Edit tour

Windows Analysis Report
ForkieByKKosty4ka.exe

Overview

General Information

Sample name:	ForkieByKKosty4ka.exe
Analysis ID:	1670048
MD5:	94ea622991260a77c641a89b0fdda267
SHA1:	9193d2daf9efa2865a36155533603ca8b95c2be9
SHA256:	284c8b2f5b187d6b221d60da2fe055cd3a0f083546cea9b122f4327eef477ed1
Tags:	exeuser-FelloBoiYuuka
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to infect the boot sector

Protects its processes via BreakOnTermination flag

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ForkieByKKosty4ka.exe (PID: 6612 cmdline: "C:\Users\user\Desktop\ForkieByKKosty4ka.exe" MD5: 94EA622991260A77C641A89B0FDDA267)

cleanup

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Operating System Destruction
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ForkieByKKosty4ka.exe

Virustotal: Detection: 8%

Perma Link

Source: ForkieByKKosty4ka.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ForkieByKKosty4ka.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: \source\repos\Forkie\Debug\Forkie.pdb source: ForkieByKKosty4ka.exe

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00AD92D0 FindFirstFileExW,FindNextFileW,	2_2_00AD92D0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00A6EA81 FindFirstFileExW,	2_2_00A6EA81
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00AD9730 FindFirstFileExW,FindNextFileW,	2_2_00AD9730

Operating System Destruction

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00A73700 CreateFileA on filename \\.\PhysicalDrive0

2_2_00A73700

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Process information set: 01 00 00 00

Jump to behavior

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00AF6880

2_2_00AF6880

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: String function: 00AE66C0 appears 34 times
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: String function: 00A6EA63 appears 103 times
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: String function: 00A701AB appears 422 times
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: String function: 00A6DA05 appears 513 times

Source: ForkieByKKosty4ka.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00A73930 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,CloseHandle,		2_2_00A73930
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00A6DA19 AdjustTokenPrivileges,		2_2_00A6DA19

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ForkieByKKosty4ka.exe

Virustotal: Detection: 8%

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Section loaded: mspdb140.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ForkieByKKosty4ka.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ForkieByKKosty4ka.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ForkieByKKosty4ka.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ForkieByKKosty4ka.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ForkieByKKosty4ka.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ForkieByKKosty4ka.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ForkieByKKosty4ka.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ForkieByKKosty4ka.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: \source\repos\Forkie\Debug\Forkie.pdb source: ForkieByKKosty4ka.exe

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00A73BE0 MessageBoxA,MessageBoxA,ExitProcess,LoadLibraryA,GetProcAddress,RtlSetProcessIsCritical,CreateThread,

2_2_00A73BE0

Source: ForkieByKKosty4ka.exe	Static PE information: section name: .textbss
Source: ForkieByKKosty4ka.exe	Static PE information: section name: .msvcjmc
Source: ForkieByKKosty4ka.exe	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00A6D0A0 push ecx; ret

2_2_00B09E76

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: CreateFileA,SetFilePointer,ReadFile,SetFilePointerEx,WriteFile, \\.\PhysicalDrive0

2_2_00A73700

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: CreateFileA,SetFilePointer,ReadFile,SetFilePointerEx,WriteFile, \\.\PhysicalDrive0

2_2_00A73700

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

API coverage: 6.9 %

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00AD92D0 FindFirstFileExW,FindNextFileW,	2_2_00AD92D0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00A6EA81 FindFirstFileExW,	2_2_00A6EA81
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00AD9730 FindFirstFileExW,FindNextFileW,	2_2_00AD9730

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00ACC080 GetSystemInfo,

2_2_00ACC080

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

API call chain: ExitProcess graph end node

graph_2-53887

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00A74950 MultiByteToWideChar,MultiByteToWideChar,DebuggerProbe,DebuggerRuntime,IsDebuggerPresent,WideCharToMultiByte,WideCharToMultiByte,

2_2_00A74950

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00AD2AC0 OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,GetFileType,WriteConsoleW,GetLastError,WriteFile,WriteFile,OutputDebugStringW,

2_2_00AD2AC0

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00A73BE0 MessageBoxA,MessageBoxA,ExitProcess,LoadLibraryA,GetProcAddress,RtlSetProcessIsCritical,CreateThread,

2_2_00A73BE0

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00A916C0 mov eax, dword ptr fs:[00000030h]	2_2_00A916C0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00ADDEE0 mov ecx, dword ptr fs:[00000030h]	2_2_00ADDEE0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00ADDE10 mov ecx, dword ptr fs:[00000030h]	2_2_00ADDE10
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00ADDFB0 mov ecx, dword ptr fs:[00000030h]	2_2_00ADDFB0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00ADE080 mov ecx, dword ptr fs:[00000030h]	2_2_00ADE080

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00A767E0 VirtualQuery,GetPdbDll,GetProcAddress,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,

2_2_00A767E0

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00A74DD0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00A74DD0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00A6E1D0 SetUnhandledExceptionFilter,	2_2_00A6E1D0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00AD18A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00AD18A0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00A75DA0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00A75DA0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: 2_2_00A76050 SetUnhandledExceptionFilter,	2_2_00A76050

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: GetLocaleInfoW,	2_2_00AE48A0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: EnumSystemLocalesW,	2_2_00AE4A30
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: EnumSystemLocalesW,	2_2_00AE4B00
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: EnumSystemLocalesW,	2_2_00AE4C20
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00AE4D70
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: EnumSystemLocalesW,	2_2_00A6E58B
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: GetLocaleInfoW,	2_2_00A6D1F4
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: GetLocaleInfoW,	2_2_00AE5330
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,	2_2_00AE5630
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: GetLocaleInfoW,	2_2_00AE5770
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00AE58C0
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: EnumSystemLocalesW,	2_2_00AE5F80
Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe	Code function: GetLocaleInfoW,	2_2_00AE6F40

Source: C:\Users\user\Desktop\ForkieByKKosty4ka.exe

Code function: 2_2_00A6E90F GetSystemTimeAsFileTime,

2_2_00A6E90F

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	2 Bootkit	1 Access Token Manipulation	2 Bootkit	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Access Token Manipulation	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ForkieByKKosty4ka.exe	8%	Virustotal		Browse
ForkieByKKosty4ka.exe	4%	ReversingLabs

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1670048
Start date and time:	2025-04-21 04:12:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Critical Process Termination
Sample name:	ForkieByKKosty4ka.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 12 Number of non-executed functions: 74
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.29.183.29, 20.109.210.53
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, c.pki.goog, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.488603955904169
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ForkieByKKosty4ka.exe
File size:	972'288 bytes
MD5:	94ea622991260a77c641a89b0fdda267
SHA1:	9193d2daf9efa2865a36155533603ca8b95c2be9
SHA256:	284c8b2f5b187d6b221d60da2fe055cd3a0f083546cea9b122f4327eef477ed1
SHA512:	f6ad1ce37e917b3cb03800a13ca52ac691affe2ef4d558fd161406707dc86c9f7630038e8dc589f94bdecf97ac47d62a1ec1ed3cc5c360cff880e9505b3127df
SSDEEP:	12288:DoSQzU9QWLWiiOuuXAu42Acd/oNTpRJ/PLDscuHcqS8n8:8pU9QWMumcd/oNTpTnLwZJn8
TLSH:	EB25D502A7A43C54F8B626F957BF63E89B2DF8E01314D0CB51C01AED962DAE17C31796
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../.../.../...;..."...;.......;...=...............>.......<...;...(.../...q.............L...../.$.............Rich/..........

File Icon


Icon Hash:	17170f6d2b2d2d13

Static PE Info

General

Entrypoint:	0x44ffdf
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6039F43A [Sat Feb 27 07:26:50 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	c3cb5b63856746e4235505d18ac02137

Entrypoint Preview

Instruction
jmp 00007FD3508FB651h
jmp 00007FD35092F8FCh
jmp 00007FD350934C57h
jmp 00007FD35097B392h
jmp 00007FD35096532Dh
jmp 00007FD3508FC398h
jmp 00007FD35090E913h
jmp 00007FD35094822Eh
jmp 00007FD35098CCB9h
jmp 00007FD3508FF824h
jmp 00007FD350978FFFh
jmp 00007FD350957C5Ah
jmp 00007FD350969BE5h
jmp 00007FD35090C800h
jmp 00007FD35099032Dh
jmp 00007FD350923E56h
jmp 00007FD350962D71h
jmp 00007FD350951E8Ch
jmp 00007FD35097B247h
jmp 00007FD35092D012h
jmp 00007FD35090464Dh
jmp 00007FD3508FADE6h
jmp 00007FD35094F603h
jmp 00007FD350906D6Eh
jmp 00007FD3509903F1h
jmp 00007FD35094BF04h
jmp 00007FD35092865Fh
jmp 00007FD3509077FAh
jmp 00007FD3508FFAA5h
jmp 00007FD3509558C0h
jmp 00007FD35092D0CBh
jmp 00007FD35098CB6Bh
jmp 00007FD350985801h
jmp 00007FD3509352DCh
jmp 00007FD35095DF07h
jmp 00007FD350961322h
jmp 00007FD35092930Dh
jmp 00007FD35096E358h
jmp 00007FD35092BDE3h
jmp 00007FD3508FD06Eh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11a240	0x50	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11d000	0x1bdd3	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x139000	0x4b10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1147f0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x114828	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11a000	0x240	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.textbss	0x1000	0x4be95	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x4d000	0xa3997	0xa3a00	a734d6070b2f2aa730251fa96f1c02d5	False	0.27788686497326204	data	5.454126167322379	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf1000	0x25a6a	0x25c00	da83f385f6ea407808982bafffe84705	False	0.17560663286423842	data	3.428532913864218	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x117000	0x25b0	0x1000	f8fe2ceaa14e754a052a9468d800a37a	False	0.123291015625	data	1.770321824723131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x11a000	0xd78	0xe00	7bf0bbd61d6d83007d7aea3f65b7a08f	False	0.3482142857142857	data	4.551611089189057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.msvcjmc	0x11b000	0x116	0x200	1a9d52a62a070d7f046386b7c4039a8e	False	0.03125	Targa image data - Map (257-257) 257 x 257 x 1 +257 +257 - 1-bit alpha "\001"	0.2288780584184795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x11c000	0x109	0x200	11a8d5e1e06af3a6d0c38f68ccbf53a7	False	0.03515625	data	0.11055713125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x11d000	0x1bdd3	0x1be00	432fcbc05562f115e27dbd1bd78809d9	False	0.099679442264574	data	3.6099294776359274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x139000	0x5a2f	0x5c00	d987c05411d734a182c1af845b223cc3	False	0.6224949048913043	data	6.014243707282866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11d780	0x115a	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	Russian	Russia	0.33340837460603334
RT_ICON	0x11e8e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Russian	Russia	0.09408315565031983
RT_ICON	0x11f788	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Russian	Russia	0.11507220216606498
RT_ICON	0x120030	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Russian	Russia	0.12427745664739884
RT_ICON	0x120598	0x90b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.791792656587473
RT_ICON	0x120ea8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Russian	Russia	0.03235710911667454
RT_ICON	0x1250d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Russian	Russia	0.04595435684647303
RT_ICON	0x127678	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.075046904315197
RT_ICON	0x128720	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.15070921985815602
RT_ICON	0x128c10	0x115a	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	Russian	Russia	0.33340837460603334
RT_ICON	0x129d70	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Russian	Russia	0.09408315565031983
RT_ICON	0x12ac18	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Russian	Russia	0.11507220216606498
RT_ICON	0x12b4c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Russian	Russia	0.12427745664739884
RT_ICON	0x12ba28	0x90b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.791792656587473
RT_ICON	0x12c338	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Russian	Russia	0.03235710911667454
RT_ICON	0x130560	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Russian	Russia	0.04595435684647303
RT_ICON	0x132b08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.075046904315197
RT_ICON	0x133bb0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.15070921985815602
RT_MENU	0x1340a0	0x5c	data	Russian	Russia	0.8913043478260869
RT_DIALOG	0x134110	0x120	data	Russian	Russia	0.6180555555555556
RT_STRING	0x134230	0x38	data	Russian	Russia	0.6607142857142857
RT_ACCELERATOR	0x134100	0x10	data	Russian	Russia	1.25
RT_GROUP_ICON	0x128b88	0x84	data	Russian	Russia	0.6590909090909091
RT_GROUP_ICON	0x134018	0x84	data	Russian	Russia	0.6515151515151515
RT_MANIFEST	0x134268	0x184	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5979381443298969

Imports

DLL	Import
KERNEL32.dll	WriteFile, CloseHandle, Sleep, GetCurrentProcess, ExitProcess, SetFilePointerEx, GetProcAddress, LoadLibraryA, ReadConsoleW, DecodePointer, FlushFileBuffers, GetConsoleMode, SetFilePointer, ReadFile, CreateThread, CreateFileA, GetCurrentThreadId, IsDebuggerPresent, RaiseException, MultiByteToWideChar, WideCharToMultiByte, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeSListHead, GetStartupInfoW, GetModuleHandleW, GetLastError, HeapAlloc, HeapFree, GetProcessHeap, VirtualQuery, FreeLibrary, InterlockedPushEntrySList, InterlockedFlushSList, GetModuleFileNameW, LoadLibraryExW, RtlUnwind, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, GetModuleHandleExW, GetStdHandle, HeapValidate, GetSystemInfo, GetFileType, OutputDebugStringW, WriteConsoleW, SetConsoleCtrlHandler, GetCurrentThread, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetStringTypeW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, HeapReAlloc, HeapSize, HeapQueryInformation, GetFileSizeEx, GetConsoleOutputCP, CreateFileW
USER32.dll	MessageBoxA, MessageBoxW
ADVAPI32.dll	AdjustTokenPrivileges, OpenProcessToken, LookupPrivilegeValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

• ForkieByKKosty4ka.exe

Click to jump to process

Memory Usage

• ForkieByKKosty4ka.exe

Click to jump to process

Target ID:	2
Start time:	22:13:17
Start date:	20/04/2025
Path:	C:\Users\user\Desktop\ForkieByKKosty4ka.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ForkieByKKosty4ka.exe"
Imagebase:	0xa20000
File size:	972'288 bytes
MD5 hash:	94EA622991260A77C641A89B0FDDA267
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	55.8%
Total number of Nodes:	129
Total number of Limit Nodes:	14

Executed Functions

Function 00AD2AC0 Relevance: 54.8, APIs: 11, Strings: 20, Instructions: 600
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 00AD2BE4
OutputDebugStringW.KERNEL32(00B273CC), ref: 00AD2C0C
OutputDebugStringW.KERNEL32(, Line ), ref: 00AD2C17
OutputDebugStringW.KERNEL32(?), ref: 00AD2C24
OutputDebugStringW.KERNEL32(00B27404), ref: 00AD2C2F

Strings

wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 00AD326D
_VCrtDbgReportW, xrefs: 00AD2BB2, 00AD2CC7, 00AD2D07, 00AD2D61, 00AD2D9B, 00AD2DEA, 00AD2E22, 00AD2EC2, 00AD2F02, 00AD2F3C, 00AD2F76, 00AD2FC7, 00AD3268, 00AD33B6
%ls(%d) : %ls, xrefs: 00AD2E89
wcscpy_s(szOutMessage, 4096, szLineMessage), xrefs: 00AD2F41
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 00AD2D0C
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 00AD2E27
_CrtDbgReport: String too long or IO Error, xrefs: 00AD2D11, 00AD2F0C
(*_errno()), xrefs: 00AD2CCC, 00AD2EC7
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 00AD2F07
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 00AD2D66
wcstombs_s(nullptr, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 00AD2F7B
P, xrefs: 00AD32B2
, Line , xrefs: 00AD2C12
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 00AD2DA0
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 00AD2DEF
Second Chance Assertion Failed: File , xrefs: 00AD2BDF
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 00AD2BB7, 00AD33BB
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 00AD2FD1
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 00AD2FCC
minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp, xrefs: 00AD2BAD, 00AD2CC2, 00AD2D02, 00AD2D5C, 00AD2D96, 00AD2DE5, 00AD2E1D, 00AD2EBD, 00AD2EFD, 00AD2F37, 00AD2F71, 00AD2FC2, 00AD3263, 00AD33B1

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: DebugOutputString
String ID: %ls(%d) : %ls$(*_errno())$, Line $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage, 4096, szLineMessage)$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(nullptr, szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 1166629820-796398028
Opcode ID: 496f2389ff92ca5c3c0820feaae1131af655f3cfd72201b27881a224e9755f9d
Instruction ID: 713137d08dd8b41347d993dbedd8b3f6c24f4227eabcb874480534642d97267e
Opcode Fuzzy Hash: 496f2389ff92ca5c3c0820feaae1131af655f3cfd72201b27881a224e9755f9d
Instruction Fuzzy Hash: 0B32AFB1A80318EBDB64DF50DD4AB9E73B8BB08740F1085D9F549662D0DFB09A88CF65

Function 00A73BE0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 80
librarywindowloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Run virus?,WARNING,00000134), ref: 00A73C1B
MessageBoxA.USER32(00000000,THIS IS THE LAST WARNING!THE CREATOR IS NOT RESPONSIBLE FOR ANY DAMAGE MADE USING THIS MALWARE!STILL EXECUTE IT?,LAST WARNING,00000134), ref: 00A73C40
ExitProcess.KERNEL32 ref: 00A73C56
LoadLibraryA.KERNEL32(ntdll.dll), ref: 00A73C77
GetProcAddress.KERNEL32(?,RtlSetProcessIsCritical), ref: 00A73C92
RtlSetProcessIsCritical.NTDLL(00000001,00000000,00000000), ref: 00A73CAA
CreateThread.KERNEL32(00000000,00000000,00A6D578,00000000,00000000,00000000), ref: 00A73CC5

Strings

LAST WARNING, xrefs: 00A73C34
THIS IS THE LAST WARNING!THE CREATOR IS NOT RESPONSIBLE FOR ANY DAMAGE MADE USING THIS MALWARE!STILL EXECUTE IT?, xrefs: 00A73C39
Run virus?, xrefs: 00A73C14
ntdll.dll, xrefs: 00A73C72
SeDebugPrivilege, xrefs: 00A73C63
WARNING, xrefs: 00A73C0F
RtlSetProcessIsCritical, xrefs: 00A73C89

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: MessageProcess$AddressCreateCriticalExitLibraryLoadProcThread
String ID: LAST WARNING$RtlSetProcessIsCritical$Run virus?$SeDebugPrivilege$THIS IS THE LAST WARNING!THE CREATOR IS NOT RESPONSIBLE FOR ANY DAMAGE MADE USING THIS MALWARE!STILL EXECUTE IT?$WARNING$ntdll.dll
API String ID: 4228153206-1395599588
Opcode ID: 9501aaf0df17850390c875f37d22696ddd8ee8debe9044643e0106b189f17ade
Instruction ID: 29edda32f42ecd46e038c3388f07e3c5ba53a97bc0c5cb43713fc70414cc822c
Opcode Fuzzy Hash: 9501aaf0df17850390c875f37d22696ddd8ee8debe9044643e0106b189f17ade
Instruction Fuzzy Hash: E0210D36F803103FD670B7A49D4BB9D7961D700752FA10291FA497B1D2D9961D9483D3

Function 00A767E0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 310
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00A76805
GetPdbDll.LIBCMTD ref: 00A768A9
GetProcAddress.KERNEL32(00000000,PDBOpenValidate5), ref: 00A768CF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A76A2C
HeapFree.KERNEL32(00000000), ref: 00A76A33
GetProcessHeap.KERNEL32 ref: 00A76AA4
HeapAlloc.KERNEL32(00000000,00000000,?), ref: 00A76AAE

Strings

PDBOpenValidate5, xrefs: 00A768C9

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeProcQueryVirtual
String ID: PDBOpenValidate5
API String ID: 1898765391-413491164
Opcode ID: 59eac7f80308047f58c4260591d6e3c29e985177a7f6a8e950acf714f002e1e5
Instruction ID: b02666b5b38934e80ab13b4d0e0d0b0b3749db7aaec58e412edad2a2beb71dc5
Opcode Fuzzy Hash: 59eac7f80308047f58c4260591d6e3c29e985177a7f6a8e950acf714f002e1e5
Instruction Fuzzy Hash: FEB16B35B006299FCF14DFA4CC54BAE7BB6FB88754F298059E905A7390DB31AD02CB91

Function 00A73930 Relevance: 9.1, APIs: 6, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 00A7397C
OpenProcessToken.ADVAPI32(00000000), ref: 00A7398A
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00A739AE
CloseHandle.KERNEL32(?), ref: 00A739C5

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Process$CloseCurrentHandleLookupOpenPrivilegeTokenValue
String ID:
API String ID: 2654680240-0
Opcode ID: 3cfb33dd0f7d24543efe3e172fb4a5873d1a06a5e6dc731372e91c712edfbb2e
Instruction ID: d2d39d7ad5daa63b30b85994e1d67b45f634109a893992038c4928596fccf3f9
Opcode Fuzzy Hash: 3cfb33dd0f7d24543efe3e172fb4a5873d1a06a5e6dc731372e91c712edfbb2e
Instruction Fuzzy Hash: 1F310672E00108AFDB14EBA8ED56BADB3B9EB44300F614164FA49E7281EB759D408791

Function 00A8C910 Relevance: 23.0, APIs: 3, Strings: 10, Instructions: 299
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000006,?,00000000), ref: 00A8C950

Strings

wcscpy_s(message_buffer, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 00A8CD5B
@, xrefs: 00A8CABF
Microsoft Visual C++ Runtime Library, xrefs: 00A8CD87
..., xrefs: 00A8CC2E
_CrtDbgReport: String too long or IO Error, xrefs: 00A8CD60
(*_errno()), xrefs: 00A8CD1B
common_message_window, xrefs: 00A8C9CB, 00A8CD16, 00A8CD56
minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp, xrefs: 00A8C9C6, 00A8CD11, 00A8CD51
@, xrefs: 00A8CA1C
traits::tcscpy_s(program_name, (sizeof(*__countof_helper(program_name)) + 0), get_program_name_unknown_text(Character())), xrefs: 00A8C9D0

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: HandleModule
String ID: (*_errno())$...$@$@$Microsoft Visual C++ Runtime Library$_CrtDbgReport: String too long or IO Error$common_message_window$minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp$traits::tcscpy_s(program_name, (sizeof(*__countof_helper(program_name)) + 0), get_program_name_unknown_text(Character()))$wcscpy_s(message_buffer, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 4139908857-1633980848
Opcode ID: 8a02cd9f87cc9d5da656a98b40303cc18deea9f0d97a6d0658f18727eb6daf9a
Instruction ID: a1c886766e9e25737b561db8331275d82d060338f463500582c108f5d9205b19
Opcode Fuzzy Hash: 8a02cd9f87cc9d5da656a98b40303cc18deea9f0d97a6d0658f18727eb6daf9a
Instruction Fuzzy Hash: 9ED17CB1944229EBDB24EF94DC4DBEAB7B4AB54304F1041E9E4096B290D7B49FC4CFA1

Function 00A73C5C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(ntdll.dll), ref: 00A73C77
GetProcAddress.KERNEL32(?,RtlSetProcessIsCritical), ref: 00A73C92
RtlSetProcessIsCritical.NTDLL(00000001,00000000,00000000), ref: 00A73CAA
CreateThread.KERNEL32(00000000,00000000,00A6D578,00000000,00000000,00000000), ref: 00A73CC5

Strings

ntdll.dll, xrefs: 00A73C72
SeDebugPrivilege, xrefs: 00A73C63
RtlSetProcessIsCritical, xrefs: 00A73C89

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: AddressCreateCriticalLibraryLoadProcProcessThread
String ID: RtlSetProcessIsCritical$SeDebugPrivilege$ntdll.dll
API String ID: 4168212113-3270220969
Opcode ID: 08744221f32daff5ac46126ca4adc5ef3e38e5a4e9ebe11c3f0987ae107006df
Instruction ID: 0edcd51d58aca528fd4cb08afae837e55b4e63674d4babb30a8cf5785638e0aa
Opcode Fuzzy Hash: 08744221f32daff5ac46126ca4adc5ef3e38e5a4e9ebe11c3f0987ae107006df
Instruction Fuzzy Hash: 9001A936F802107FD661B7B4AD47B9C7A719B00752F6202A1FE497B1D3E9961D9043D3

Function 00A74750 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

failwithmessage.LIBCMTD ref: 00A74774

Part of subcall function 00A74950: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00A74702,000000FF,00000000,00000000,?), ref: 00A749B1
Part of subcall function 00A74950: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00A74702,000000FF,?,00000000), ref: 00A749D0
Part of subcall function 00A74950: DebuggerProbe.LIBCMTD ref: 00A749EA
Part of subcall function 00A74950: DebuggerRuntime.LIBCMTD ref: 00A74A06
Part of subcall function 00A74950: IsDebuggerPresent.KERNEL32 ref: 00A74A2F

failwithmessage.LIBCMTD ref: 00A74794

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Debugger$ByteCharMultiWidefailwithmessage$PresentProbeRuntime
String ID:
API String ID: 3941055102-0
Opcode ID: fd1efcfaa176356a8cd6c0adcb30cda862dbd5beaf97d950fac376cf9d3ef3fa
Instruction ID: cc6f8b62bc67bbb54ed3bec1eaba0d48c97f867ef7ab5b367d97ee439b51e1d6
Opcode Fuzzy Hash: fd1efcfaa176356a8cd6c0adcb30cda862dbd5beaf97d950fac376cf9d3ef3fa
Instruction Fuzzy Hash: C0E065B4500104AFEB149B58FC5597B3359D785314F94C214F51C572A2EB72AD724550

Function 00AD5580 Relevance: 1.6, APIs: 1, Instructions: 91
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 00AD5588

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: aa01a8f9ecf539bd5cc2aff93a9c6738f1d22219196cfc5b9dcb0796f0e088c2
Instruction ID: 10afeb63b9e47855d0c3a92de253d0197dfc68d9acbc73b93b0f9ef936c2f44c
Opcode Fuzzy Hash: aa01a8f9ecf539bd5cc2aff93a9c6738f1d22219196cfc5b9dcb0796f0e088c2
Instruction Fuzzy Hash: A431E4B5C08288AADF16DBF5D451BFE7F756F11300F08809BE8525A382D675C708CBA2

Function 00A74BD0 Relevance: 1.5, APIs: 1, Instructions: 35
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000006,00A745A6,6B903ED7,?,?,?,00A745A6), ref: 00A74C16

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c0fec8de9f066242c14d97fb96407cbc567aa022a929d62428c2992231e39209
Instruction ID: 2e02d913413d898f4a523134200206c595138169bc8c1a61ecb04660dab2379f
Opcode Fuzzy Hash: c0fec8de9f066242c14d97fb96407cbc567aa022a929d62428c2992231e39209
Instruction Fuzzy Hash: F5F0F671A84748FBC724CF98DD01F9ABFB8F744B20F204269F505972D0D73124008A90

Function 00AE7450 Relevance: 1.5, APIs: 1, Instructions: 26
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32 ref: 00AE7485

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 0559cffa934f44047a79ea0ba5a7bc9fd82f5937fd5f424dc967d7c27d07a1db
Instruction ID: 57353adf92684cf2816fdfa217c324389556316986239087acdc4adbb7b374cb
Opcode Fuzzy Hash: 0559cffa934f44047a79ea0ba5a7bc9fd82f5937fd5f424dc967d7c27d07a1db
Instruction Fuzzy Hash: FCF03071A0414CEBCB04EFD9D94499E7BB8EF88300F108158F91993250DB70AE50DB61

Function 00A78330 Relevance: 1.5, APIs: 1, Instructions: 11
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 00A7833F

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cfcdda449e3093355ace1f95615532683115fb88f44de15e77c81508a38aec5b
Instruction ID: 08f5a9317651d0d45b5dd9606f88c40f25eaa349b7b67d724fd9b07219f4096d
Opcode Fuzzy Hash: cfcdda449e3093355ace1f95615532683115fb88f44de15e77c81508a38aec5b
Instruction Fuzzy Hash: A3C04C7611424CAB8B04DF98EC84CEB37ADAB8C611B108508BA1DC7210CA30F9549BA5

Function 00A741E0 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_common_main_seh.LIBCMTD ref: 00A741E8

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: __scrt_common_main_seh
String ID:
API String ID: 4147471026-0
Opcode ID: 1f45acf9b494ed39981534e27bc09cf64c01b739f5bc27cd40f0248eabbfc0dd
Instruction ID: bf8d31957a7c8da586d4668d5e3a7229dde78b6ec880f3696b02676c8978e449
Opcode Fuzzy Hash: 1f45acf9b494ed39981534e27bc09cf64c01b739f5bc27cd40f0248eabbfc0dd
Instruction Fuzzy Hash: C8A0022184464C49148033E53F03999769C0944714B908061752C055133D45646000EA

Non-executed Functions

Function 00A73700 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\PhysicalDrive0,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 00A7374C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00A7376E
ReadFile.KERNEL32(?,?,000FA000,?,00000000), ref: 00A73796
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000001), ref: 00A73819
WriteFile.KERNEL32(?,?,000FA000,?,00000000), ref: 00A73841

Strings

\\.\PhysicalDrive0, xrefs: 00A73747

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: File$Pointer$CreateReadWrite
String ID: \\.\PhysicalDrive0
API String ID: 832938191-1180397377
Opcode ID: ae6a33c86b284f01ea958d7b3c5eedb0ed5f7b2cc2ea51d5403133346806598b
Instruction ID: adbaf8dc7fcf52cbeea52d2d34f3529ef2cc8ca74e8a446b09d81b03df47a3bd
Opcode Fuzzy Hash: ae6a33c86b284f01ea958d7b3c5eedb0ed5f7b2cc2ea51d5403133346806598b
Instruction Fuzzy Hash: 043170F1F00318ABCB24DB18EC56FB976B4AB0A700F5141D4F60CA7681CA355A85AFA7

Function 00AE5630 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00AE566D
GetACP.KERNEL32 ref: 00AE5681
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00AE56B2

Strings

ACP, xrefs: 00AE5646
OCP, xrefs: 00AE568B

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 28dcdac122a93a2092486a42b8bc5e124ee632033e27931f9e9642373886703b
Instruction ID: 58b3c185a5f79c0e644e260bf28e5855305924388b94df1596b133f7b6827325
Opcode Fuzzy Hash: 28dcdac122a93a2092486a42b8bc5e124ee632033e27931f9e9642373886703b
Instruction Fuzzy Hash: 93119074A00648FBDB00DF72EA85EAA3378AB14749F688818FD0ADB150EB70DE40DB51

Function 00AE58C0 Relevance: 6.2, APIs: 4, Instructions: 228COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32(00000000), ref: 00AE5A7E

Part of subcall function 00AE4AB0: GetUserDefaultLCID.KERNEL32 ref: 00AE4AC6

IsValidLocale.KERNEL32(00000000,00000001), ref: 00AE5A98
GetLocaleInfoW.KERNEL32(00000000,00001001,00000000,00000040,00000000,-00000120,00000055,00000000,00000000,?,00000055,00000000), ref: 00AE5B01

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: LocaleValid$CodeDefaultInfoPageUser
String ID:
API String ID: 334263767-0
Opcode ID: 0b2e8fccadec728744d7ea70eb77a2edb558f1c4e1c3aae15f37294e46fef19a
Instruction ID: 661da2cb8d7d5ab11b10092f34f0c478e36f74a358a3590647e177d9cc95c873
Opcode Fuzzy Hash: 0b2e8fccadec728744d7ea70eb77a2edb558f1c4e1c3aae15f37294e46fef19a
Instruction Fuzzy Hash: 09917CB0E00645DFDB04DFA5E995BBFB7B5AF48308F248128E505AB281E735EC41CBA1

Function 00AE4D70 Relevance: 4.8, APIs: 3, Instructions: 292COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,00001002,?,00000078), ref: 00AE4DEF
GetLocaleInfoW.KERNEL32(?,00001001,?,00000078), ref: 00AE4E69

Part of subcall function 00AE5770: GetLocaleInfoW.KERNEL32(00000000,20000001,?,00000002,?,?,00000000,?), ref: 00AE57AB

GetLocaleInfoW.KERNEL32(?,00001001,?,00000078), ref: 00AE5005

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 98993cff081280fc6b0e29641476769ca613360df660dbcee1d0a7c84cf842a2
Instruction ID: 96b61a63b36ce5479c6ec7792bf4a0b55a78145f3ecc25a25afb2ab79ee7f662
Opcode Fuzzy Hash: 98993cff081280fc6b0e29641476769ca613360df660dbcee1d0a7c84cf842a2
Instruction Fuzzy Hash: 61D1F274E4021ACBDB64CF15D981BEAB3B5BB58304F1181E8E809AB740EB75AEC5DF50

Function 00AD18A0 Relevance: 4.6, APIs: 3, Instructions: 81COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00AD19A0
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AD19AE
UnhandledExceptionFilter.KERNEL32(?), ref: 00AD19BB

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ec107cfcc9a7e3b41c1baaa57ea044793ebadff44350cbbb137f56a724257aef
Instruction ID: 9a44eccfc9424c5247e42a6e78621e606953f923339188c512f6a6f324658f19
Opcode Fuzzy Hash: ec107cfcc9a7e3b41c1baaa57ea044793ebadff44350cbbb137f56a724257aef
Instruction Fuzzy Hash: B741D5B4C0122CABCB25DF24D9997DDB7B4BF18310F1041DAE90DA6250E7705B85CF85

Function 00AF6880 Relevance: 4.4, Strings: 3, Instructions: 603COMMON

Download Yara Rule

Strings

minkernel\crts\ucrt\inc\corecrt_internal_big_integer.h, xrefs: 00AF68C5
%ls, xrefs: 00AF68B9
("Division by zero", false), xrefs: 00AF68B4

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$("Division by zero", false)$minkernel\crts\ucrt\inc\corecrt_internal_big_integer.h
API String ID: 0-226933
Opcode ID: bc7f580edf5a365ffdca3bc120f2fbbf91d9879b8e7f31a3fb20b0a5b2e44003
Instruction ID: 6de99165c72861a2edb68d03477a4a6fc10d36cb427dc7eb02735f34df12a2d4
Opcode Fuzzy Hash: bc7f580edf5a365ffdca3bc120f2fbbf91d9879b8e7f31a3fb20b0a5b2e44003
Instruction Fuzzy Hash: 38629974E049288FDB64CF58CD90BAAB7B2BB88356F1081D9E94DA7345DB316E81CF40

Function 00ADDEE0 Relevance: 3.8, Strings: 3, Instructions: 52COMMON

Download Yara Rule

Strings

minkernel\crts\ucrt\src\appcrt\internal\win_policies.cpp, xrefs: 00ADDF61
cached_state == static_cast<long>(policyValue), xrefs: 00ADDF53
%ls, xrefs: 00ADDF58

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$cached_state == static_cast<long>(policyValue)$minkernel\crts\ucrt\src\appcrt\internal\win_policies.cpp
API String ID: 0-2042085565
Opcode ID: 66491424536a9098488db36b9722da774b40e0c47dab43c0bfc141f0b7814a8d
Instruction ID: 8ab67aa1e157a562645b960b40f42b078b56b6c07d2501d00a6a72078561ad2f
Opcode Fuzzy Hash: 66491424536a9098488db36b9722da774b40e0c47dab43c0bfc141f0b7814a8d
Instruction Fuzzy Hash: B311A5B5E40248FBCB10DF94C946BEDB7B0AB54700F208595E4176B381E7B1AE50CB81

Function 00ADDE10 Relevance: 3.8, Strings: 3, Instructions: 52COMMON

Download Yara Rule

Strings

minkernel\crts\ucrt\src\appcrt\internal\win_policies.cpp, xrefs: 00ADDE91
cached_state == static_cast<long>(policyValue), xrefs: 00ADDE83
%ls, xrefs: 00ADDE88

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$cached_state == static_cast<long>(policyValue)$minkernel\crts\ucrt\src\appcrt\internal\win_policies.cpp
API String ID: 0-2042085565
Opcode ID: e637602304ac0c1bcb028f08aceadde1ab2aec600c107b06ef65f15faadd18df
Instruction ID: 1e2b579fdc7c29c75bba5cc2486d38babd9ba34251114e2e60f35e3dad37605f
Opcode Fuzzy Hash: e637602304ac0c1bcb028f08aceadde1ab2aec600c107b06ef65f15faadd18df
Instruction Fuzzy Hash: 0011A575E40209EFCB10EF94C946BADB7B0AB54700F204599E41A6F381EB70AF44CB81

Function 00ADDFB0 Relevance: 3.8, Strings: 3, Instructions: 52COMMON

Download Yara Rule

Strings

minkernel\crts\ucrt\src\appcrt\internal\win_policies.cpp, xrefs: 00ADE031
cached_state == static_cast<long>(policyValue), xrefs: 00ADE023
%ls, xrefs: 00ADE028

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$cached_state == static_cast<long>(policyValue)$minkernel\crts\ucrt\src\appcrt\internal\win_policies.cpp
API String ID: 0-2042085565
Opcode ID: 93445ec976f9f160c977b0047cf49b9abec37e6e2d639712e5af1fd04de3ae11
Instruction ID: 99e7c3576efc114c9f781b309ee52e29dc28e54ed2bd452b69b8e6b4e957a63d
Opcode Fuzzy Hash: 93445ec976f9f160c977b0047cf49b9abec37e6e2d639712e5af1fd04de3ae11
Instruction Fuzzy Hash: 9211A575E40308EBCB14EF94D986BADB7F0AB14700F2445A5E51A6B381E7B5AE44CB81

Function 00AD9730 Relevance: 3.2, APIs: 2, Instructions: 224fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?), ref: 00AD9843
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00AD99E5

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: e65e7c685caab99005087ba8684d5421a87925c28f2d09c4bf7df6826b6ff7b9
Instruction ID: bfdcbee352eaf49c7cbac3f89a66b326df73e3bb9e81374294ac2cb2b4191a20
Opcode Fuzzy Hash: e65e7c685caab99005087ba8684d5421a87925c28f2d09c4bf7df6826b6ff7b9
Instruction Fuzzy Hash: 19A13F71A042299FDB64EF24CD99BEE7375AF95300F5045EAE40A6B291DF30AE84CF50

Function 00AD92D0 Relevance: 3.2, APIs: 2, Instructions: 223fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?), ref: 00AD93E1
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00AD9583

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 8a5558488b3fef1120eebd46ac8c12bc59cc8b2ea5fd51c1ad778f805e69d21f
Instruction ID: c43a915fcf32bf53c1ef48b504f4c7dac43e48fe3124d54daf6ed916a28c1adc
Opcode Fuzzy Hash: 8a5558488b3fef1120eebd46ac8c12bc59cc8b2ea5fd51c1ad778f805e69d21f
Instruction Fuzzy Hash: D1A16F71A042699FCB24EF20DD99BEE7775AF95301F1041EAE40A6B291DF31AE84CF40

Function 00AE5330 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,00001001,?,00000078), ref: 00AE53AF

Part of subcall function 00AE5770: GetLocaleInfoW.KERNEL32(00000000,20000001,?,00000002,?,?,00000000,?), ref: 00AE57AB

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c3ae71f8df9208b364a168bf0568cb4c8f05b5b5a3c95b4a8fcabb9c6c129de9
Instruction ID: 11aefbc45e73dcb8dc96f6211c24b080f51e414fe1ed1e5fac927891916f9615
Opcode Fuzzy Hash: c3ae71f8df9208b364a168bf0568cb4c8f05b5b5a3c95b4a8fcabb9c6c129de9
Instruction Fuzzy Hash: B4511975E4021A8BDB34CF65D981BE9B3B5AB58305F1180E8E80D9B780EB74AEC5DF50

Function 00ACC080 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,6B903ED7), ref: 00ACC0D6

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: ed13922813153c9deffb5099bd8824b2475c2355c2aa8e8cfe5151b31653223e
Instruction ID: 18bb912d8e764413219f24a213659f134d9401891a6659836ee4d117efac6351
Opcode Fuzzy Hash: ed13922813153c9deffb5099bd8824b2475c2355c2aa8e8cfe5151b31653223e
Instruction Fuzzy Hash: 9331B0B5D04258EFCB14CFA9C881AEDBBF1FB49320F25826AD419B7241D7355A41CB64

Function 00AE48A0 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,00001002,?,00000078), ref: 00AE491F

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d80f44918492c453f151ab7cb70fd76f13ed00c53bbb576e59e8f8ed666dbe6c
Instruction ID: cb62c0a2098f1d4af8171ab321b713348b253b10e5ed9b3963b547c200b28ac5
Opcode Fuzzy Hash: d80f44918492c453f151ab7cb70fd76f13ed00c53bbb576e59e8f8ed666dbe6c
Instruction Fuzzy Hash: 87313AB1E4421A8BDB64CF14D941BAAB7B4AB58300F1081E8D94DAB341EB74EEC4DF50

Function 00AE4B00 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00AE4D70,00000001), ref: 00AE4BA9

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 2febcd4c2ff507b6f83c92493a028e3708f987589e67dd523daa56ada7b40783
Instruction ID: 81619cc9f064f17d28f85fffa02286a7d63a7572990d6f07ca9137f6d89cc613
Opcode Fuzzy Hash: 2febcd4c2ff507b6f83c92493a028e3708f987589e67dd523daa56ada7b40783
Instruction Fuzzy Hash: 532119B8A00248EFDB04DF95D585BAEBBB5FB88310F208598E8155B381D775EE51CB81

Function 00AE5770 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,20000001,?,00000002,?,?,00000000,?), ref: 00AE57AB

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a7a8bf6658f1b48e4d74a81b8ecb8f275abb870d70c8ad3a04669c84ae0ccf19
Instruction ID: a9491dc3c87b9cb579f98defd23d0dd994b42100b9f05006e3a4ca6ce420e7d8
Opcode Fuzzy Hash: a7a8bf6658f1b48e4d74a81b8ecb8f275abb870d70c8ad3a04669c84ae0ccf19
Instruction Fuzzy Hash: F301B176D00254EBDB10DBBAE981ABF73B9AB44344F108579F855DB240E634EE508BA1

Function 00AE4C20 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00AE5330,00000001), ref: 00AE4C92

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 19fe28760b9468fa1e787f16a282f7b397a4a947b72cb7e0d4e1169c21ec7981
Instruction ID: 0917b2585221f54025a07ec29d86ff1a747501e213638efb9219cfcac0247d64
Opcode Fuzzy Hash: 19fe28760b9468fa1e787f16a282f7b397a4a947b72cb7e0d4e1169c21ec7981
Instruction Fuzzy Hash: F511F7B4E01248EFDB04DF95D585B9DB7B5EB88304F208198E8159B340D775AE41DB81

Function 00AE6F40 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?), ref: 00AE6F92

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7452645e52c11858bc9d0a0303084eae87608a561c6a21aa41a5400af3fb1c54
Instruction ID: 7098abacd572c52454efb4090f26384cc80e6601ce3717637529ae40ef2e2c0f
Opcode Fuzzy Hash: 7452645e52c11858bc9d0a0303084eae87608a561c6a21aa41a5400af3fb1c54
Instruction Fuzzy Hash: F0011975500208FFCB04DF98D948E9F7BB9AF88301F108548B90997250CA30AE11DB60

Function 00AE4A30 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_000C48A0,00000001), ref: 00AE4A77

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a18e2ed12fc1e9b26480c7b71a4861f2698351659af8ac8a1d06e10d442a7cbb
Instruction ID: 367a1d83a99bf148e6fbc4fca14e7adc6aacefcdc48a1a5d289bf51481118d7e
Opcode Fuzzy Hash: a18e2ed12fc1e9b26480c7b71a4861f2698351659af8ac8a1d06e10d442a7cbb
Instruction Fuzzy Hash: 82F03075940348EFEB10DF94E985B5E7BB5EB89750F2081A4E8055B340D672EE80CBD1

Function 00AE5F80 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00000000,00000001), ref: 00AE5FA9

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 8539f1650bed94a10f8feaa40469359ba9abcbb567ddde39ddce276fe7a34c11
Instruction ID: e8f27a461ff4e710292f9720b8444ff8067ade2f57e221a22f97631bad432368
Opcode Fuzzy Hash: 8539f1650bed94a10f8feaa40469359ba9abcbb567ddde39ddce276fe7a34c11
Instruction Fuzzy Hash: A5F0A7B5D04388AFDF00EBB4E807A9E7B749B01301F0040A5F84597341EE71661DCB92

Function 00A76050 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00A6E469), ref: 00A76058

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 45951bf638628437f5d3748e21205e246fb838ede21845eaa74e1f27c26d1665
Instruction ID: be2f04940a7ad4f218b8f5181a641b1e8d34a96f521e7087b4165ba0977f5dac
Opcode Fuzzy Hash: 45951bf638628437f5d3748e21205e246fb838ede21845eaa74e1f27c26d1665
Instruction Fuzzy Hash: 01A0223008030CB302002BF2BC0E8083B2CF000B223280800F20C828208EC3202000A3

Function 00A916C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f71abc6a61aeea27e477f0be29e4f9b3fd2b393605829c4231d1e46edd81c9
Instruction ID: cd474864ecd705db5db7e308a8c0d6ca96dc369111c5384889867070d0bd4640
Opcode Fuzzy Hash: 96f71abc6a61aeea27e477f0be29e4f9b3fd2b393605829c4231d1e46edd81c9
Instruction Fuzzy Hash: EBE02234F0C3CAAACF228BA48002BFE7BF88F53304F1800C4D44117242C1ABC90AE762

Function 00ADE080 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 444943a13ae2ffb8ab67dbbfae9924854bd6ff28f0f721fd2be7c0ad30b87760
Instruction ID: ba854f986479e451af1ba97555a9220b1e7abfee2e4744bbe43f7948b924ea3b
Opcode Fuzzy Hash: 444943a13ae2ffb8ab67dbbfae9924854bd6ff28f0f721fd2be7c0ad30b87760
Instruction Fuzzy Hash: 5FE048B6900248EBCB15DB54D942A5AB374E754310F244659F80D4B301E535EF11C691

Function 00A6E1D0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc5cfb00b0a832793ec46a1cf6020460bb34e82a8248cf7c8624f99aefc75f9
Instruction ID: a94bde22d71b713cfe07ececace54c385913ec22595d3d6ec688cd1e8ae482d0
Opcode Fuzzy Hash: 9dc5cfb00b0a832793ec46a1cf6020460bb34e82a8248cf7c8624f99aefc75f9
Instruction Fuzzy Hash:

Function 00A6E58B Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0538d92690580f435eaf8b7a82d857e69d8b4c7600d87bd2e9474c74118484d
Instruction ID: 26ef7044ebf832acdaef467249ba3c80596c062299c0921c198ad63a0c751813
Opcode Fuzzy Hash: c0538d92690580f435eaf8b7a82d857e69d8b4c7600d87bd2e9474c74118484d
Instruction Fuzzy Hash:

Function 00A6E90F Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a67bfcb3bb4f8734b4a3997206c0ede4099513db003de9bf1d676a18511b2f
Instruction ID: e28f99d9186e28b9d77ab939f990ad8e8d8679759fa9ba6b868e20004b22b0ab
Opcode Fuzzy Hash: b9a67bfcb3bb4f8734b4a3997206c0ede4099513db003de9bf1d676a18511b2f
Instruction Fuzzy Hash:

Function 00A6EA81 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcbe99b0b95b9213226b184d49d5136edcd1ab572c93f68bc0005ca3a5fcc68
Instruction ID: 036c01a56f460dbd254e48ff6fbc7de07835bc8c1a61c46ab04f81189e34a639
Opcode Fuzzy Hash: 0dcbe99b0b95b9213226b184d49d5136edcd1ab572c93f68bc0005ca3a5fcc68
Instruction Fuzzy Hash:

Function 00A6D1F4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa734b617cbfa559c65c032faac63661f3f8425b15eb1ee6d6552e6a40054e7
Instruction ID: c60f4e4fac0fb37915a88cd628fb57838f80cf1e7224e1894b3713daba60a871
Opcode Fuzzy Hash: 2aa734b617cbfa559c65c032faac63661f3f8425b15eb1ee6d6552e6a40054e7
Instruction Fuzzy Hash:

Function 00A6DA19 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ea879092edb4892e88a861bb063849d215a765e1a5f81b250b17f6c68218a4
Instruction ID: bb4b378f5f19ca7ce6c44e77d385d5b0ac2578b7971f58c4e494c47da2d95a45
Opcode Fuzzy Hash: 06ea879092edb4892e88a861bb063849d215a765e1a5f81b250b17f6c68218a4
Instruction Fuzzy Hash:

Function 00A8C2F0 Relevance: 23.0, APIs: 3, Strings: 10, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,00000000), ref: 00A8C330

Strings

wcscpy_s(message_buffer, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 00A8C72C
Microsoft Visual C++ Runtime Library, xrefs: 00A8C758
..., xrefs: 00A8C5FF
_CrtDbgReport: String too long or IO Error, xrefs: 00A8C731
(*_errno()), xrefs: 00A8C6EC
common_message_window, xrefs: 00A8C3AB, 00A8C6E7, 00A8C727
minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp, xrefs: 00A8C3A6, 00A8C6E2, 00A8C722
traits::tcscpy_s(program_name, (sizeof(*__countof_helper(program_name)) + 0), get_program_name_unknown_text(Character())), xrefs: 00A8C3B0
@, xrefs: 00A8C490
@, xrefs: 00A8C3FC

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: HandleModule
String ID: (*_errno())$...$@$@$Microsoft Visual C++ Runtime Library$_CrtDbgReport: String too long or IO Error$common_message_window$minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp$traits::tcscpy_s(program_name, (sizeof(*__countof_helper(program_name)) + 0), get_program_name_unknown_text(Character()))$wcscpy_s(message_buffer, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 4139908857-1633980848
Opcode ID: 1dfb374b9bcc15543f71c0d10109e18970e96be66c7b4cf1a4d1536063bc1662
Instruction ID: e9cfa1253eecc331b6acf9ae28608b8157bd4a942cdc97b31d595b36b948b146
Opcode Fuzzy Hash: 1dfb374b9bcc15543f71c0d10109e18970e96be66c7b4cf1a4d1536063bc1662
Instruction Fuzzy Hash: 72D16EB1900228DFDB28EF54CC4DBDEB7B5AB69714F1040E9E60967280D7B09AD5CFA1

Function 00A8E590 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 142COMMON

Download Yara Rule

Strings

wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 00A8E6C6
Microsoft Visual C++ Runtime Library, xrefs: 00A8E765
<program name unknown>, xrefs: 00A8E66D
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 00A8E668
Runtime Error!Program: , xrefs: 00A8E60E
wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"\n\n"), xrefs: 00A8E706
..., xrefs: 00A8E6CD
wcscpy_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"Runtime Error!\n\nProgram: "), xrefs: 00A8E609
wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), message), xrefs: 00A8E73C
__acrt_report_runtime_error, xrefs: 00A8E604, 00A8E663, 00A8E6C1, 00A8E701, 00A8E737
minkernel\crts\ucrt\src\appcrt\internal\report_runtime_error.cpp, xrefs: 00A8E5FF, 00A8E65E, 00A8E6BC, 00A8E6FC, 00A8E732

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $__acrt_report_runtime_error$minkernel\crts\ucrt\src\appcrt\internal\report_runtime_error.cpp$wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"\n\n")$wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), message)$wcscpy_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)
API String ID: 0-4242594854
Opcode ID: 0c2f9ae5089080c11e98cdd0a3b01c50f424798622dd6e64850f41a69d52765e
Instruction ID: 71442913751d2de64cfe1ac4fd7cacfdb305dcea479216f04bf6ac041193a209
Opcode Fuzzy Hash: 0c2f9ae5089080c11e98cdd0a3b01c50f424798622dd6e64850f41a69d52765e
Instruction Fuzzy Hash: 9A41B6B6F81304F7DB04FAA49D43F9E76B59B94B00F5484A4B9047B3D2EAB19B408792

Function 00A74630 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 79COMMON

Download Yara Rule

APIs

failwithmessage.LIBCMTD ref: 00A7466D

Part of subcall function 00A74950: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00A74702,000000FF,00000000,00000000,?), ref: 00A749B1
Part of subcall function 00A74950: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00A74702,000000FF,?,00000000), ref: 00A749D0
Part of subcall function 00A74950: DebuggerProbe.LIBCMTD ref: 00A749EA
Part of subcall function 00A74950: DebuggerRuntime.LIBCMTD ref: 00A74A06
Part of subcall function 00A74950: IsDebuggerPresent.KERNEL32 ref: 00A74A2F

_getMemBlockDataString.LIBCMTD ref: 00A74699
failwithmessage.LIBCMTD ref: 00A746FD

Strings

Stack area around _alloca memory reserved by this function is corrupted, xrefs: 00A746CF
Stack area around _alloca memory reserved by this function is corrupted, xrefs: 00A74664
Allocation number within this function: , xrefs: 00A746BE
%s%s%p%s%zd%s%d%s%s%s%s%s, xrefs: 00A746D4
Data: <, xrefs: 00A746B3
Size: , xrefs: 00A746C4
Address: 0x, xrefs: 00A746CA

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Debugger$ByteCharMultiWidefailwithmessage$BlockDataPresentProbeRuntimeString_get
String ID: Address: 0x$Allocation number within this function: $Data: <$Size: $%s%s%p%s%zd%s%d%s%s%s%s%s$Stack area around _alloca memory reserved by this function is corrupted$Stack area around _alloca memory reserved by this function is corrupted
API String ID: 4067135985-3301296223
Opcode ID: 90c812b3f1ee8dc500851e8ac680c0fac675a3043fc995c92109f7341117bc5c
Instruction ID: 121d3d79bbc118399aa57e7650fbec4c4c7ba5429860be53b06b6fcb9fcbba1a
Opcode Fuzzy Hash: 90c812b3f1ee8dc500851e8ac680c0fac675a3043fc995c92109f7341117bc5c
Instruction Fuzzy Hash: DD2183B6A40208ABCB10DF94DD82EEF77BCEB49710F4041A5FA1CE71D1DA709D558754

Function 00AE8730 Relevance: 16.8, APIs: 1, Strings: 10, Instructions: 265COMMON

Download Yara Rule

Strings

destination_count <= INT_MAX, xrefs: 00AE878E, 00AE87D0
("Buffer too small", 0), xrefs: 00AE8A39, 00AE8A81
*, xrefs: 00AE8AAD
destination_count > 0, xrefs: 00AE8903, 00AE8945
", xrefs: 00AE8952
%ls, xrefs: 00AE8793, 00AE8908, 00AE8A3E
minkernel\crts\ucrt\src\appcrt\convert\wctomb.cpp, xrefs: 00AE879C, 00AE87C6, 00AE8911, 00AE893B, 00AE8A4A, 00AE8A77
", xrefs: 00AE8A8E
*, xrefs: 00AE88C0
_wctomb_s_l, xrefs: 00AE87CB, 00AE8940, 00AE8A7C

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: "$"$%ls$("Buffer too small", 0)$*$*$_wctomb_s_l$destination_count <= INT_MAX$destination_count > 0$minkernel\crts\ucrt\src\appcrt\convert\wctomb.cpp
API String ID: 0-2198373435
Opcode ID: c48990a2e58f9e827753a72b619b0216d4bb5d86ddb209ef70d08715f21f68ec
Instruction ID: 1c284c8d938600a7c73fc0e3ec41c5aa1561896a1736b32aaed3abd2ea5e9996
Opcode Fuzzy Hash: c48990a2e58f9e827753a72b619b0216d4bb5d86ddb209ef70d08715f21f68ec
Instruction Fuzzy Hash: 6DB19070E00248EFDF14EF91D94ABEE77B0BF14744F20846AE5192B2D1DBB85A84CB91

Function 00B0A7EE Relevance: 15.1, APIs: 10, Instructions: 135COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00B0A7FC

Part of subcall function 00B09EF0: _cmpBYTE.LIBCMTD ref: 00B09F26

_cmpDWORD.LIBCMTD ref: 00B0A823

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: dcf5647540f9869c7e8f67cfd3f3416951bda7d1ccddd060f364bd93f6ce725b
Instruction ID: d141457cb14c2915f6362cdaa55d860478d35527b9bac42df2ce2ef5698b9289
Opcode Fuzzy Hash: dcf5647540f9869c7e8f67cfd3f3416951bda7d1ccddd060f364bd93f6ce725b
Instruction Fuzzy Hash: 7051EAB1E00208EFCB04DFACDA98A9E7FF5EB40301F51C598E409AB286D630AF44DB51

Function 00AD88B0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 221COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMTD ref: 00AD8945

Strings

?, xrefs: 00AD896B
common_expand_argv_wildcards, xrefs: 00AD891D, 00AD8B0D
traits::tcsncpy_s( character_it, character_count - (character_it - character_first), *it, count), xrefs: 00AD8B12
%ls, xrefs: 00AD88DF
result != nullptr, xrefs: 00AD88DA, 00AD8922
*, xrefs: 00AD8967
minkernel\crts\ucrt\src\appcrt\startup\argv_wildcards.cpp, xrefs: 00AD88EB, 00AD8918, 00AD8B08

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: std::exception::exception
String ID: %ls$*$?$common_expand_argv_wildcards$minkernel\crts\ucrt\src\appcrt\startup\argv_wildcards.cpp$result != nullptr$traits::tcsncpy_s( character_it, character_count - (character_it - character_first), *it, count)
API String ID: 2807920213-976376051
Opcode ID: d6e4e25024ca9d64d790ad33b8432775270b854bc5cb787235cc58f3c8425703
Instruction ID: 9e520441ae4197986ba7f3b80df489db051992065d3300dce63e21088d92c8bc
Opcode Fuzzy Hash: d6e4e25024ca9d64d790ad33b8432775270b854bc5cb787235cc58f3c8425703
Instruction Fuzzy Hash: 799117B1D00208EFDB04EFE4D992BEEB7B4AF54304F24456AE4167B391EB74AA44CB51

Function 00AE44B0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 251COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 00AE4614
IsValidCodePage.KERNEL32(0000FDE8), ref: 00AE4631

Strings

minkernel\crts\ucrt\src\appcrt\locale\get_qualified_locale.cpp, xrefs: 00AE4676, 00AE4774
wcsncpy_s(lpOutStr->szLocaleName, (sizeof(*__countof_helper(lpOutStr->szLocaleName)) + 0), _psetloc_data->_cacheLocaleName, wcslen, xrefs: 00AE4680
__acrt_get_qualified_locale, xrefs: 00AE467B, 00AE4779
utf8, xrefs: 00AE4785
wcsncpy_s(lpOutStr->szCodePage, (sizeof(*__countof_helper(lpOutStr->szCodePage)) + 0), L"utf8", 5), xrefs: 00AE477E

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: CodePageValid
String ID: __acrt_get_qualified_locale$minkernel\crts\ucrt\src\appcrt\locale\get_qualified_locale.cpp$utf8$wcsncpy_s(lpOutStr->szCodePage, (sizeof(*__countof_helper(lpOutStr->szCodePage)) + 0), L"utf8", 5)$wcsncpy_s(lpOutStr->szLocaleName, (sizeof(*__countof_helper(lpOutStr->szLocaleName)) + 0), _psetloc_data->_cacheLocaleName, wcslen
API String ID: 1911128615-3002009667
Opcode ID: 7d4e20c2441b8fac55ecc3bbf7797383121fa1948d53a4c85b4b9efcfb90e3f8
Instruction ID: e553b44e6830ccdb6e4bf46ee7a56dbf8381469c7c7fa88ecf0b69dec1819992
Opcode Fuzzy Hash: 7d4e20c2441b8fac55ecc3bbf7797383121fa1948d53a4c85b4b9efcfb90e3f8
Instruction Fuzzy Hash: 5F91E2B0A00244EBEB04DF66CD46B6E73B9AF48704F148568F9059B3C2E775EE50DB90

Function 00A86DB0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 243COMMON

Download Yara Rule

APIs

und_strncmp.LIBCMTD ref: 00A86EC5

Strings

template-parameter-, xrefs: 00A86EB9
`generic-type-, xrefs: 00A86F26
`template-parameter-, xrefs: 00A86ED7
@, xrefs: 00A86E50
generic-type-, xrefs: 00A86F09

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: und_strncmp
String ID: @$`generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 2034953485-3433397351
Opcode ID: f11a2066aa67ca98710c5d277278e7828d34dbc8264c693757a49c6a79c5b49a
Instruction ID: 7897a83566d935ebfc8e2e3bde1feeee68ef8c4e79018bb840e077bde19e22d0
Opcode Fuzzy Hash: f11a2066aa67ca98710c5d277278e7828d34dbc8264c693757a49c6a79c5b49a
Instruction Fuzzy Hash: EAA180B1D042089FDB04EFA4DD91EEEBBB5BF58300F244129F916AB261EF309A44CB51

Function 00AEDAA0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

HeapSize.KERNEL32(012A0000,00000000,00000000), ref: 00AEDB45
HeapReAlloc.KERNEL32(012A0000,00000010,00000000,?), ref: 00AEDB7A

Strings

_expand_base, xrefs: 00AEDB08
minkernel\crts\ucrt\src\appcrt\heap\expand.cpp, xrefs: 00AEDAD9, 00AEDB03
%ls, xrefs: 00AEDAD0
block != nullptr, xrefs: 00AEDACB, 00AEDB0D

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Heap$AllocSize
String ID: %ls$_expand_base$block != nullptr$minkernel\crts\ucrt\src\appcrt\heap\expand.cpp
API String ID: 3906553864-3244948836
Opcode ID: 8624e90fdfe784a354a017f7bdd3ca7b00d8c513032d0a246b5518dcb0e8fd81
Instruction ID: b725e53d6ac79a02eaeb3a5d77b9f156d946d3066e458298911a5e0ba995fbfe
Opcode Fuzzy Hash: 8624e90fdfe784a354a017f7bdd3ca7b00d8c513032d0a246b5518dcb0e8fd81
Instruction Fuzzy Hash: AB31CFB0E04348EFDB10EFA5DC46BAE7BB5EB54740F218954F515AB2C0E7B49A80CB91

Function 00A73B10 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 46windowsleepCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,This PC has been recycled by KKosty4ka...,h a v e f u n,00001030), ref: 00A73B4B
Sleep.KERNEL32(00001388), ref: 00A73B5F
MessageBoxW.USER32(00000000,I'm Forkie.I just wiped this VMand it's only copy in in memory.If you reboot, all data will be lost.Have fun! - KKosty4ka,Forkie by KKosty4ka,00000030), ref: 00A73B85

Strings

Forkie by KKosty4ka, xrefs: 00A73B79
This PC has been recycled by KKosty4ka..., xrefs: 00A73B44
I'm Forkie.I just wiped this VMand it's only copy in in memory.If you reboot, all data will be lost.Have fun! - KKosty4ka, xrefs: 00A73B7E
h a v e f u n, xrefs: 00A73B3F

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Message$Sleep
String ID: Forkie by KKosty4ka$I'm Forkie.I just wiped this VMand it's only copy in in memory.If you reboot, all data will be lost.Have fun! - KKosty4ka$This PC has been recycled by KKosty4ka...$h a v e f u n
API String ID: 3822036148-1844201075
Opcode ID: abae609f34336ef00cda9d27b2fe3b68f856f821303d9b7dc6e6b340b0879003
Instruction ID: 6c5ba960203e3351341e7c73b415063e7a63d42bc160bff246cad4c64e133e27
Opcode Fuzzy Hash: abae609f34336ef00cda9d27b2fe3b68f856f821303d9b7dc6e6b340b0879003
Instruction Fuzzy Hash: 03F0C837B842146BE620339DAC17FAA76689740792F9106A0FE59772D299865D8081D3

Function 00B0A596 Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00B0A5A4

Part of subcall function 00B09EF0: _cmpBYTE.LIBCMTD ref: 00B09F26

_cmpDWORD.LIBCMTD ref: 00B0A5CB

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 2640301d4570daf9c888c71c09274a33e47595d280c6422622a01629a6ba161a
Instruction ID: a8316002bec3432fc131df8a1cee1e2dce979b75a5dede0801218097b0996769
Opcode Fuzzy Hash: 2640301d4570daf9c888c71c09274a33e47595d280c6422622a01629a6ba161a
Instruction Fuzzy Hash: F8311E71900208EFCB04DFBCDA98A9D7FF5AB40305F55C598F409AB286E635AF44DB91

Function 00B0A6C2 Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00B0A6D0

Part of subcall function 00B09EF0: _cmpBYTE.LIBCMTD ref: 00B09F26

_cmpDWORD.LIBCMTD ref: 00B0A6F7

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: cab4e5dea73df74ae65bb80adee57d74dc798646feee793aae844ddc1c4fb3b9
Instruction ID: d6a3e44f61142912dc212a86ec54e988efeca8998174277b3229ebad80a88941
Opcode Fuzzy Hash: cab4e5dea73df74ae65bb80adee57d74dc798646feee793aae844ddc1c4fb3b9
Instruction Fuzzy Hash: 5F312D71900208EFCB04DFBCDA89A9D7FF5AB40345F61C598F409AB286D630AF44EB91

Function 00AF0290 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 439COMMONLIBRARYCODE

Download Yara Rule

Strings

pwcs != nullptr, xrefs: 00AF0300, 00AF0342
minkernel\crts\ucrt\src\appcrt\convert\wcstombs.cpp, xrefs: 00AF030E, 00AF0338
_wcstombs_l_helper, xrefs: 00AF033D
%ls, xrefs: 00AF0305

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$_wcstombs_l_helper$minkernel\crts\ucrt\src\appcrt\convert\wcstombs.cpp$pwcs != nullptr
API String ID: 0-287901994
Opcode ID: 0f0cf60533d35ea368f642b6638ed7675b44791d3f3a14c30bce58eb94c1b53d
Instruction ID: 32d46d03f99f924f89c0c2a47e5cbb2b214380415dcf1a1c05ea006a4c4be1ac
Opcode Fuzzy Hash: 0f0cf60533d35ea368f642b6638ed7675b44791d3f3a14c30bce58eb94c1b53d
Instruction Fuzzy Hash: 891213B0A00209EFDB14DFA4D994FADB7B1BF54350F208259F625AB292D774AA41CF80

Function 00A899B0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 427COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIMED ref: 00A89B09
CatchIt.LIBCMTD ref: 00A89D03

Strings

csm, xrefs: 00A89B5A
csm, xrefs: 00A89A04
csm, xrefs: 00A89A85

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: CatchIs_bad_exception_allowed
String ID: csm$csm$csm
API String ID: 974221251-393685449
Opcode ID: c635bcc587df01c3ac2da5b8668f77e92a8aeafe8a366eca20090aa46e79c4a1
Instruction ID: 824f890d847a1b03d81c66fe41d927a9723f57867646b371b88595d39dfd28df
Opcode Fuzzy Hash: c635bcc587df01c3ac2da5b8668f77e92a8aeafe8a366eca20090aa46e79c4a1
Instruction Fuzzy Hash: 16F16EB5A00209EFCB08EFA4D981AFF7BB5BF54340F188559F8155B241DB31EA45CBA1

Function 00AD8C40 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 232COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMTD ref: 00AD8CDF

Strings

common_expand_argv_wildcards, xrefs: 00AD8CB7, 00AD8EB5
traits::tcsncpy_s( character_it, character_count - (character_it - character_first), *it, count), xrefs: 00AD8EBA
%ls, xrefs: 00AD8C79
result != nullptr, xrefs: 00AD8C74, 00AD8CBC
minkernel\crts\ucrt\src\appcrt\startup\argv_wildcards.cpp, xrefs: 00AD8C85, 00AD8CB2, 00AD8EB0

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: std::exception::exception
String ID: %ls$common_expand_argv_wildcards$minkernel\crts\ucrt\src\appcrt\startup\argv_wildcards.cpp$result != nullptr$traits::tcsncpy_s( character_it, character_count - (character_it - character_first), *it, count)
API String ID: 2807920213-1103401458
Opcode ID: db60eba9ed34477084e9a2af8cd478a56e5614945ca098a7dc78224544a72bbd
Instruction ID: af7bdb0fd47e2311926a5f740fe8b14eed61bba026c34a9b1de649cf18210951
Opcode Fuzzy Hash: db60eba9ed34477084e9a2af8cd478a56e5614945ca098a7dc78224544a72bbd
Instruction Fuzzy Hash: 41A12AB0D00209DFDB14EF94D982BEEB7B5BF58300F24412AE506BB395EB74AA45CB51

Function 00A8EE30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 198COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\ForkieByKKosty4ka.exe, xrefs: 00A8EEE9, 00A8EF02, 00A8EF45
mode == _crt_argv_expanded_arguments || mode == _crt_argv_unexpanded_arguments, xrefs: 00A8EE6E, 00A8EEB6
common_configure_argv, xrefs: 00A8EEB1
%ls, xrefs: 00A8EE73
minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp, xrefs: 00A8EE7F, 00A8EEAC

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$C:\Users\user\Desktop\ForkieByKKosty4ka.exe$common_configure_argv$minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp$mode == _crt_argv_expanded_arguments || mode == _crt_argv_unexpanded_arguments
API String ID: 0-2458879550
Opcode ID: ac61946173b83e0bc1c367e02dd737cfd8092245668c17c2ceafe16b7396cd94
Instruction ID: 6342a0d4ec8c7bbfba984f60389bf4346de047abccffeaf18f2c896801b16a3b
Opcode Fuzzy Hash: ac61946173b83e0bc1c367e02dd737cfd8092245668c17c2ceafe16b7396cd94
Instruction Fuzzy Hash: C5714AB1D00209EFDB14FFE4D986BEEB7B5AF54304F204169E5066B292EB705A44CBA1

Function 00B050B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 104COMMON

Download Yara Rule

Strings

minkernel\crts\ucrt\src\appcrt\lowio\close.cpp, xrefs: 00B05117, 00B0514C, 00B051B5, 00B051EA
%ls, xrefs: 00B0510E, 00B051AC
(_osfile(fh) & FOPEN), xrefs: 00B051A7, 00B051F4
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 00B05109, 00B05156
_close, xrefs: 00B05151, 00B051EF

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_close$minkernel\crts\ucrt\src\appcrt\lowio\close.cpp
API String ID: 0-1433886027
Opcode ID: 1a8e3605f3c16d066f177adc285cb2a70f1a928ae3f097f64d1c0dd41f857140
Instruction ID: c0448ed0b11fa49a66d7f63562f56bac149184c57ac856cb8cac1d304674a58b
Opcode Fuzzy Hash: 1a8e3605f3c16d066f177adc285cb2a70f1a928ae3f097f64d1c0dd41f857140
Instruction Fuzzy Hash: 8331A2B0A84608FEDB249B94CD42BAF3FE0AB21B51F6046C4F1156A5D1D7F18A80CBA1

Function 00B01C70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 98COMMON

Download Yara Rule

Strings

minkernel\crts\ucrt\src\appcrt\lowio\commit.cpp, xrefs: 00B01CCC, 00B01CF6, 00B01D5F, 00B01D89
%ls, xrefs: 00B01CC3, 00B01D56
_commit, xrefs: 00B01CFB, 00B01D8E
(_osfile(fh) & FOPEN), xrefs: 00B01D51, 00B01D93
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 00B01CBE, 00B01D00

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_commit$minkernel\crts\ucrt\src\appcrt\lowio\commit.cpp
API String ID: 0-1026578051
Opcode ID: 1f307f4df37569ab6932e35f9cbf65f908c83489a816d231a9285c2666f01919
Instruction ID: e02d33c1442d29a75b4418d5c6b04cb69924b4b8c0ed6825fae442a7f928a272
Opcode Fuzzy Hash: 1f307f4df37569ab6932e35f9cbf65f908c83489a816d231a9285c2666f01919
Instruction Fuzzy Hash: 1B31A970E80204BADB24DB98CC87BED7FF4AB50B15F608BD4F5252E1D2D7B086908791

Function 00B0A47E Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00B0A48C

Part of subcall function 00B09EF0: _cmpBYTE.LIBCMTD ref: 00B09F26

_cmpDWORD.LIBCMTD ref: 00B0A4B3

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 886a3d6f066865c6bb5d327980fe2796885dd27cc38c0e45858bb95054f92fe6
Instruction ID: 7fd9775f9f7c1664f181487158274f33f785fb154d4ee30923cba7461c33d789
Opcode Fuzzy Hash: 886a3d6f066865c6bb5d327980fe2796885dd27cc38c0e45858bb95054f92fe6
Instruction Fuzzy Hash: 8931ED71900208EFCB04DFBCDA88A9D7FF5AB50305F51C598E409AB296D634EF44DB61

Function 00A8CF50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00A8D058

Strings

new_hook != nullptr, xrefs: 00A8CFF9, 00A8D03B
common_set_report_hook, xrefs: 00A8CFBD, 00A8D036
%ls, xrefs: 00A8CF85, 00A8CFFE
minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp, xrefs: 00A8CF8E, 00A8CFB8, 00A8D007, 00A8D031
mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE, xrefs: 00A8CF80, 00A8CFC2

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: %ls$common_set_report_hook$minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp$mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE$new_hook != nullptr
API String ID: 1114552684-2008714909
Opcode ID: 161e6e049e714a33051edcc1643ca0eba9d328926044a7d2743acf2d8937ab64
Instruction ID: 0aa88b740abcf3c016b0d78a0c93f5ed46da40729c85e5ae4a0304c6801d8fcd
Opcode Fuzzy Hash: 161e6e049e714a33051edcc1643ca0eba9d328926044a7d2743acf2d8937ab64
Instruction Fuzzy Hash: 7A2186B0E80308BAEB20BB94CC47FEE7BB16B11B25F518194F614291D2D3F55A84CB65

Function 00A8D0C0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00A8D1C8

Strings

new_hook != nullptr, xrefs: 00A8D169, 00A8D1AB
common_set_report_hook, xrefs: 00A8D12D, 00A8D1A6
%ls, xrefs: 00A8D0F5, 00A8D16E
minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp, xrefs: 00A8D0FE, 00A8D128, 00A8D177, 00A8D1A1
mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE, xrefs: 00A8D0F0, 00A8D132

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: %ls$common_set_report_hook$minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp$mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE$new_hook != nullptr
API String ID: 1114552684-2008714909
Opcode ID: 9b810b0a21e732dd1c5cffd7a258dd745fb966d2666d4af6371698f12f6b3e07
Instruction ID: dce8cb32e7e629edcef13bc6df0519d03df4585672a559d6e7527b9ea98742ee
Opcode Fuzzy Hash: 9b810b0a21e732dd1c5cffd7a258dd745fb966d2666d4af6371698f12f6b3e07
Instruction Fuzzy Hash: 0D2186B0E80308BAEB20BF90CC4BBEE7BB06B11B19F518795F514291D2D3F55684CB95

Function 00AFBDB0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372COMMON

Download Yara Rule

Strings

%ls, xrefs: 00AFBE9B
minkernel\crts\ucrt\src\appcrt\locale\comparestringa.cpp, xrefs: 00AFBEA4
cchCount1==0 && cchCount2==1 || cchCount1==1 && cchCount2==0, xrefs: 00AFBE96
minkernel\crts\ucrt\src\appcrt\locale\comparestringa.cpp, xrefs: 00AFC031, 00AFC132

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$cchCount1==0 && cchCount2==1 || cchCount1==1 && cchCount2==0$minkernel\crts\ucrt\src\appcrt\locale\comparestringa.cpp$minkernel\crts\ucrt\src\appcrt\locale\comparestringa.cpp
API String ID: 0-1085474390
Opcode ID: 7993959913260589bb7a4ad2ccacb9b9ebf609b41c952e527eeaac3da7f8496e
Instruction ID: 9c4a7b0f2ebdbfc32409c176f7516791ed8d7700f5a672c5496ef3b0a99b6e98
Opcode Fuzzy Hash: 7993959913260589bb7a4ad2ccacb9b9ebf609b41c952e527eeaac3da7f8496e
Instruction Fuzzy Hash: 49E16C71A0010DDBDF14EFE5CA52BFE77B5AB58304F204129F612AB285D739D941CBA0

Function 00AD1D30 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5), ref: 00AD1DE3
GetStdHandle.KERNEL32(000000F4), ref: 00AD1DFD

Strings

%ls, xrefs: 00AD1D65
_CrtSetReportFile, xrefs: 00AD1DA3
minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp, xrefs: 00AD1D71, 00AD1D9E
nRptType >= 0 && nRptType < _CRT_ERRCNT, xrefs: 00AD1D60, 00AD1DA8

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Handle
String ID: %ls$_CrtSetReportFile$minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp$nRptType >= 0 && nRptType < _CRT_ERRCNT
API String ID: 2519475695-1451859211
Opcode ID: 2ad17360b95574c6430ebef5d86762182bd98966840f44511b317360cb82073d
Instruction ID: 43de833285ddac0700bc06c6df8d4aff5f70075ff04e46142fdea5c3475dc44a
Opcode Fuzzy Hash: 2ad17360b95574c6430ebef5d86762182bd98966840f44511b317360cb82073d
Instruction Fuzzy Hash: E5218374A44309FBCB20CF64D945B9C7BB1E71A720F208245FD6A573E0DB709680CB51

Function 00AE0EB0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 296COMMON

Download Yara Rule

APIs

_fix_grouping.LIBCMTD ref: 00AE1149

Strings

minkernel\crts\ucrt\src\appcrt\locale\initnum.cpp, xrefs: 00AE11FE
minkernel\crts\ucrt\src\appcrt\locale\initnum.cpp, xrefs: 00AE0F05, 00AE0F40, 00AE0FCC
%ls, xrefs: 00AE11F2
ploci->lconv_num_refcount > 0, xrefs: 00AE11ED

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: _fix_grouping
String ID: %ls$minkernel\crts\ucrt\src\appcrt\locale\initnum.cpp$minkernel\crts\ucrt\src\appcrt\locale\initnum.cpp$ploci->lconv_num_refcount > 0
API String ID: 3906328105-162942574
Opcode ID: bbf3c7abeedd6f39ebe5a824b4d9b62c6b20424e53cfe40f870a30f87b73654d
Instruction ID: 6bad14c4d5b6d3f08d392cdbc03b1e3ae0189d13ce67ae2ec6cde5a56c672a88
Opcode Fuzzy Hash: bbf3c7abeedd6f39ebe5a824b4d9b62c6b20424e53cfe40f870a30f87b73654d
Instruction Fuzzy Hash: 44C162B1E40218AFDB10DF95C846FEEBBB1FF44304F148568E614AB381D7B5AA85CB91

Function 00A8EAE0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 198COMMON

Download Yara Rule

Strings

mode == _crt_argv_expanded_arguments || mode == _crt_argv_unexpanded_arguments, xrefs: 00A8EB1E, 00A8EB66
common_configure_argv, xrefs: 00A8EB61
%ls, xrefs: 00A8EB23
minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp, xrefs: 00A8EB2F, 00A8EB5C

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$common_configure_argv$minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp$mode == _crt_argv_expanded_arguments || mode == _crt_argv_unexpanded_arguments
API String ID: 0-3792389471
Opcode ID: 53215877f68a9471aebc7f847f1f056d0394c4690529aa9819f9a06b0e3ef578
Instruction ID: 5e249a58a406ba9d43b53fed4b69153db52ae05efe5e35d928c7a90b11a6f815
Opcode Fuzzy Hash: 53215877f68a9471aebc7f847f1f056d0394c4690529aa9819f9a06b0e3ef578
Instruction Fuzzy Hash: D2716DB1E00209EFDB14FFE4D996BEEB7B4AF54704F108169E5027B291EB706A44CB91

Function 00A87FF0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

Strings

d:\agent\_work\3\s\src\vctools\crt\vcruntime\src\internal\winapi_downlevel.cpp, xrefs: 00A88085, 00A880D7
%ls, xrefs: 00A88079, 00A880CB
cached_fp == invalid_function_sentinel(), xrefs: 00A88074
cached_fp == new_fp, xrefs: 00A880C6

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$cached_fp == invalid_function_sentinel()$cached_fp == new_fp$d:\agent\_work\3\s\src\vctools\crt\vcruntime\src\internal\winapi_downlevel.cpp
API String ID: 0-1715344985
Opcode ID: 43b4457f90eda92f0adc674adaffcde01f32ded0a9aafd2433f137c1f31ad7ad
Instruction ID: b82e512c8d8b2502e5445f846ce1746c66c9a95ea72c67384c7ccf93641000d8
Opcode Fuzzy Hash: 43b4457f90eda92f0adc674adaffcde01f32ded0a9aafd2433f137c1f31ad7ad
Instruction Fuzzy Hash: 91218571E40309FBCB10FBA4DD46B9E77B4AB14704FA08494F514A7281EE7A9B98CB61

Function 00AE6840 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

minkernel\crts\ucrt\src\appcrt\internal\winapi_thunks.cpp, xrefs: 00AE68CA, 00AE691C
%ls, xrefs: 00AE68BE, 00AE6910
cached_handle == INVALID_HANDLE_VALUE, xrefs: 00AE68B9
cached_handle == new_handle, xrefs: 00AE690B

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$cached_handle == INVALID_HANDLE_VALUE$cached_handle == new_handle$minkernel\crts\ucrt\src\appcrt\internal\winapi_thunks.cpp
API String ID: 0-442401637
Opcode ID: 0f33db2f4474436cbfdb42243539ecad30db0b34238eff0e2a11fe83affd973d
Instruction ID: 38d430aff9c98f526290945d8e0021607737e812f1df8e3b799de9a96ae78a59
Opcode Fuzzy Hash: 0f33db2f4474436cbfdb42243539ecad30db0b34238eff0e2a11fe83affd973d
Instruction Fuzzy Hash: CC21E470E40349FBCF20DBA4DC4ABAD77B4AB20794F200A54F015672D1EA70AF95CB91

Function 00A94810 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

std::_Timevec::_Timevec.LIBCPMTD ref: 00A948CE

Strings

minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00A9485F, 00A9488C
%ls, xrefs: 00A94853
_wsetlocale, xrefs: 00A94891
LC_MIN <= _category && _category <= LC_MAX, xrefs: 00A9484E, 00A94896

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: TimevecTimevec::_std::_
String ID: %ls$LC_MIN <= _category && _category <= LC_MAX$_wsetlocale$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp
API String ID: 4219598475-2399076032
Opcode ID: 881680be9203b04fb10eb9747fd2e7605cd31cf02700688f9241c57cd4f6e0f7
Instruction ID: 10fadc969eb03ac6b1a46430c9354ab88802280540b3e2a7e31096a33525eb58
Opcode Fuzzy Hash: 881680be9203b04fb10eb9747fd2e7605cd31cf02700688f9241c57cd4f6e0f7
Instruction Fuzzy Hash: 3F217CB6E40208FADF10EFE0CD86FEE77F8AB58700F108595F50576181EAB09685CBA1

Function 00B01B80 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(00000000), ref: 00B01BC3
GetLastError.KERNEL32 ref: 00B01BD1

Strings

minkernel\crts\ucrt\src\appcrt\lowio\commit.cpp, xrefs: 00B01BFD
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 00B01BEF
%ls, xrefs: 00B01BF4

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: BuffersErrorFileFlushLast
String ID: %ls$("Invalid file descriptor. File possibly closed by a different thread",0)$minkernel\crts\ucrt\src\appcrt\lowio\commit.cpp
API String ID: 1917127615-1268643607
Opcode ID: aef0f20c1b1a246979f30f73f1772a2887a4055f628a063133da6624a9ca647d
Instruction ID: 2b673f434e0ec633a0942263b592814f9b0a8289a132b752e6ae5be0fd31e5fb
Opcode Fuzzy Hash: aef0f20c1b1a246979f30f73f1772a2887a4055f628a063133da6624a9ca647d
Instruction Fuzzy Hash: B311E134B80200AFCB18DBA8DD46A6A37E9EB4A750F3409D8F501DB3E1EA71ED408791

Function 00AE69E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00AE6889,00000000,00000800,?,?,00AE6889,00000000), ref: 00AE69F1
GetLastError.KERNEL32(?,?,00AE6889), ref: 00AE6A05
LoadLibraryExW.KERNEL32(00AE6889,00000000,00000000,?,?,?,?,00AE6889), ref: 00AE6A46

Strings

api-ms-, xrefs: 00AE6A12
ext-ms-, xrefs: 00AE6A29

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: 26d9668ba04b3072bd7f836d0c44d26ae272cca2668a5e5be5a74d54dff62d29
Instruction ID: ae7ecb2335f4d16e19ae9a0443ae5f4ed0664bd6eb04aca4bc4895b80b0eb203
Opcode Fuzzy Hash: 26d9668ba04b3072bd7f836d0c44d26ae272cca2668a5e5be5a74d54dff62d29
Instruction Fuzzy Hash: 72018171A40348BBDB14DB61DE46B6E3BB5AB10780F208820F90DAB180DA71EA449791

Function 00AEF850 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

Strings

_mbstowcs_l_helper, xrefs: 00AEF8E5
s != nullptr, xrefs: 00AEF8A8, 00AEF8EA
%ls, xrefs: 00AEF8AD
minkernel\crts\ucrt\src\appcrt\convert\mbstowcs.cpp, xrefs: 00AEF8B6, 00AEF8E0

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: %ls$_mbstowcs_l_helper$minkernel\crts\ucrt\src\appcrt\convert\mbstowcs.cpp$s != nullptr
API String ID: 0-454128329
Opcode ID: eef50a094324b6e0eb565c7b9e1266589d96e4c11d50dde6665268e6273f2142
Instruction ID: 2c5aa714c3ecff477c0b35bed3f52ad60e73bab2ecf2c664ac46519361e73f30
Opcode Fuzzy Hash: eef50a094324b6e0eb565c7b9e1266589d96e4c11d50dde6665268e6273f2142
Instruction Fuzzy Hash: 1BC14D71A00248EFDF18EFA5C995BEDB7B1FF54350F248269E419AB291D770AE80CB50

Function 00AF2D40 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 236COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00AF2E4D

Strings

__acrt_GetLocaleInfoA, xrefs: 00AF2E0A
minkernel\crts\ucrt\src\appcrt\locale\getlocaleinfoa.cpp, xrefs: 00AF2DB0, 00AF2E91, 00AF2FB2
strncpy_s(*char_result, local_length, local_buffer, local_length - 1), xrefs: 00AF2E0F
minkernel\crts\ucrt\src\appcrt\locale\getlocaleinfoa.cpp, xrefs: 00AF2E05

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: ErrorLast
String ID: __acrt_GetLocaleInfoA$minkernel\crts\ucrt\src\appcrt\locale\getlocaleinfoa.cpp$minkernel\crts\ucrt\src\appcrt\locale\getlocaleinfoa.cpp$strncpy_s(*char_result, local_length, local_buffer, local_length - 1)
API String ID: 1452528299-34002772
Opcode ID: a74a3769b5f9980d7be8087a92b041f49dc433a845259409c705d002b0db1622
Instruction ID: 2db92a90e6d1177ff45b25cbfbbe9ba718b618e6f60d78f3d91604de3fbf2592
Opcode Fuzzy Hash: a74a3769b5f9980d7be8087a92b041f49dc433a845259409c705d002b0db1622
Instruction Fuzzy Hash: E6A13671A002189BDB24EF64DD42FAAB7B5BF14310F1082D9F61DA7292DB319E84CF61

Function 00B01320 Relevance: 7.6, APIs: 5, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,?,?,00000001), ref: 00B01346
GetLastError.KERNEL32 ref: 00B01350
SetFilePointerEx.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00B0139D
GetLastError.KERNEL32 ref: 00B013A7

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c4f965b4d84dec7e0c881b5c58d58554bb7096ec5d06c496a53eed933b3ba123
Instruction ID: f47172536995ebce59310a109e18575166924c6b42fb53849b83839f491ae1fe
Opcode Fuzzy Hash: c4f965b4d84dec7e0c881b5c58d58554bb7096ec5d06c496a53eed933b3ba123
Instruction Fuzzy Hash: 6A2110B1900108EBDB08DFA9DD45BAF7BF9FF48310F208659B529D32D0DB7499008B51

Function 00A77320 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMTD ref: 00A7736D
_ValidateLocalCookies.LIBCMTD ref: 00A774A0
_ValidateLocalCookies.LIBCMTD ref: 00A774F3

Strings

csm, xrefs: 00A7741F

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: CookiesLocalValidate
String ID: csm
API String ID: 2268201637-1018135373
Opcode ID: f9f6b396c4cf9e9944d7f15f9e0d41d2b5d24a3b05e952679d68ee28e0147636
Instruction ID: d3a3d53ee0ac9af1a2c55abb380104a9c837d90a1ca1bd7d0d93847858466d8d
Opcode Fuzzy Hash: f9f6b396c4cf9e9944d7f15f9e0d41d2b5d24a3b05e952679d68ee28e0147636
Instruction Fuzzy Hash: 24513C74E04209EFCB08CF94D991AAEBBB1BF49314F10C198E9196B391D735AA41CFA1

Function 00A882C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00A88187,00000000,00000800,?,?,00A88187,00000000), ref: 00A882CF
GetLastError.KERNEL32(?,?,00A88187), ref: 00A882E3
LoadLibraryExW.KERNEL32(00A88187,00000000,00000000,?,00A88187), ref: 00A8830D

Strings

api-ms-, xrefs: 00A882F0

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 065a76b00ab2fadb8a28d845e09972a4fe72c190b784f4a2f67f35332939ecdc
Instruction ID: 4bf026be03fc34dfe759617b2b8b7b17029a1a55caf8d026c69624dbc5533046
Opcode Fuzzy Hash: 065a76b00ab2fadb8a28d845e09972a4fe72c190b784f4a2f67f35332939ecdc
Instruction Fuzzy Hash: 00F0BE75A00304FBDB04ABA0CC4ABAE37B8EB00F00F604410F9489B180EEB9EE44DB91

Function 00ACBC40 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 255memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(012A0000,00000000,?), ref: 00ACBDCF

Strings

Error: memory allocation: bad memory block type., xrefs: 00ACBD9A
Client hook allocation failure at file %hs line %d., xrefs: 00ACBCFB
Client hook allocation failure., xrefs: 00ACBD18

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: AllocHeap
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.
API String ID: 4292702814-2973468218
Opcode ID: 5e45a452f974e21418cf03fed561b35b6e10edb13e8d22fe9bda9aa74d087d56
Instruction ID: c4e98bd75023b1364491c2b3286ff638c793e6a21818d274c1cd67a0bcbaa196
Opcode Fuzzy Hash: 5e45a452f974e21418cf03fed561b35b6e10edb13e8d22fe9bda9aa74d087d56
Instruction Fuzzy Hash: F0B16DB4A10318EBDB14DF94DC82FAD77B2BB48314F208559F909AB391DB769940CFA1

Function 00B07362 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00B0737C
GetLastError.KERNEL32 ref: 00B07388
___initconout.LIBCMT ref: 00B07398

Part of subcall function 00B07416: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B0739D), ref: 00B07429

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00B073AC

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: b912937d3d9a3ab33e208939b3514d96a75176599ec56399a58225477dd28298
Instruction ID: 26c3fee9bfa0a2c0771e648111c9524139572c2c292781f0e6d517d5ef501622
Opcode Fuzzy Hash: b912937d3d9a3ab33e208939b3514d96a75176599ec56399a58225477dd28298
Instruction Fuzzy Hash: A2F05E36544544ABCB222B95DC05D4ABFA7EB89350B200454F6D983530CE32E810AB21

Function 00B0747E Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00B07495
GetLastError.KERNEL32 ref: 00B074A1
___initconout.LIBCMT ref: 00B074B1

Part of subcall function 00B07416: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B0739D), ref: 00B07429

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00B074C6

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 875fcb96630d6a78403d9de30418afacf14eae7967e84a697cd0d108f5ba0eb7
Instruction ID: c86a0ae4ca1cf4c8c48b14fc48913ea1c8c57c0c93b5bdced877870a9b530132
Opcode Fuzzy Hash: 875fcb96630d6a78403d9de30418afacf14eae7967e84a697cd0d108f5ba0eb7
Instruction Fuzzy Hash: D1F03736545558BBCF222FA1DC0898E7F66FF093A0F204050FA5996170CF32DD20DB91

Function 00ADB3A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0000FDE9,?), ref: 00ADB3D3

Strings

, xrefs: 00ADB4A4
z, xrefs: 00ADB6A7

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: Info
String ID: $z
API String ID: 1807457897-2251613814
Opcode ID: 3827063bfcd941fe3c44b1199b681727e58d00e230833c586f7f386c9e5684ca
Instruction ID: c5765eca4be8443b03557e36ae36e7db885081fb2f6495a1707892df068699c5
Opcode Fuzzy Hash: 3827063bfcd941fe3c44b1199b681727e58d00e230833c586f7f386c9e5684ca
Instruction Fuzzy Hash: 1DA11974A5825CDBDB25CF49C891BE9BB71EF44304F1480DAD94E5B382C378AA91CFA4

Function 00AD65A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(Function_000B5C20,00000001), ref: 00AD6657

Strings

minkernel\crts\ucrt\src\appcrt\misc\signal.cpp, xrefs: 00AD6746

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: ConsoleCtrlHandler
String ID: minkernel\crts\ucrt\src\appcrt\misc\signal.cpp
API String ID: 1513847179-3244217075
Opcode ID: 9e6ba7f68964c10b9aef863cba27f146839f426cf90d8b2059c4721286700c78
Instruction ID: 71d93273dd73cc1e9e7de62517b1f53f1e8e50b68e2c12084e94ff1082abda97
Opcode Fuzzy Hash: 9e6ba7f68964c10b9aef863cba27f146839f426cf90d8b2059c4721286700c78
Instruction Fuzzy Hash: 2D71AEB5E00208EFCB14DFA4D985AEE7BB5EF49308F14852AF8066B351D735E944CBA1

Function 00A8A040 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

RCC, xrefs: 00A8A086
MOC, xrefs: 00A8A07B

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID:
String ID: MOC$RCC
API String ID: 0-2084237596
Opcode ID: 1fd8e8fb234002cc42bf269c96c37e65f150a7988d74e7dbf537c866d3502b8c
Instruction ID: 9ac5c3319ee720139d303d0ac72e9819b42b2241cf4a24639a1f411840e1b09c
Opcode Fuzzy Hash: 1fd8e8fb234002cc42bf269c96c37e65f150a7988d74e7dbf537c866d3502b8c
Instruction Fuzzy Hash: 2B516375A00109EFDB04EF94C981EEF77B9AF58300F14825AF916A7291DB30EE41CB92

Function 00ADCF17 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00ADCF20
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00ADCF9C

Strings

minkernel\crts\ucrt\src\desktopcrt\env\get_environment_from_os.cpp, xrefs: 00ADCF53

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID: minkernel\crts\ucrt\src\desktopcrt\env\get_environment_from_os.cpp
API String ID: 3328510275-170101930
Opcode ID: 888288d6e3b6d66fbfbdda4895d6e82c188a14efbf276ae946f8c96dce9fa0a4
Instruction ID: 8e0b603d1c90440edfcafb288f39a78c81232b6b094478acbc4d778571ad93fb
Opcode Fuzzy Hash: 888288d6e3b6d66fbfbdda4895d6e82c188a14efbf276ae946f8c96dce9fa0a4
Instruction Fuzzy Hash: 9D01D6E2A013527EE72117B61D4EDFF396ECFCABA4B544126BA06D6341ED658D01C1B0

Function 00A943B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63timeCOMMON

Download Yara Rule

APIs

std::_Timevec::_Timevec.LIBCPMTD ref: 00A94436
std::_Timevec::_Timevec.LIBCPMTD ref: 00A9444D

Strings

minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00A943C5

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: TimevecTimevec::_std::_
String ID: minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp
API String ID: 4219598475-2192260110
Opcode ID: 4ddd17a069ce82bf25d73acf0af37dfdf036f88601fa3e31618818d27d30375a
Instruction ID: b713bb47e47253d54fd0b498543a1fceefc617e87c241044f73c7bfa1f7ee7fd
Opcode Fuzzy Hash: 4ddd17a069ce82bf25d73acf0af37dfdf036f88601fa3e31618818d27d30375a
Instruction Fuzzy Hash: 8C210075E40108AFDB04FB94DA53EEEB7B4AF54300F5041A5E5556B292EF306F06CB91

Function 00A91720 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,00000000,?,00A91540,?), ref: 00A91746

Strings

mscoree.dll, xrefs: 00A9173F
CorExitProcess, xrefs: 00A9175A

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: HandleModule
String ID: CorExitProcess$mscoree.dll
API String ID: 4139908857-1276376045
Opcode ID: c671918223d323e7b851a71d888ca89010da1c9df3a3ce1d86f0438b78bf6fb1
Instruction ID: 4ba0bc3b5f138a28b1aa8a5360582f1777a5250695e4f3b3fb68262ff4a85e38
Opcode Fuzzy Hash: c671918223d323e7b851a71d888ca89010da1c9df3a3ce1d86f0438b78bf6fb1
Instruction Fuzzy Hash: AF01DA34E00109FFCB04FBE4DE96AEDBB78AF50305F6041A8E40666191EF305B44DB55

Function 00ADCFCD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,00A9024E,?,?,00A901AB,00A90BA3), ref: 00ADCFD1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00ADD01E

Strings

minkernel\crts\ucrt\src\desktopcrt\env\get_environment_from_os.cpp, xrefs: 00ADCFEC

Memory Dump Source

Source File: 00000002.00000002.1480643754.0000000000A73000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000002.00000002.1480610957.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000A6D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480643754.0000000000B0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480751496.0000000000B11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480793467.0000000000B37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480813702.0000000000B3A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1480831945.0000000000B59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a20000_ForkieByKKosty4ka.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID: minkernel\crts\ucrt\src\desktopcrt\env\get_environment_from_os.cpp
API String ID: 3328510275-170101930
Opcode ID: fea4e5313d7b0d2336493b54d2e82698a1eaa2329a41be4194d04aea204586f7
Instruction ID: 0de275379916268b4b730c8e786101f4876c00e187a22fad662ac98e8a55da44
Opcode Fuzzy Hash: fea4e5313d7b0d2336493b54d2e82698a1eaa2329a41be4194d04aea204586f7
Instruction Fuzzy Hash: B4F0A7676417213AD12122793E4FF7F2659CBC5B74F650125F61AA63C3EE684C0251A1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ForkieByKKosty4ka.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: ForkieByKKosty4ka.exePID: 6612, Parent PID: 496

General

File Activities

File Opened

File Read

File Attributes Queried

Volume Information Queried

Device IO

Section Activities

Sections loaded by Windows

Windows Analysis Report
ForkieByKKosty4ka.exe

Function 00AD2AC0 Relevance: 54.8, APIs: 11, Strings: 20, Instructions: 600
COMMON

Function 00A73BE0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 80
librarywindowloaderCOMMON

Function 00A767E0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 310
memorylibraryloaderCOMMON

Function 00A73930 Relevance: 9.1, APIs: 6, Instructions: 105
COMMON

Function 00A8C910 Relevance: 23.0, APIs: 3, Strings: 10, Instructions: 299
COMMONLIBRARYCODE

Function 00A73C5C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47
libraryloaderthreadCOMMON

Function 00A74750 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Function 00AD5580 Relevance: 1.6, APIs: 1, Instructions: 91
COMMONLIBRARYCODE

Function 00A74BD0 Relevance: 1.5, APIs: 1, Instructions: 35
COMMONLIBRARYCODE

Function 00AE7450 Relevance: 1.5, APIs: 1, Instructions: 26
windowCOMMON

Function 00A78330 Relevance: 1.5, APIs: 1, Instructions: 11
libraryCOMMON

Function 00A741E0 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON