFac_nodeFac_node::_HandleModuleProcstd::_
String ID: $$$98$RtlGetVersion$Z)$aJ$bJ$cE$cJaJ$dJ$eJ$ntdll.dll$B
API String ID: 4198870135-1259080596
Opcode ID: 0bf612e41e4d69a7b70ddce33710d6c6f3135ff56e96c1bcb78225d191d14954
Instruction ID: 1d53b28b2522ded028413ff6196bffcb9a10e626cecc515b0514a579ee43db96
Opcode Fuzzy Hash: 0bf612e41e4d69a7b70ddce33710d6c6f3135ff56e96c1bcb78225d191d14954
Instruction Fuzzy Hash: 02A1626260C68699EB21EF79D4402DEBB70E7A130CF804122E79C57A9DDF7CD609CB91

Function 00007FF7B9D2BF70 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF7B9D2C03A
GetLastError.KERNEL32 ref: 00007FF7B9D2C045

Strings

Virtual PC, xrefs: 00007FF7B9D2BF7F
c:\windows\system32\drivers\prltime.sys, xrefs: 00007FF7B9D2BFEE
c:\windows\system32\drivers\prlvideo.sys, xrefs: 00007FF7B9D2BFDF
c:\windows\system32\drivers\prl_paravirt_32.sys, xrefs: 00007FF7B9D2C00C
c:\windows\system32\drivers\prlfs.sys, xrefs: 00007FF7B9D2BFC1
c:\windows\system32\drivers\prlmouse.sys, xrefs: 00007FF7B9D2BFD0
c:\windows\system32\drivers\vmsrvc.sys, xrefs: 00007FF7B9D2BF8B
Parallels, xrefs: 00007FF7B9D2BFA7
c:\windows\system32\drivers\prl_pv32.sys, xrefs: 00007FF7B9D2BFFD
c:\windows\system32\drivers\prleth.sys, xrefs: 00007FF7B9D2BFB2
c:\windows\system32\drivers\vpc-s3.sys, xrefs: 00007FF7B9D2BF9C

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: Parallels$Virtual PC$c:\windows\system32\drivers\prl_paravirt_32.sys$c:\windows\system32\drivers\prl_pv32.sys$c:\windows\system32\drivers\prleth.sys$c:\windows\system32\drivers\prlfs.sys$c:\windows\system32\drivers\prlmouse.sys$c:\windows\system32\drivers\prltime.sys$c:\windows\system32\drivers\prlvideo.sys$c:\windows\system32\drivers\vmsrvc.sys$c:\windows\system32\drivers\vpc-s3.sys
API String ID: 1799206407-3874332415
Opcode ID: e6794cf4ebca42abbc4b3945c9655d6db326a41356ca59b303e2935e99c5ada4
Instruction ID: f6c6736039bc26ab1ba20f9dd973f95c59a2ca749577fd65696c43ec1a1fc59a
Opcode Fuzzy Hash: e6794cf4ebca42abbc4b3945c9655d6db326a41356ca59b303e2935e99c5ada4
Instruction Fuzzy Hash: CA31F732609B41C4DB10AF19F9882A9B3B4FB55790FC10236C7AC46769EF38D958C350

Function 00007FF7B9D3BCA0 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 63COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 00007FF7B9D3BCB8
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D3BCE4
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D3BCFD
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D3BD12
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D3BD27
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D3BD3C
type_info::_name_internal_method.LIBCMTD ref: 00007FF7B9D3BD54

Strings

Cuckoo, xrefs: 00007FF7B9D3BD45
malsand, xrefs: 00007FF7B9D3BD1B
Maltest, xrefs: 00007FF7B9D3BCF1
Malware, xrefs: 00007FF7B9D3BD06
ClonePC, xrefs: 00007FF7B9D3BD30
Sandbox, xrefs: 00007FF7B9D3BCD8

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: type_info::_name_internal_method$ComputerName
String ID: ClonePC$Cuckoo$Maltest$Malware$Sandbox$malsand
API String ID: 760624270-3400526147
Opcode ID: b7a5d295f5ed5fae910fab376fb48368a987b4ca17d7c2a5b950987ec20f4101
Instruction ID: b2a5e4eb474da48124298d62e08238aca8d90407c600516885111464ac1e3d7e
Opcode Fuzzy Hash: b7a5d295f5ed5fae910fab376fb48368a987b4ca17d7c2a5b950987ec20f4101
Instruction Fuzzy Hash: D4210E61A2C94A91FE40BF2AE8410F9B331EFB2745FC01171E7AD465AE9E2CE509C760

Function 00007FF7B9D26540 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 236memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF7B9D265B1
SysAllocString.OLEAUT32 ref: 00007FF7B9D26602
SysFreeString.OLEAUT32 ref: 00007FF7B9D2666A
SysFreeString.OLEAUT32 ref: 00007FF7B9D266AA
VariantInit.OLEAUT32 ref: 00007FF7B9D26754
VariantClear.OLEAUT32 ref: 00007FF7B9D267EF
CoUninitialize.COMBASE ref: 00007FF7B9D268AE

Strings

WMI has been cleaned, xrefs: 00007FF7B9D268B4
wmi: ExecQuery failed. Error code = , xrefs: 00007FF7B9D266DA
WQL, xrefs: 00007FF7B9D265FB
Apple VZ, xrefs: 00007FF7B9D26551
KVM, xrefs: 00007FF7B9D26555

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: String$AllocFreeVariant$ClearInitUninitialize
String ID: Apple VZ$KVM$WMI has been cleaned$WQL$wmi: ExecQuery failed. Error code =
API String ID: 3571656907-266999952
Opcode ID: b51ad44348a2fc26c7cc0133e51fee188fb8e3ad63b6bb99d1f46de18fa4a91d
Instruction ID: 25d5f9d0394a67b9fe75138dd04e09479964f13b83d8b3fac11f0b45c9eb1195
Opcode Fuzzy Hash: b51ad44348a2fc26c7cc0133e51fee188fb8e3ad63b6bb99d1f46de18fa4a91d
Instruction Fuzzy Hash: F6A17E21B09B0285EB14AF6AD4506B8B3B0BF66B98FD44536DF2E47B99DF3CD4448321

Function 00007FF7B9D29930 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 143COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7B9D29A68
GetModuleHandleA.KERNEL32 ref: 00007FF7B9D29AFA

Strings

sbiedll.dll, xrefs: 00007FF7B9D29949
api_log.dll, xrefs: 00007FF7B9D299D9
wpespy.dll, xrefs: 00007FF7B9D29A45
cmdvrt64.dll, xrefs: 00007FF7B9D299A9
cmdvrt32.dll, xrefs: 00007FF7B9D29991
dir_watch.dll, xrefs: 00007FF7B9D299F4
snxhk.dll, xrefs: 00007FF7B9D299C1
vmcheck.dll, xrefs: 00007FF7B9D29979, 00007FF7B9D29A2A
pstorec.dll, xrefs: 00007FF7B9D29961, 00007FF7B9D29A0F

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Fac_nodeFac_node::_HandleModulestd::_
String ID: api_log.dll$cmdvrt32.dll$cmdvrt64.dll$dir_watch.dll$pstorec.dll$sbiedll.dll$snxhk.dll$vmcheck.dll$wpespy.dll
API String ID: 3326713076-2979618199
Opcode ID: e2d38b307eb48ec691f87414e97626e446f48edd522d218eef998ef7a95307a9
Instruction ID: 1044eab372e5dd1ca9fed8968c05ede942939a2a3a36b703d889af0ea6ec22d2
Opcode Fuzzy Hash: e2d38b307eb48ec691f87414e97626e446f48edd522d218eef998ef7a95307a9
Instruction Fuzzy Hash: F661EE62958987A5EB10FF69D8512E9B330FF62388FC05072D71D576AEEE2CD609C360

Function 00007FF7B9D29BE0 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF7B9D29C80
RegCloseKey.ADVAPI32 ref: 00007FF7B9D29CAB

Strings

SYSTEM\ControlSet001\Services\viostor, xrefs: 00007FF7B9D29BF7
SYSTEM\ControlSet001\Services\VirtIO-FS Service, xrefs: 00007FF7B9D29C02
SYSTEM\ControlSet001\Services\BalloonService, xrefs: 00007FF7B9D29C23
SYSTEM\ControlSet001\Services\vioscsi, xrefs: 00007FF7B9D29BEC
SYSTEM\ControlSet001\Services\BALLOON, xrefs: 00007FF7B9D29C18
SYSTEM\ControlSet001\Services\netkvm, xrefs: 00007FF7B9D29C2E
KVM, xrefs: 00007FF7B9D29CB1
SYSTEM\ControlSet001\Services\VirtioSerial, xrefs: 00007FF7B9D29C0D

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: CloseOpen
String ID: KVM$SYSTEM\ControlSet001\Services\BALLOON$SYSTEM\ControlSet001\Services\BalloonService$SYSTEM\ControlSet001\Services\VirtIO-FS Service$SYSTEM\ControlSet001\Services\VirtioSerial$SYSTEM\ControlSet001\Services\netkvm$SYSTEM\ControlSet001\Services\vioscsi$SYSTEM\ControlSet001\Services\viostor
API String ID: 47109696-1580002752
Opcode ID: ae3d089ed190cb715739a4a78e65915f8cb0144a931b1901f093ce2b02a3e7e8
Instruction ID: 0bef9772388c113b187066551bd04ccb765ece3dc29a7b7bb8308b1aaa9dcc06
Opcode Fuzzy Hash: ae3d089ed190cb715739a4a78e65915f8cb0144a931b1901f093ce2b02a3e7e8
Instruction Fuzzy Hash: 8B213C31618E4194EB50AF1AF5842E9B3B4FB65B94FD44236CBAC037A9EF2CD544C760

Function 00007FF7B9D29520 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 162COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 00007FF7B9D2956D

Strings

COMPUTER_NAME: detected general (VM but unknown), xrefs: 00007FF7B9D29734
Anubis, xrefs: 00007FF7B9D29655
COMPUTER_NAME: detected Anubis, xrefs: 00007FF7B9D29649
klone_x64-pc, xrefs: 00007FF7B9D29679
InsideTm, xrefs: 00007FF7B9D2958B
TU-4NH09SMCG1HC, xrefs: 00007FF7B9D295D6
COMPUTER_NAME: fetched = , xrefs: 00007FF7B9D2957F
tequilaboomboom, xrefs: 00007FF7B9D296C6

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ComputerName
String ID: Anubis$COMPUTER_NAME: detected Anubis$COMPUTER_NAME: detected general (VM but unknown)$COMPUTER_NAME: fetched = $InsideTm$TU-4NH09SMCG1HC$klone_x64-pc$tequilaboomboom
API String ID: 3545744682-2521782763
Opcode ID: caa37cdf75694edc52c11af0e48dd78de0760814cdf720e1f3cf534533566bba
Instruction ID: 989404d24dc86bd64e540d7ecfdd985f0fc0d4ed5c66efccace48b6f9016c939
Opcode Fuzzy Hash: caa37cdf75694edc52c11af0e48dd78de0760814cdf720e1f3cf534533566bba
Instruction Fuzzy Hash: AC617321A0854648EB41BF7AC9543FCB6B1AF72388FD41175DB2E466EEEE2CD505C360

Function 00007FF7B9D29EF0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B9D29F49
IsWow64Process.KERNEL32 ref: 00007FF7B9D29F5A
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7B9D29F83
SHGetSpecialFolderPathA.SHELL32 ref: 00007FF7B9D29F9E
PathCombineA.SHLWAPI ref: 00007FF7B9D29FB9
GetFileAttributesA.KERNEL32 ref: 00007FF7B9D29FC7
GetLastError.KERNEL32 ref: 00007FF7B9D29FD2

Strings

%ProgramW6432%, xrefs: 00007FF7B9D29F7C
in\, xrefs: 00007FF7B9D29F21

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: PathProcess$AttributesCombineCurrentEnvironmentErrorExpandFileFolderLastSpecialStringsWow64
String ID: %ProgramW6432%$in\
API String ID: 1711094772-3997613738
Opcode ID: a70cb524a3b089b1ed5d131733d3b8d8b3b0055cb2a3d3617fd46d3929119df5
Instruction ID: b82cbd91f7308a09589bb6a214f1bee9661649986d3b8f98f11588045e94464a
Opcode Fuzzy Hash: a70cb524a3b089b1ed5d131733d3b8d8b3b0055cb2a3d3617fd46d3929119df5
Instruction Fuzzy Hash: 8C215E61A0898692EB71AF2AE4443EAB370FBA6701FC00135D66D429ACDF3CD249CB10

Function 00007FF7B9D10B40 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 114COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D10C06

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D10D15
table->MemoryCompacted == false, xrefs: 00007FF7B9D10B6F
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D10C69, 00007FF7B9D10CCA
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7B9D10B68
p >= Buf.Data && p < Buf.Data + Buf.Size, xrefs: 00007FF7B9D10CD1
p >= Data && p < DataEnd, xrefs: 00007FF7B9D10C70
i >= 0 && i < Size, xrefs: 00007FF7B9D10D1C

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$i >= 0 && i < Size$p >= Buf.Data && p < Buf.Data + Buf.Size$p >= Data && p < DataEnd$table->MemoryCompacted == false
API String ID: 1173767890-1783795845
Opcode ID: deaac86c666f60603a0ab03538edd9ece8a877489638d9122b77b0a0e241bf59
Instruction ID: 49b69b57f60d2a58899a71c4dbf94d9a0a2b3e82e1913a46ff0b098833b07cde
Opcode Fuzzy Hash: deaac86c666f60603a0ab03538edd9ece8a877489638d9122b77b0a0e241bf59
Instruction Fuzzy Hash: E951A372A08A92C6DB10EF2AE8542E8B7B1FB66B48F844532CB5C47768DF3DD146C750

Function 00007FF7B9D28E60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73registryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B9D28E86
IsWow64Process.KERNEL32 ref: 00007FF7B9D28E97
MultiByteToWideChar.KERNEL32 ref: 00007FF7B9D28ECA
MultiByteToWideChar.KERNEL32 ref: 00007FF7B9D28EF7
RegOpenKeyExW.ADVAPI32 ref: 00007FF7B9D28F1C
RegCloseKey.ADVAPI32 ref: 00007FF7B9D28F2B

Strings

detected = , xrefs: 00007FF7B9D28F66
REGISTRY: , xrefs: 00007FF7B9D28F6D

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ByteCharMultiProcessWide$CloseCurrentOpenWow64
String ID: REGISTRY: $detected =
API String ID: 2040592378-3201242305
Opcode ID: ad6fc55fd5f3feca7ba9fe37accba806b699b1885a4d022cf14badd93844a452
Instruction ID: bea7df6d94080227a9d2c9f7ae9b5154beab39cb1711b377700a27fcdd88fbfe
Opcode Fuzzy Hash: ad6fc55fd5f3feca7ba9fe37accba806b699b1885a4d022cf14badd93844a452
Instruction Fuzzy Hash: 4E31627260CB8181E720AF16E4442AAB771FB96B94F844635EBAD47BADDF3CD148C710

Function 00007FF7B9D3BAE0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 62fileCOMMON

Download Yara Rule

APIs

00007FF8C619EF10.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF7B9D3BB06
CreateFileA.KERNEL32 ref: 00007FF7B9D3BB41
CloseHandle.KERNEL32 ref: 00007FF7B9D3BB54
CreateDirectoryA.KERNEL32 ref: 00007FF7B9D3BB9D
GetLastError.KERNEL32 ref: 00007FF7B9D3BBA5
RemoveDirectoryA.KERNEL32 ref: 00007FF7B9D3BBC3

Strings

Cuckoo, xrefs: 00007FF7B9D3BB5A
C:\Cuckoo, xrefs: 00007FF7B9D3BAE6

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: CreateDirectory$00007C619CloseErrorFileHandleLastRemove
String ID: C:\Cuckoo$Cuckoo
API String ID: 2311428884-1252002312
Opcode ID: 77ed7e829a3131f68bf2b4d93badf1fe1b3e431451209259daa3b5df27989d7e
Instruction ID: bb8ea4cfb9bbb5edb450e8c4becc7fed9f0172929a5bf28bd6ca9f50a889acda
Opcode Fuzzy Hash: 77ed7e829a3131f68bf2b4d93badf1fe1b3e431451209259daa3b5df27989d7e
Instruction Fuzzy Hash: FF212B21A1894282FA00BF2AE45427AB3B1EBB2751FD05231E76E476EDDF2CD549C760

Function 00007FF7B9D2B050 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47sharememorystringCOMMON

Download Yara Rule

APIs

WNetGetProviderNameW.MPR ref: 00007FF7B9D2B068
LocalAlloc.KERNEL32 ref: 00007FF7B9D2B07E
WNetGetProviderNameW.MPR ref: 00007FF7B9D2B099
lstrcmpiW.KERNEL32 ref: 00007FF7B9D2B0B2
LocalFree.KERNEL32 ref: 00007FF7B9D2B0BF
LocalFree.KERNEL32 ref: 00007FF7B9D2B0EF

Strings

VirtualBox Shared Folders, xrefs: 00007FF7B9D2B0A8
VirtualBox, xrefs: 00007FF7B9D2B0C5

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Local$FreeNameProvider$Alloclstrcmpi
String ID: VirtualBox$VirtualBox Shared Folders
API String ID: 1777482205-1209410647
Opcode ID: cf5b927fb929961a78d070a9b53f84e37d11d585333aa85bd9ceb35592476e6e
Instruction ID: 9f243f40813ea9e842cff5d080fde5699196ef6423b526d9c61e30982866b489
Opcode Fuzzy Hash: cf5b927fb929961a78d070a9b53f84e37d11d585333aa85bd9ceb35592476e6e
Instruction Fuzzy Hash: C1118260A18A0282FB456F2BE9806B9B3B1BF67741FC46035DB2E06298EE2CD4448620

Function 00007FF7B9D03450 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 322COMMON

Download Yara Rule

APIs

00007FF8B9F61210.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00000000,00007FF7B9CFFCB7), ref: 00007FF7B9D035EF
00007FF8B9F61210.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00000000,00007FF7B9CFFCB7), ref: 00007FF7B9D038F1

Strings

, xrefs: 00007FF7B9D03834
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D034C7, 00007FF7B9D03561, 00007FF7B9D035CA, 00007FF7B9D0363E, 00007FF7B9D037D7, 00007FF7B9D03875
it >= Data && it < Data + Size, xrefs: 00007FF7B9D03645
Size > 0, xrefs: 00007FF7B9D034CE, 00007FF7B9D0387C
i >= 0 && i < Size, xrefs: 00007FF7B9D03568, 00007FF7B9D035D1, 00007FF7B9D037DE

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007F61210
String ID: $C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0$i >= 0 && i < Size$it >= Data && it < Data + Size
API String ID: 2512014792-669993125
Opcode ID: bb8098f0ec28934d46b752e51123f8fcaece127f484d79474833ff05b9a11b48
Instruction ID: b2c5d235caf58063ec6b02cc09f01a97be3c4eb890714949ab9d84047bffd27d
Opcode Fuzzy Hash: bb8098f0ec28934d46b752e51123f8fcaece127f484d79474833ff05b9a11b48
Instruction Fuzzy Hash: E9E1CE72A08A8287EB94EF1AD454369B3B0FB66B84F854135CB5E47758EF3CE441C714

Function 00007FF7B9D06C20 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 216COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D06FA0

Strings

user_rects.Size >= 1, xrefs: 00007FF7B9D06C74
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9D06D00, 00007FF7B9D06D28, 00007FF7B9D06D56, 00007FF7B9D06D7E, 00007FF7B9D06DC6, 00007FF7B9D06E1A, 00007FF7B9D06E45, 00007FF7B9D06E80, 00007FF7B9D06EAC
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7B9D06C4D, 00007FF7B9D06C6D, 00007FF7B9D06ED4
pack_rects[i].w == user_rects[i].Width && pack_rects[i].h == user_rects[i].Height, xrefs: 00007FF7B9D06EDB
pack_context != 0, xrefs: 00007FF7B9D06C54
i >= 0 && i < Size, xrefs: 00007FF7B9D06D07, 00007FF7B9D06D2F, 00007FF7B9D06D5D, 00007FF7B9D06D85, 00007FF7B9D06DCD, 00007FF7B9D06E21, 00007FF7B9D06E4C, 00007FF7B9D06E87, 00007FF7B9D06EB3

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$i >= 0 && i < Size$pack_context != 0$pack_rects[i].w == user_rects[i].Width && pack_rects[i].h == user_rects[i].Height$user_rects.Size >= 1
API String ID: 1173767890-766226355
Opcode ID: ab5fb847ed008e76fb1a4452799997cefb5ed2ad386507e9b020e9c133a1405a
Instruction ID: f80ceceae121b4e527692f1dcaf6e780293881cf4271e0f6b818accfe28347dd
Opcode Fuzzy Hash: ab5fb847ed008e76fb1a4452799997cefb5ed2ad386507e9b020e9c133a1405a
Instruction Fuzzy Hash: 86A19D32A08A1296EB44AF1AD4541B8B7B0FB62B85FC08136DB6D4766CDF3CE546C760

Function 00007FF7B9CF6FE0 Relevance: 12.4, APIs: 8, Instructions: 350COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF706E
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF715A
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF71DA
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF72F6
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF7406
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF74E6
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF7566
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF75E7

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID:
API String ID: 1173767890-0
Opcode ID: dc091c0c2fd7f859c98354b9ae88de1060433860c9897d7aa7754a57c71dcdfe
Instruction ID: 7b5d17842c40d76c726e43960a6cefd018c451f0098cee3dce3361932c0cfc3a
Opcode Fuzzy Hash: dc091c0c2fd7f859c98354b9ae88de1060433860c9897d7aa7754a57c71dcdfe
Instruction Fuzzy Hash: 22025C3261998292CB09FF28D5691FCB375FB65B44B904132D72E832A5EF38E56AC350

Function 00007FF7B9CFCA40 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 426COMMON

Download Yara Rule

Strings

z != 0, xrefs: 00007FF7B9CFCCE8
z->direction, xrefs: 00007FF7B9CFCC08
z->ey >= scan_y_top, xrefs: 00007FF7B9CFCD85
C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7B9CFCC01, 00007FF7B9CFCCE1, 00007FF7B9CFCD7E

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$z != 0$z->direction$z->ey >= scan_y_top
API String ID: 0-479673919
Opcode ID: 4d8b9a479b37acfe9c944020e1a6a9c4196bf994dcff49c628cae36f939cba42
Instruction ID: 59c3f54d831e6a1fcf23b0a3f5a36c4a9149b134cd0bb0836d5ce8404b7432fe
Opcode Fuzzy Hash: 4d8b9a479b37acfe9c944020e1a6a9c4196bf994dcff49c628cae36f939cba42
Instruction Fuzzy Hash: 97122932A08BC586D352DF3AD0452A9F370FF69B84F588322DB5963669EF38E159C710

Function 0000018CD0A0E310 Relevance: 10.7, APIs: 7, Instructions: 213COMMON

Download Yara Rule

APIs

__std_fs_code_page.MSVCPRT ref: 0000018CD0A0E342

Part of subcall function 0000018CD0A11E00: std::_Fac_node::_Fac_node.LIBCPMTD ref: 0000018CD0A11E3D

Part of subcall function 0000018CD0A132F0: List.LIBCMTD ref: 0000018CD0A13329
Part of subcall function 0000018CD0A132F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A133D7

type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A0E4DF
type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A0E50A
type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A0E520
type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A0E55C
type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A0E56F
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 0000018CD0A0E57F

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Concurrency::task_continuation_context::task_continuation_contextEmptyFac_nodeFac_node::_ListQueue::StructuredWork__std_fs_code_pagestd::_
String ID:
API String ID: 4010070106-0
Opcode ID: 38750d4eb1cf29f378788765fb515e49289ddfa89f0a1372fcd3b1c37b4e52a4
Instruction ID: 62c0f03c9ba0d73ebe1d37a72c0773e808f8296930950ad133602d849dafdb3b
Opcode Fuzzy Hash: 38750d4eb1cf29f378788765fb515e49289ddfa89f0a1372fcd3b1c37b4e52a4
Instruction Fuzzy Hash: 1371D131118B488BD765FB58C4557EBB7E1FBD8341F408A2EA48EC7291DE709A44C7D2

Function 00007FF7B9CDAF80 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDB042
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDB0FA
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDB18A

Part of subcall function 00007FF7B9CDADE0: 00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDAE69
Part of subcall function 00007FF7B9CDADE0: 00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDAEE9
Part of subcall function 00007FF7B9CDADE0: 00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDAF6A

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CDB224

Strings

DrawList == &DrawListInst, xrefs: 00007FF7B9CDAFBA
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CDAFB3

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$DrawList == &DrawListInst
API String ID: 1173767890-20161693
Opcode ID: f61a8afc69b8efd00099b22ab65cfe891d3f9d6334ab943cd541b3ca409aa906
Instruction ID: fd6f72e249b3e3c02053a0c1642077c363c825ed58bef330899b8a9d51726e56
Opcode Fuzzy Hash: f61a8afc69b8efd00099b22ab65cfe891d3f9d6334ab943cd541b3ca409aa906
Instruction Fuzzy Hash: E171C272609A8286C745EF28D4991FCB3B5FB25B84F944237DB1D87268DF39D15AC340

Function 00007FF7B9D3CE20 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7B9D3CE7C

Strings

HDD serial number: Failed to initialize WMI, xrefs: 00007FF7B9D3CE36
SELECT SerialNumber FROM Win32_DiskDrive, xrefs: 00007FF7B9D3CEA9
SerialNumber, xrefs: 00007FF7B9D3CE55
VBbd5bbffd-59166c24, xrefs: 00007FF7B9D3CF41
VirtualBox, xrefs: 00007FF7B9D3CF7B

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: HDD serial number: Failed to initialize WMI$SELECT SerialNumber FROM Win32_DiskDrive$SerialNumber$VBbd5bbffd-59166c24$VirtualBox
API String ID: 1114552684-1335786110
Opcode ID: 516ae901a69b1f1cac9966b1e868247d03072e4acffd53190d636664e9c603b9
Instruction ID: e755a49e473b16b329679603a7457b6b3621d59c83f472f621de12b0897aeca4
Opcode Fuzzy Hash: 516ae901a69b1f1cac9966b1e868247d03072e4acffd53190d636664e9c603b9
Instruction Fuzzy Hash: 1E413222A0D582A1EA20BF59E4413F9F370FFA2384FC45172D79D466AEEE2CD549C760

Function 00007FF7B9D2BDE0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7B9D2BE43

Strings

SELECT * FROM Win32_BaseBoard, xrefs: 00007FF7B9D2BE70
Manufacturer, xrefs: 00007FF7B9D2BE1C
Microsoft Hyper-V, xrefs: 00007FF7B9D2BF3C
Microsoft Corporation Virtual Machine, xrefs: 00007FF7B9D2BF02
Failed to initialize WMI., xrefs: 00007FF7B9D2BDF6

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: Failed to initialize WMI.$Manufacturer$Microsoft Corporation Virtual Machine$Microsoft Hyper-V$SELECT * FROM Win32_BaseBoard
API String ID: 1114552684-2183059302
Opcode ID: dd3f05e064e776b369a932a11be2b602e47f78df37e4b81e87c83f45d12aa2f4
Instruction ID: d37b005b3712aeb521d41d988c79ba925757b14260b206ae3b1c56be35600e15
Opcode Fuzzy Hash: dd3f05e064e776b369a932a11be2b602e47f78df37e4b81e87c83f45d12aa2f4
Instruction Fuzzy Hash: 5A415221A0D58291EA60BF5AE4413F9F370FFA2384FC05132D39D466AEEE6CE549C720

Function 00007FF7B9D2B9D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF7B9D2BA33
RegQueryValueExA.ADVAPI32 ref: 00007FF7B9D2BA65
RegCloseKey.ADVAPI32 ref: 00007FF7B9D2BAB9
RegCloseKey.ADVAPI32 ref: 00007FF7B9D2BADC

Strings

Failed to query value for ", xrefs: 00007FF7B9D2BACB
Failed to open registry key for ", xrefs: 00007FF7B9D2BAEE

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID: Failed to open registry key for "$Failed to query value for "
API String ID: 1607946009-1205367380
Opcode ID: e23d6cf29bcb4a1a0980a667c984250c2a6b7340e35bb65f1bb2d31dd5ab03d4
Instruction ID: d9f824414301ed7bd0a1aa6b996d0b8f3fedd353a36ee6db9378161dd2f0a191
Opcode Fuzzy Hash: e23d6cf29bcb4a1a0980a667c984250c2a6b7340e35bb65f1bb2d31dd5ab03d4
Instruction Fuzzy Hash: D531AE72618A8181E7109F26E4442AAF770FBA6780F804136EB6E53B6CDF7CD104C710

Function 00007FF7B9D28910 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 33COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7B9D28949

Strings

Ghofr.dll, xrefs: 00007FF7B9D2892B
LIB_INST detected true for false dll = , xrefs: 00007FF7B9D28972
fg122.dll, xrefs: 00007FF7B9D28937
DLL: , xrefs: 00007FF7B9D28979
NetProjW.dll, xrefs: 00007FF7B9D2891A

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: HandleModule
String ID: DLL: $Ghofr.dll$LIB_INST detected true for false dll = $NetProjW.dll$fg122.dll
API String ID: 4139908857-4049422396
Opcode ID: 95dea0a3c11a30dcafb0d9b1fdcbe61328e5cd1fc921b03a5fe0ff9d35288540
Instruction ID: 37376089f2a3db52de39412be1b756bb1e6f0b268b7f5de408dcc3370e5d92e4
Opcode Fuzzy Hash: 95dea0a3c11a30dcafb0d9b1fdcbe61328e5cd1fc921b03a5fe0ff9d35288540
Instruction Fuzzy Hash: E0012862B0CB4295DE119F1AF5801A9F3B4FBA9784BC90631DBAD02B29EF6CD645C710

Function 0000018CD0A0D680 Relevance: 9.2, APIs: 6, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aea37f858869c0ee2bd0f7b5adcec34911b3012f2e42ab6534745184a15e4199
Instruction ID: bd5a1f83794214850d2eb49a372bb08fdbfd1d1cca210c44192ea4e3594ceeda
Opcode Fuzzy Hash: aea37f858869c0ee2bd0f7b5adcec34911b3012f2e42ab6534745184a15e4199
Instruction Fuzzy Hash: CF61AC3162890C8BE798EB6CC455BBA72D0FB99344FC0D529F08ACB2D5EA34D945C7D1

Function 0000018CD0A0DB70 Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

Part of subcall function 0000018CD0A0DF60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A0DF71
Part of subcall function 0000018CD0A0DF60: std::_Is_slash_oper::operator.LIBCPMTD ref: 0000018CD0A0DFDE

task.LIBCPMTD ref: 0000018CD0A0DBA2
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A0DBB7
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A0DBEA
task.LIBCPMTD ref: 0000018CD0A0DC73

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$task$Is_slash_oper::operatorstd::_
String ID:
API String ID: 486407804-0
Opcode ID: 13d526afbca65304c1c215c9590e9300ea953cbea8c1c428c27edecbe409f73f
Instruction ID: 004cd0b0e113bf969981c53947c84f80cbe0becf236b97079505ebc66487152a
Opcode Fuzzy Hash: 13d526afbca65304c1c215c9590e9300ea953cbea8c1c428c27edecbe409f73f
Instruction Fuzzy Hash: 1161E130618A4C9FDB94FB6CC444BAAB7E1FB98385F408A2DB48DC3295DE30D941C792

Function 0000018CD0A0FED0 Relevance: 9.2, APIs: 6, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 0000018CD09D9D50: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D9D6D

Part of subcall function 0000018CD0A0F730: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A0F73E
Part of subcall function 0000018CD0A0F730: GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0000018CD09EA822), ref: 0000018CD0A0F746

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD0A0FFE7
HandleT.LIBCPMTD ref: 0000018CD0A0FFF6
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A10036

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$AttributesConcurrency::details::_CriticalFileHandleLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 3190666571-0
Opcode ID: a290ba903524b759902efc529f555de29b1e13d7dc93d95c08b0c05a6973c813
Instruction ID: bb8c8d66ac0764020e5b4bffa78587d35a5a51c4f6200b90b3ca1c44544a0ad9
Opcode Fuzzy Hash: a290ba903524b759902efc529f555de29b1e13d7dc93d95c08b0c05a6973c813
Instruction Fuzzy Hash: 15610630158A488FE795FB68C455BDFB7E1FB98341F408A2EA08EC31A2DE709545C7D2

Function 00007FF7B9D2A4D0 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32 ref: 00007FF7B9D2A50A
OpenProcess.KERNEL32 ref: 00007FF7B9D2A53F
K32GetModuleBaseNameA.KERNEL32 ref: 00007FF7B9D2A55D
00007FF8C61AFA40.API-MS-WIN-CRT-MULTIBYTE-L1-1-0 ref: 00007FF7B9D2A56F
CloseHandle.KERNEL32 ref: 00007FF7B9D2A57C
CloseHandle.KERNEL32 ref: 00007FF7B9D2A5A6

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: CloseHandle$00007BaseEnumModuleNameOpenProcessProcesses
String ID:
API String ID: 1600142199-0
Opcode ID: 62f49f3f388ba0b582254f6316f151dfc9292fb5ef00bf313e7f4c781eebdb8e
Instruction ID: ccbebc9d3a7fe9b6206df6fb28d0e3dfd3cc4b9b8c47c3d0499c2d84fc05f9d5
Opcode Fuzzy Hash: 62f49f3f388ba0b582254f6316f151dfc9292fb5ef00bf313e7f4c781eebdb8e
Instruction Fuzzy Hash: 57212131A0864186E620AF16E4442EAB3B4FBAABC5FC64131DFAD4779CDE3CD945C750

Function 00007FF7B9D03FB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D04084
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D04167
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D041F0

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7B9D03FD3
!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF7B9D03FDA

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp
API String ID: 1173767890-3599239301
Opcode ID: c8afc1f3ba6d03622518ecddb6aeb890cacc16beb064410397940ac739d46223
Instruction ID: b14b3ebc8dd36eeca30ed1325cca616ffbcd913b72e12ef1dbbc879ccd20e745
Opcode Fuzzy Hash: c8afc1f3ba6d03622518ecddb6aeb890cacc16beb064410397940ac739d46223
Instruction Fuzzy Hash: 7E61E572A09A4196DB85EF19E1546BCB3B1FB25B84F948237C71D43368EF39D56AC300

Function 00007FF7B9D0F690 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 147COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D0F7C0

Strings

column->SortOrder < table->SortSpecsCount, xrefs: 00007FF7B9D0F87F
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D0F84E
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7B9D0F878
p >= Data && p < DataEnd, xrefs: 00007FF7B9D0F855

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$column->SortOrder < table->SortSpecsCount$p >= Data && p < DataEnd
API String ID: 1173767890-2291414753
Opcode ID: 28738da86535f726680f27d0394537296504cfecf121a282e658290b9d83b3bf
Instruction ID: 0c70b129ae248dbd7733027d54dabe116dec7f82a5c5085a89ade5a910cfac1b
Opcode Fuzzy Hash: 28738da86535f726680f27d0394537296504cfecf121a282e658290b9d83b3bf
Instruction Fuzzy Hash: CE61D03660869292DB48EF2ED1955BCB7B0FB66B40FA40036DB6D83258DF38E596C350

Function 00007FF7B9CD5A30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

00007FF8C6118950.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7B9CD5AC1
00007FF8C6118950.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7B9CD5AEC
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CD5BA9

Strings

filename && mode, xrefs: 00007FF7B9CD5A58
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CD5A51

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007$C6118950$C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$filename && mode
API String ID: 3653100989-1878659873
Opcode ID: bba0ade7e3dfc7a379c6028fea06fb2b9aebc10f2a13c69682634570e4d2b126
Instruction ID: aa99f5f0e92a94a8e4dbca0a0e5b79e063b07375b4fb5cc84ac605bb1b4ce950
Opcode Fuzzy Hash: bba0ade7e3dfc7a379c6028fea06fb2b9aebc10f2a13c69682634570e4d2b126
Instruction Fuzzy Hash: E3419621A09A9241EA54BF2AA448178B3B0FF6AB95FD44231DB2E477DCDF3CD9468310

Function 00007FF7B9D0DE10 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 112COMMON

Download Yara Rule

APIs

00007FF8B9F61210.VCRUNTIME140(?,?,00007FF7B9CD6649), ref: 00007FF7B9D0DE7A

Strings

table->BgClipRect.Min.y <= table->BgClipRect.Max.y, xrefs: 00007FF7B9D0DFE5
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D0DF09
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7B9D0DFDE
p >= Data && p < DataEnd, xrefs: 00007FF7B9D0DF10

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007F61210
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$p >= Data && p < DataEnd$table->BgClipRect.Min.y <= table->BgClipRect.Max.y
API String ID: 2512014792-3469508490
Opcode ID: 50cf5a6ab57d8c19a53fd3450b170c06f5e4f642d5f4c864c8681da9204b02b9
Instruction ID: 43e35129275d5e412d12f0ca3bf8b9e42d9d0beb71daed348f5dd7e2463980b5
Opcode Fuzzy Hash: 50cf5a6ab57d8c19a53fd3450b170c06f5e4f642d5f4c864c8681da9204b02b9
Instruction Fuzzy Hash: 4051F133A087C6D2D314AF2AD5942A9F7B0FB65744F844136DB6C43659EB38F1A5C720

Function 00007FF7B9D27910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7B9D27978

Strings

SELECT * FROM Win32_BaseBoard, xrefs: 00007FF7B9D279A5
Manufacturer, xrefs: 00007FF7B9D27951
Microsoft Corporation, xrefs: 00007FF7B9D27A37
Failed to initialize WMI., xrefs: 00007FF7B9D2792B

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: Failed to initialize WMI.$Manufacturer$Microsoft Corporation$SELECT * FROM Win32_BaseBoard
API String ID: 1114552684-1757773434
Opcode ID: 6f142b6b0f40b3564236f0fd9e63b026c22f3c1abd80b5269be33910e51c04fe
Instruction ID: 101dffd233bc6827e8f028b4b46e3d946af1f69adbdf5567c75b39a410be985d
Opcode Fuzzy Hash: 6f142b6b0f40b3564236f0fd9e63b026c22f3c1abd80b5269be33910e51c04fe
Instruction Fuzzy Hash: 93315521A4D58291EA20BF5AE4413F9F370EFA2384FC05132D39D466AEDE6CE649C720

Function 00007FF7B9D23FF9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetMessageExtraInfo.USER32 ref: 00007FF7B9D23FF9
GetCapture.USER32 ref: 00007FF7B9D24091
SetCapture.USER32 ref: 00007FF7B9D2409F

Strings

Ctx != 0, xrefs: 00007FF7B9D240C5
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D240BE

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Capture$ExtraInfoMessage
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 2172523684-3890275027
Opcode ID: fadbb218f598ac816963b6e9d3deab802f48b1676a20e7f2c042cf2f02a0acfb
Instruction ID: c8c0e058d073557ce2fae616c84b711e2ce578c3896211ea6fbb4f9f0b530039
Opcode Fuzzy Hash: fadbb218f598ac816963b6e9d3deab802f48b1676a20e7f2c042cf2f02a0acfb
Instruction Fuzzy Hash: C121F262609A4282E711DF2AE5046ADB3B0FB55BA4FC10132DF2E47398DF3DE4868750

Function 00007FF7B9CF4B40 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

printf.MSPDB140-MSVCRT ref: 00007FF7B9CF4C3E

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9CF4C19
[%05d] , xrefs: 00007FF7B9CF4BAF
[%s] [%05d] , xrefs: 00007FF7B9CF4B9A
Size > 0, xrefs: 00007FF7B9CF4C20

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: printf
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0$[%05d] $[%s] [%05d]
API String ID: 3524737521-3476604433
Opcode ID: e8239c56648bab4fa2b2f5e8b3dbc424be754bec813f2db0b6c8291fa3d70bbb
Instruction ID: 3d6da3a65651f12391b60d0bfef00ba08683cafd9d6f9a103f20e141d091f651
Opcode Fuzzy Hash: e8239c56648bab4fa2b2f5e8b3dbc424be754bec813f2db0b6c8291fa3d70bbb
Instruction Fuzzy Hash: A721CF72608A4686EA10AF2AF8886AAF7B0FF52B84F844031DB5953269DF3CE444C750

Function 00007FF7B9D22650 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF7B9D226D2

Strings

bd != nullptr && "No platform backend to shutdown, or already shutdown?", xrefs: 00007FF7B9D2268B
C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp, xrefs: 00007FF7B9D22684
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D226AA
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7B9D226B1

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: FreeLibrary
String ID: C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$bd != nullptr && "No platform backend to shutdown, or already shutdown?"
API String ID: 3664257935-1332676508
Opcode ID: 933e3e9d9e14cdf1fb685a928ada23f382910b15d4df5d7ee9841c57da70155e
Instruction ID: a091302fda23ad413920c812cacbdbc68434d0ddf1867625d2bd1b0fe6b010e6
Opcode Fuzzy Hash: 933e3e9d9e14cdf1fb685a928ada23f382910b15d4df5d7ee9841c57da70155e
Instruction Fuzzy Hash: 7D317432609A4282EB04AF19E9506B8B7B0FB26B85F848136DB6D47378DF3CE455C350

Function 00007FF7B9D240F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetMessageExtraInfo.USER32 ref: 00007FF7B9D240F3
GetCapture.USER32 ref: 00007FF7B9D24173
ReleaseCapture.USER32 ref: 00007FF7B9D2417E

Strings

Ctx != 0, xrefs: 00007FF7B9D2419A
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D24193

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Capture$ExtraInfoMessageRelease
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 1767768705-3890275027
Opcode ID: 593d8df146e3c9bd604ee6194be82d3c1ba262c0eaed81b7b5b1f7e0063fb3b4
Instruction ID: 03b365c54b4257257a683cf0ed86bacdafd7ed7d6830c90e3e7f1a4681663156
Opcode Fuzzy Hash: 593d8df146e3c9bd604ee6194be82d3c1ba262c0eaed81b7b5b1f7e0063fb3b4
Instruction Fuzzy Hash: 2C21F521A19A4282F751AF6AD8002B9B2B1FB65BD4FC14031DF2E0779CDE3CE5468720

Function 0000018CD0A0A4B0 Relevance: 7.8, APIs: 5, Instructions: 294COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 0000018CD0A0A553
fpos.LIBCPMTD ref: 0000018CD0A0A6DE
fpos.LIBCPMTD ref: 0000018CD0A0A719
fpos.LIBCPMTD ref: 0000018CD0A0A78C

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: 77ffe952fc4b999dcfd6abc97a3c4ffc9ab75299f3cc3bb578268549a1736f21
Instruction ID: a2854a3df5031ebb37d006c7505f165bfa26ed2e6d869b9287f629a91ee40870
Opcode Fuzzy Hash: 77ffe952fc4b999dcfd6abc97a3c4ffc9ab75299f3cc3bb578268549a1736f21
Instruction Fuzzy Hash: 2AB1FF30218B4C8FD7A4EB5CC45479AB7E0FBA8345F548A2DE08EC3295DB75D984CB92

Function 0000018CD0A6D930 Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 0000018CD09D5BD0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D5BDE
Part of subcall function 0000018CD09D5BD0: _Max_value.LIBCPMTD ref: 0000018CD09D5C03
Part of subcall function 0000018CD09D5BD0: _Min_value.LIBCPMTD ref: 0000018CD09D5C31

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A6D969
char_traits.LIBCPMTD ref: 0000018CD0A6D9CA
char_traits.LIBCPMTD ref: 0000018CD0A6D9ED
char_traits.LIBCPMTD ref: 0000018CD0A6DA7E

Part of subcall function 0000018CD0A12D50: wmemset.LIBCMTD ref: 0000018CD0A12D73

char_traits.LIBCPMTD ref: 0000018CD0A6DAA6

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: char_traits$Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valuewmemset
String ID:
API String ID: 1140703174-0
Opcode ID: 2c1beed089430c0d4b72a3be535a43a4126744fe2144d061b05a4d3dbc83a8f2
Instruction ID: c088950d23f8538ed4da7bbee7e276edb2b7c68ef80a9811f6bc9dc5e729bf83
Opcode Fuzzy Hash: 2c1beed089430c0d4b72a3be535a43a4126744fe2144d061b05a4d3dbc83a8f2
Instruction Fuzzy Hash: 8A51CD3055CB489FDB84FB6CC055A9AB7E1FF98391F504A2EB089D3261DE74DA40CB92

Function 0000018CD0A21E30 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000018CD0A21E5A
shared_ptr.LIBCMTD ref: 0000018CD0A21E6E

Part of subcall function 0000018CD0A22070: shared_ptr.LIBCMTD ref: 0000018CD0A2207E

allocator.LIBCPMTD ref: 0000018CD0A21E82
shared_ptr.LIBCMTD ref: 0000018CD0A21E94
allocator.LIBCPMTD ref: 0000018CD0A21EA8

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: shared_ptr$allocator$Affinity::operator!=Concurrency::details::Hardware
String ID:
API String ID: 1053258265-0
Opcode ID: fac8cde274d0089e482a859526b6d9f7be0a55b830471d17c36861a35f3ded8e
Instruction ID: 6c32b2bd1337d67916f7729293fbe70826bb85f11dfa442ff52614703f059070
Opcode Fuzzy Hash: fac8cde274d0089e482a859526b6d9f7be0a55b830471d17c36861a35f3ded8e
Instruction Fuzzy Hash: AD11BC30518B485FD694FB68C445BEBB7E1FBD8351F408A6EA48DC3262DE309A4587D2

Function 0000018CD09DE0F0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 341COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 0000018CD09DE11C
type_info::_name_internal_method.LIBCMTD ref: 0000018CD09DE1D2
type_info::_name_internal_method.LIBCMTD ref: 0000018CD09DE29A

Part of subcall function 0000018CD09D9CF0: char_traits.LIBCPMTD ref: 0000018CD09D9D1D

Strings

, xrefs: 0000018CD09DE314

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$char_traits
String ID:
API String ID: 2432257368-3916222277
Opcode ID: 58eada811cfc50bfa12ba2a5beeec2e254d07d8d36abfc2ff38303cef76b8389
Instruction ID: 4e08db1d3d37396090d2aedff976fcf4e5b1bc8cd53afd10fce4369920cd249c
Opcode Fuzzy Hash: 58eada811cfc50bfa12ba2a5beeec2e254d07d8d36abfc2ff38303cef76b8389
Instruction Fuzzy Hash: F4C1ED31168B488BD765FB68C455BDBB3E1FB98341F404B29A08EC3191EE74DA45CBA2

Function 00007FF7B9D10D50 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D11032

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7B9D10DC5, 00007FF7B9D10E02, 00007FF7B9D10F32, 00007FF7B9D10F6F
p < end(), xrefs: 00007FF7B9D10E09, 00007FF7B9D10F76
p >= begin() && p < end(), xrefs: 00007FF7B9D10DCC, 00007FF7B9D10F39

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$p < end()$p >= begin() && p < end()
API String ID: 1173767890-1901453082
Opcode ID: 4b0654cc6224b4accf271935946b73b0b684b1b90702a536bdc8a17d958ccb2f
Instruction ID: e0ada56c60e4cdde27040592b281134c9994fe4808b1a303380f418e12438c6d
Opcode Fuzzy Hash: 4b0654cc6224b4accf271935946b73b0b684b1b90702a536bdc8a17d958ccb2f
Instruction Fuzzy Hash: 3F811272B05A51C6EA14AF2AE9492A8F3B1FB12B81F884536CB2D47258EF3CE555C300

Function 0000018CD09E40A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_Subatomic.LIBCONCRTD ref: 0000018CD09E4110
_Subatomic.LIBCONCRTD ref: 0000018CD09E41AC

Strings

d, xrefs: 0000018CD09E40E0

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Subatomic
String ID: d
API String ID: 3648745215-2564639436
Opcode ID: 32f0f512572c5f2b876240f0d85275f7d0e3cd5f8e8d37a546adf0b366805964
Instruction ID: 9c63c7f7527ac06258b107f7e2a4a3504eb044ccc29d03245686ef6ffae7d3a2
Opcode Fuzzy Hash: 32f0f512572c5f2b876240f0d85275f7d0e3cd5f8e8d37a546adf0b366805964
Instruction Fuzzy Hash: 2241F470619F4C8FD794FF58C4497AAB7E2FBA9345F414A2EB08AD3260DA74D940CB42

Function 00007FF7B9D23C91 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32 ref: 00007FF7B9D23C94
MultiByteToWideChar.KERNEL32 ref: 00007FF7B9D23D6F

Strings

Ctx != 0, xrefs: 00007FF7B9D23D8F
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9D23D88

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ByteCharMultiUnicodeWideWindow
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 3417139564-3890275027
Opcode ID: 2698e420990244abdd0969a0cf8ae2069bf7b9e182d94aa0280ce259b0bd08f2
Instruction ID: d77ccf59e65e07a76c6f6bf339a81515911db7a963104075dea06015ff2c036e
Opcode Fuzzy Hash: 2698e420990244abdd0969a0cf8ae2069bf7b9e182d94aa0280ce259b0bd08f2
Instruction Fuzzy Hash: 84519422A1865286E724AF2AD4402F9F3B0EF65B48F944136DF5D47A9DDF7CD8468320

Function 00007FF7B9CF6DF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF6F04
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF6FC6

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7B9CF6E1D, 00007FF7B9CF6E4E
!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF7B9CF6E24, 00007FF7B9CF6E55

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp
API String ID: 1173767890-3599239301
Opcode ID: 1a74476acc9dd4e83879cfb7cc54077a521ab570961e410a8d4560091ccb2a23
Instruction ID: d5452436678c4f6279b947e8ed1ed88cc70acac52d3b507ccf84371d65ae68d1
Opcode Fuzzy Hash: 1a74476acc9dd4e83879cfb7cc54077a521ab570961e410a8d4560091ccb2a23
Instruction Fuzzy Hash: 1551E072608A8282DB00EF28E4681BCF3B4FB66B84BC44132DB5D43659DF3CD59AC350

Function 0000018CD09D4680 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D46B0
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD09D470F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D4721

Strings

, xrefs: 0000018CD09D4765

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 991905282-3916222277
Opcode ID: 10d6b1d029f9ddb136135efc7a3ae6b877095ebec24af036911b0b436a0fe1a6
Instruction ID: 2b237bb87f9b3c8be045a8c8bd05a97804daaa430f40e56a53954d820e23ea91
Opcode Fuzzy Hash: 10d6b1d029f9ddb136135efc7a3ae6b877095ebec24af036911b0b436a0fe1a6
Instruction Fuzzy Hash: 5B411C30158B449FE394EF68C49579ABBE1FBD8341F909A2DB499C32A1CF70D941CB92

Function 00007FF7B9D04220 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D042C6
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D04344

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7B9D04239
!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF7B9D04240

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp
API String ID: 1173767890-3599239301
Opcode ID: b31b5a46ae572bc5135d65714882fba757d099ca6e89907e2c117fa5ee8dcf9f
Instruction ID: 5ab7b43271fb6654f1ddde59173725d2fb4b0b9bdba3b7a77ed2ed2913ca0174
Opcode Fuzzy Hash: b31b5a46ae572bc5135d65714882fba757d099ca6e89907e2c117fa5ee8dcf9f
Instruction Fuzzy Hash: DC310573609A4286C745EF69D0954BCB3B5FB25B84B945233CB0D43268EF38C59AC340

Function 00007FF7B9D3BDA0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF7B9D3BDAA
GetWindowRect.USER32 ref: 00007FF7B9D3BDB8

Strings

SCREEN_RESOLUTION: horizontal = , xrefs: 00007FF7B9D3BDCD
, vertical = , xrefs: 00007FF7B9D3BDC2

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Window$DesktopRect
String ID: , vertical = $SCREEN_RESOLUTION: horizontal =
API String ID: 3963079893-3686520795
Opcode ID: 7c90521360dbd55d769f0a94670be84a4f00dc0ae0e6f56376b6e2dcda020e26
Instruction ID: 0147f2b1c833f44fd11e6723086d40cfa6e72ac1e9670efcd8bfa52f0878a034
Opcode Fuzzy Hash: 7c90521360dbd55d769f0a94670be84a4f00dc0ae0e6f56376b6e2dcda020e26
Instruction Fuzzy Hash: 37017126F0C54246FBA16F1EF4801BDB370ABAA398F950631DB6C13699DD3CE5858660

Function 00007FF7B9D26D90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7B9D26DB0
GetProcAddress.KERNEL32 ref: 00007FF7B9D26DC5

Strings

ntdll.dll, xrefs: 00007FF7B9D26DA9
RtlGetVersion, xrefs: 00007FF7B9D26DBB

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 1646373207-1489217083
Opcode ID: a6f30f69d8c39dc3d55898ddf663d1d77849ff6904338cba7caa322b0fa43df5
Instruction ID: f622b7f517191d1d81c192a74571ae6f111635c6b5115f409719b4349c575234
Opcode Fuzzy Hash: a6f30f69d8c39dc3d55898ddf663d1d77849ff6904338cba7caa322b0fa43df5
Instruction Fuzzy Hash: 90F05824A0964281EF61AF1AE4803F8B3B0ABAA700FC80135C66D016A9DE2DD608CA20

Function 00007FF7B9D28FB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF7B9D28FBB
GetLastError.KERNEL32 ref: 00007FF7B9D28FC6

Strings

C:\analysis, xrefs: 00007FF7B9D28FB4
CWSandbox, xrefs: 00007FF7B9D28FD8

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: C:\analysis$CWSandbox
API String ID: 1799206407-2896230626
Opcode ID: 62cbce53be5f319fe4b9640d7a7d66b11879ba64749fc1f2ba2d269f5d9b97ed
Instruction ID: 13f063c720f50b66edb5df645dc5a17f9856044b1f1df56f93805130dd3d3bb7
Opcode Fuzzy Hash: 62cbce53be5f319fe4b9640d7a7d66b11879ba64749fc1f2ba2d269f5d9b97ed
Instruction Fuzzy Hash: 07E03020E1894281EA407F1AD8800A5B371BB72711FD11631D32E512A9AE2CD58A9720

Function 0000018CD09E2850 Relevance: 6.4, APIs: 4, Instructions: 351COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09E2882
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09E2A43
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09E2A58

Part of subcall function 0000018CD09DAD50: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09DAD5E
Part of subcall function 0000018CD09DAD50: _Max_value.LIBCPMTD ref: 0000018CD09DAD83
Part of subcall function 0000018CD09DAD50: _Min_value.LIBCPMTD ref: 0000018CD09DADB1

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09E2B97

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
String ID:
API String ID: 348937374-0
Opcode ID: f92b1f2ea4708790b626a08718b6c7f83935265edb5cf21cb82d565086118216
Instruction ID: 34ab813cb9b7cc45f4ea01a9fefa89af917399d0b055ebe184cc4b0f21e5fc2c
Opcode Fuzzy Hash: f92b1f2ea4708790b626a08718b6c7f83935265edb5cf21cb82d565086118216
Instruction Fuzzy Hash: 43D1BE3025CB888FD794FB6CC454BAAB7E1FBA9341F504A6DA08DD3261DE70D940CB92

Function 0000018CD09FBE80 Relevance: 6.3, APIs: 4, Instructions: 300COMMON

Download Yara Rule

APIs

Part of subcall function 0000018CD09FC360: _Min_value.LIBCPMTD ref: 0000018CD09FC397

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 0000018CD09FBF9D
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000018CD09FBFD5
shared_ptr.LIBCMTD ref: 0000018CD09FBFEA
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000018CD09FC0ED

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardware$Concurrency::details::_Min_valueSchedulerScheduler::_shared_ptr
String ID:
API String ID: 122474871-0
Opcode ID: 1201105ad459e1b952de9e8ad781df7c7d1692dd5703cbbd9bfba7c6a4ae0dea
Instruction ID: bd823aa1f074ce9cd8d5112f478cc1ff614e5baf8b8d5561f9f07e22165b7b1c
Opcode Fuzzy Hash: 1201105ad459e1b952de9e8ad781df7c7d1692dd5703cbbd9bfba7c6a4ae0dea
Instruction Fuzzy Hash: F0B1BB70118B488FD794FB5CC454BAEB7E1FB98385F508A2DA08DC32A1DE74DA45CB92

Function 0000018CD0A0A1C0 Relevance: 6.3, APIs: 4, Instructions: 263COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 0000018CD0A0A2EA

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: c87aca3121aa4d0a4ce99ffdd16e7fa188978e7a18dc08499405c2d6647252e4
Instruction ID: 8003e5b33eb44fc1cbac5ab0eaa5ec17dd5f89cdb2e063d43374290f521572ef
Opcode Fuzzy Hash: c87aca3121aa4d0a4ce99ffdd16e7fa188978e7a18dc08499405c2d6647252e4
Instruction Fuzzy Hash: A191583051CF488FE794EB6CC454B9AB7E0FBA8340F548A6DE09DC32A5CA75D941CB92

Function 00007FF7B9D185A0 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D18626
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D186A3
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D18720
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9D1879E

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID:
API String ID: 1173767890-0
Opcode ID: eab6b21905e51d3eff8d2a56197303495e713b7707be6fe1fdb7baa3d4a0f7aa
Instruction ID: 8e67b9714456856d7dde078eecc0752ba81bae284c930e029c8e3742b5e26df9
Opcode Fuzzy Hash: eab6b21905e51d3eff8d2a56197303495e713b7707be6fe1fdb7baa3d4a0f7aa
Instruction Fuzzy Hash: 1D519EB360995287CB49EF29D1950BCB3B1FB65B85B948233DB0E83264DF39D55AC340

Function 0000018CD0A44760 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 0000018CD09D9CF0: char_traits.LIBCPMTD ref: 0000018CD09D9D1D

type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A4480A
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 0000018CD0A44850
type_info::_name_internal_method.LIBCMTD ref: 0000018CD0A44870
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 0000018CD0A44892

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_contexttype_info::_name_internal_method$char_traits
String ID:
API String ID: 294693563-0
Opcode ID: 5449af506ff2c6661e5ebe4c5190aede9d5536acc63e24634385c8fb253b6741
Instruction ID: 325c108037b530cdc2791131362a5af33269e79af327689aa77031cc35e31a21
Opcode Fuzzy Hash: 5449af506ff2c6661e5ebe4c5190aede9d5536acc63e24634385c8fb253b6741
Instruction Fuzzy Hash: 15415330158A888BF344FB68C4956EE77E1FB95381F508A3EA18AC31A1DF30DA40CBD1

Function 0000018CD0A25BC0 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD0A25C45
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD0A25C6E
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD0A25CA5
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD0A25CCE

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 2443641946-0
Opcode ID: 08be06c49c265cedc30954d8ca573b186e75b0be6c9493a00689574aaac4a2e3
Instruction ID: e5ef70b51d2c8c32cd099bc05ac2a975eb0efc9702b628924e9b52c99837d7f7
Opcode Fuzzy Hash: 08be06c49c265cedc30954d8ca573b186e75b0be6c9493a00689574aaac4a2e3
Instruction Fuzzy Hash: 4841E131558B488FE754FB68C455BEAB7E1FB98341F404A2EA08DC32A1DF709985CB92

Function 00007FF7B9D76090 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7B9D7610D
WideCharToMultiByte.KERNEL32 ref: 00007FF7B9D76149
GetLastError.KERNEL32 ref: 00007FF7B9D76166
GetLastError.KERNEL32 ref: 00007FF7B9D76188

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 8a8d35d71edf502955cb145adce672ea92072d8d1ba15ac3886262327fa40ceb
Instruction ID: 3ea2d4ec4d1bbbc6a9d1f62df7dc2ca931df8e90ee5854c137bc30088d5d08d4
Opcode Fuzzy Hash: 8a8d35d71edf502955cb145adce672ea92072d8d1ba15ac3886262327fa40ceb
Instruction Fuzzy Hash: 31319131A0878282EB14EF2AA44026AB3F0FB55B90F844634DFAE47B9DDF3CD5518720

Function 0000018CD0A13030 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

List.LIBCMTD ref: 0000018CD0A13069
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 0000018CD0A130DF
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A13117
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 0000018CD0A13162

Part of subcall function 0000018CD0A0CE20: std::make_error_code.LIBCPMTD ref: 0000018CD0A0CE36

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$Concurrency::details::EmptyListQueue::StructuredWorkstd::make_error_code
String ID:
API String ID: 3856960188-0
Opcode ID: 8a099eaa64921c44599d0040a850ce8e1c1bd2e4b7851a4bed96735fbbed1df3
Instruction ID: 8982d03faa60e5bed3936085555d7009043a8119bd91b068effd2b14bb38d9ba
Opcode Fuzzy Hash: 8a099eaa64921c44599d0040a850ce8e1c1bd2e4b7851a4bed96735fbbed1df3
Instruction Fuzzy Hash: EF41BE705187884FD394FF68C4557AAB7E1FBD8345F408A2EA48DC3292DF309945CB92

Function 0000018CD0A0D430 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

List.LIBCMTD ref: 0000018CD0A0D45C
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 0000018CD0A0D4D2
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD0A0D50B
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 0000018CD0A0D556

Part of subcall function 0000018CD0A0CE20: std::make_error_code.LIBCPMTD ref: 0000018CD0A0CE36

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_narrow_to_wide$Concurrency::details::EmptyListQueue::StructuredWorkstd::make_error_code
String ID:
API String ID: 108412505-0
Opcode ID: fa8212391b22175b04cd394b61bda241e1eb8c77ae00566b5bc9fef351543ef5
Instruction ID: 11e05f1a3941e51ab3c281adf5bdaf121c523437fa5129e00c4dd06fb94ac5ee
Opcode Fuzzy Hash: fa8212391b22175b04cd394b61bda241e1eb8c77ae00566b5bc9fef351543ef5
Instruction Fuzzy Hash: E331AB705187888FD394FB68C4557AAB7E2FBD8345F408A2DB48DC32A2DF709945CB92

Function 0000018CD09D3920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 0000018CD09D4F40: _WChar_traits.LIBCPMTD ref: 0000018CD09D4F6D

Part of subcall function 0000018CD09D4320: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D434C
Part of subcall function 0000018CD09D4320: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D435E
Part of subcall function 0000018CD09D4320: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000018CD09D439B

Part of subcall function 0000018CD09D4430: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD09D4498

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000018CD09D3D0A

Strings

, xrefs: 0000018CD09D3D91
X, xrefs: 0000018CD09D3AC3

Memory Dump Source

Source File: 00000000.00000002.4472641830.0000018CD09D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000018CD09D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd09d0000_Fortexternal.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Char_traits
String ID: $X
API String ID: 1626164810-1398056850
Opcode ID: 063eea553fc9bfca9b8aeafdc5da36c21b7422aabf87f839958f0c0d185b7b7b
Instruction ID: 8f9afad54333786f299ebd7dfad22c554a18486738aee0736e3f785678e1ed91
Opcode Fuzzy Hash: 063eea553fc9bfca9b8aeafdc5da36c21b7422aabf87f839958f0c0d185b7b7b
Instruction Fuzzy Hash: 24D1CD70518B888FE7A4EF68C489BDAB7E1FBD8341F50492EA48DC3251DF749584CB92

Function 00007FF7B9CF3A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF3B2F

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7B9CF3A73
g.SettingsWindows.empty(), xrefs: 00007FF7B9CF3A7A

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$g.SettingsWindows.empty()
API String ID: 1173767890-1747592857
Opcode ID: 6f9cfb39adcd5c56d3518468b8e0a463255f7995024ad30cf357cc757fd9890d
Instruction ID: fef09612573289321f87fdf4a84461db44cf0cb97707f1cfc3c1d5abea88d799
Opcode Fuzzy Hash: 6f9cfb39adcd5c56d3518468b8e0a463255f7995024ad30cf357cc757fd9890d
Instruction Fuzzy Hash: E241D632A09A8286D741EF2AA4681B8B7B0FB66BC4F944136EB5D0775DEF3CD046C710

Function 00007FF7B9CF5640 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF57A4

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9CF568F, 00007FF7B9CF56BF
i >= 0 && i < Size, xrefs: 00007FF7B9CF5696, 00007FF7B9CF56C6

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 1173767890-1817040388
Opcode ID: a41b285bc25e57d281785609a2a3e9ae753a3fa7f6339038507393243173ec3d
Instruction ID: 7b1f3bcca0847cc2d69b5d6cee9b325dec8fdcdb661da0ea9e2b595424f46aec
Opcode Fuzzy Hash: a41b285bc25e57d281785609a2a3e9ae753a3fa7f6339038507393243173ec3d
Instruction Fuzzy Hash: 3041C232618A8282D704EF29E4941BCF3B0FB65784B944132DB6D477A8EF38E49AC350

Function 00007FF7B9CF5410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7B9CF553C

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7B9CF5451, 00007FF7B9CF5480
i >= 0 && i < Size, xrefs: 00007FF7B9CF5458, 00007FF7B9CF5487

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 1173767890-1817040388
Opcode ID: 29671e0955e00863697dcf07175f39ff7db5bfdeec36a46dd3c528aa2a95441f
Instruction ID: 7fb76e30cb6b43545af14566162775281a6f19b1cf92a6f4f575b7217b3c6831
Opcode Fuzzy Hash: 29671e0955e00863697dcf07175f39ff7db5bfdeec36a46dd3c528aa2a95441f
Instruction Fuzzy Hash: 37310432608A9283D704EF28E4941BCB3B1FB55B89B904136DB5D43768EF3CD89AC320

Function 00007FF7B9D000A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

00007FF8B9F61210.VCRUNTIME140 ref: 00007FF7B9D00133

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7B9D000FD
curr_cmd->UserCallback == 0, xrefs: 00007FF7B9D00104

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007F61210
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$curr_cmd->UserCallback == 0
API String ID: 2512014792-2009316668
Opcode ID: 6e7a8e398eaff1fe81df7f3b648a466a8ebad63a72cf65ac519ad0f569bc9051
Instruction ID: 5671fd54267d768bf5648f7e6565d94d01e02fa8d95653e0169c44339158b131
Opcode Fuzzy Hash: 6e7a8e398eaff1fe81df7f3b648a466a8ebad63a72cf65ac519ad0f569bc9051
Instruction Fuzzy Hash: 1F218B32A08A45D2FB909F1AE19836DB3B0FB27B88F940031DB2D47658DF39E891C750

Function 00007FF7B9D3CFB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7B9D3CFF2

Strings

Caption, xrefs: 00007FF7B9D3CFCB
SELECT * FROM Win32_PortConnector, xrefs: 00007FF7B9D3D01F

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: Caption$SELECT * FROM Win32_PortConnector
API String ID: 1114552684-572011918
Opcode ID: a42e56395c2c9a64211847b623019ba2976587ab08f69d5eb10aa7909c6d08f3
Instruction ID: b3b50868627c87a3df2ec3fd2f151ddc963bb29e653c8ce6f58de6aa6a76ce9d
Opcode Fuzzy Hash: a42e56395c2c9a64211847b623019ba2976587ab08f69d5eb10aa7909c6d08f3
Instruction Fuzzy Hash: FE214161919586A1EA10BF59E4413FAF330FFE2344FC05072E79D826AEEE2CD649C760

Function 00007FF7B9D00180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

00007FF8B9F61210.VCRUNTIME140 ref: 00007FF7B9D001FD

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7B9D001C9
curr_cmd->UserCallback == 0, xrefs: 00007FF7B9D001D0

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007F61210
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$curr_cmd->UserCallback == 0
API String ID: 2512014792-2009316668
Opcode ID: eb5f3a28026ed2ca0d43e1b56a900fcc3a92a86825cbedaab23c80ab9ca30375
Instruction ID: b597d4a2b7aa3a0d1bd063f61c032c4355bd833d9e7b32948e2b1f5878aeee84
Opcode Fuzzy Hash: eb5f3a28026ed2ca0d43e1b56a900fcc3a92a86825cbedaab23c80ab9ca30375
Instruction Fuzzy Hash: E7215C32B18A45D6E790EF1AE29036CB3B0F726784F901031DB2D53A98EF38D9A1C750

Function 00007FF7B9D3BBE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 00007FF7B9D3BBFA

Strings

fv-az\d+-\d+, xrefs: 00007FF7B9D3BC21
Microsoft Azure Hyper-V, xrefs: 00007FF7B9D3BC49

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: ComputerName
String ID: Microsoft Azure Hyper-V$fv-az\d+-\d+
API String ID: 3545744682-1765012764
Opcode ID: 1d66ef82b51d5d570c189cd524064f9134678dc810b58e97abaa004b3a677bb8
Instruction ID: 065ccfc8e8d68cc8807e0e3797fd4c7d4c45949e96704999fa2bd7533aaa22d1
Opcode Fuzzy Hash: 1d66ef82b51d5d570c189cd524064f9134678dc810b58e97abaa004b3a677bb8
Instruction Fuzzy Hash: D8118B2161854695EA20BF29E8503B9B330FFA2740FC05431E6AD066AADE6CE548CB20

Function 00007FF7B9CF4A80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

00007FF8C87E2E80.IMM32 ref: 00007FF7B9CF4AA2

Strings

@, xrefs: 00007FF7B9CF4AF3
, xrefs: 00007FF7B9CF4AB5

Memory Dump Source

Source File: 00000000.00000002.4476689952.00007FF7B9CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9CD0000, based on PE: true

Associated: 00000000.00000002.4476661249.00007FF7B9CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7B9F89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA0CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4476689952.00007FF7BA23E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477028391.00007FF7BA241000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4477058649.00007FF7BA243000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9cd0000_Fortexternal.jbxd

Similarity

API ID: 00007
String ID: $@
API String ID: 3568877910-1077428164
Opcode ID: 47a04fc7440247f8fca85e83f76cdc011aee6d6f4263c5b710153db2b4e8f6e9
Instruction ID: e715289a0de5bdce1c3a47f6bf76a67716c6de52bcc943f68a6c75f5b910cc9a
Opcode Fuzzy Hash: 47a04fc7440247f8fca85e83f76cdc011aee6d6f4263c5b710153db2b4e8f6e9
Instruction Fuzzy Hash: F5110A7291878187DB25DF26F14422AB3B1FB9AB84F544235EB9907B18DB7CD984CF00

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fortexternal.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\FQQLHUPB.htm

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
Fortexternal.exe

Function 00007FF7B9D2C470 Relevance: 1665.1, APIs: 1, Strings: 945, Instructions: 9553
COMMON

Function 00007FF7B9D2C0A0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 89
synchronizationCOMMON

Function 00007FF7B9D223A0 Relevance: 36.9, APIs: 7, Strings: 14, Instructions: 150
libraryloaderCOMMON

Function 00007FF7B9D4030C Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 442
windowCOMMON

Function 00007FF7B9D22F30 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 182
keyboardCOMMON

Function 00007FF7B9D292C0 Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 117
COMMON

Function 00007FF7B9D3CC55 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86
COMMON

Function 00007FF7B9D3B530 Relevance: 56.4, APIs: 11, Strings: 21, Instructions: 365
registryCOMMON

Function 00007FF7B9D271B0 Relevance: 56.3, APIs: 13, Strings: 19, Instructions: 299
registryCOMMON

Function 00007FF7B9D27660 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 165
registryCOMMON

Function 00007FF7B9D2B100 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 71
COMMON

Function 00007FF7B9D2BB20 Relevance: 16.6, APIs: 11, Instructions: 76
COMMON

Function 00007FF7B9D3E3D0 Relevance: 15.5, APIs: 10, Instructions: 516
COMMON

Function 00007FF7B9D3FAF0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59
registryCOMMON

Function 00007FF7B9D425F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 151
windowCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre