Play interactive tour

Edit tour

Analysis Report New Inquiry 903838737777721102029393003938.exe

Overview

General Information

Sample Name:	New Inquiry 903838737777721102029393003938.exe
Analysis ID:	112557
MD5:	01a54f73856cfb74a3bbba47bcec227b
SHA1:	ed2ed885dcd7be832cdae5c189bd7db78ca9eaa2
SHA256:	759c87f02d5850ee317454dc8242067d042a320f653946c9162b645c0ae68ba6
Most interesting Screenshot:

Detection

GuLoader LuminosityLink

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Potential malicious icon found

Yara detected GuLoader

Yara detected LuminosityLink RAT

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to hide a thread from the debugger

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Installs a global keyboard hook

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64native

New Inquiry 903838737777721102029393003938.exe (PID: 6652 cmdline: 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe' MD5: 01A54F73856CFB74A3BBBA47BCEC227B)

RegAsm.exe (PID: 1576 cmdline: 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe' MD5: 6AFAE79556E125202DCF1D3FE74A3638)

RegAsm.exe (PID: 1440 cmdline: 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe' MD5: 6AFAE79556E125202DCF1D3FE74A3638)

conhost.exe (PID: 1584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C221707E5CE93515AC87507E19181E2A)

anibtcent.exe.exe (PID: 4188 cmdline: 'C:\ProgramData\782401\anibtcent.exe.exe' MD5: 6AFAE79556E125202DCF1D3FE74A3638)

conhost.exe (PID: 1500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C221707E5CE93515AC87507E19181E2A)

demisphereklediskene.exe (PID: 1812 cmdline: 'C:\Users\user\Hustankesgy3\demisphereklediskene.exe' MD5: 01A54F73856CFB74A3BBBA47BCEC227B)

RegAsm.exe (PID: 4328 cmdline: 'C:\Users\user\Hustankesgy3\demisphereklediskene.exe' MD5: 6AFAE79556E125202DCF1D3FE74A3638)

conhost.exe (PID: 4084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C221707E5CE93515AC87507E19181E2A)

RegAsm.exe (PID: 2652 cmdline: 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe' MD5: 6AFAE79556E125202DCF1D3FE74A3638)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C221707E5CE93515AC87507E19181E2A)

demisphereklediskene.exe (PID: 2140 cmdline: 'C:\Users\user\Hustankesgy3\demisphereklediskene.exe' MD5: 01A54F73856CFB74A3BBBA47BCEC227B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
0000000D.00000002.24321865954.000000001DD3A000.00000004.00000001.sdmp	JoeSecurity_LuminosityLink	Yara detected LuminosityLink RAT	Joe Security
00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: RegAsm.exe PID: 1440	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: RegAsm.exe PID: 1440	JoeSecurity_LuminosityLink	Yara detected LuminosityLink RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 4328	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Virustotal: Detection: 20%			Perma Link
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	ReversingLabs: Detection: 18%

Multi AV Scanner detection for submitted file

Show sources

Source: New Inquiry 903838737777721102029393003938.exe	Virustotal: Detection: 20%			Perma Link
Source: New Inquiry 903838737777721102029393003938.exe	ReversingLabs: Detection: 18%

Yara detected LuminosityLink RAT

Show sources

Source: Yara match	File source: 0000000D.00000002.24321865954.000000001DD3A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1440, type: MEMORY

Bitcoin Miner:

Yara detected LuminosityLink RAT

Show sources

Source: Yara match	File source: 0000000D.00000002.24321865954.000000001DD3A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1440, type: MEMORY

Source: global traffic

TCP traffic: 192.168.0.80:49780 -> 194.5.97.46:3021

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: RegAsm.exe, 0000000D.00000002.24301433100.00000000010A5000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265379647.0000000000E64000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: RegAsm.exe, 0000000D.00000002.24301433100.00000000010A5000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265379647.0000000000E64000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: RegAsm.exe, 0000000D.00000002.24301548535.00000000010C1000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265379647.0000000000E64000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: RegAsm.exe, 0000000D.00000002.24328207020.0000000021190000.00000002.00000001.sdmp	String found in binary or memory: https://aka.ms/hcsadmin
Source: RegAsm.exe, 0000000D.00000002.24301095324.000000000107D000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265379647.0000000000E64000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265110684.0000000000E2E000.00000004.00000020.sdmp	String found in binary or memory: https://eaup2w.sn.files.1drv.com/
Source: RegAsm.exe, 00000013.00000002.24265379647.0000000000E64000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265299276.0000000000E52000.00000004.00000020.sdmp	String found in binary or memory: https://eaup2w.sn.files.1drv.com/y4m4bqAkwHQUJx1iHbF6prKSSCddXNt-56Mg951zMrckoiAx-x88t2pks0UEJqWB7st
Source: RegAsm.exe, 0000000D.00000002.24301433100.00000000010A5000.00000004.00000020.sdmp, RegAsm.exe, 0000000D.00000002.24301548535.00000000010C1000.00000004.00000020.sdmp	String found in binary or memory: https://eaup2w.sn.files.1drv.com/y4mcRoU26afjmMcM96C_CG1xmFAJaGVWXqZWLE8oSmKi-bsn2pOmBTUtvaCnggDIr1k
Source: RegAsm.exe, 0000000D.00000002.24300776016.000000000104B000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24264785299.0000000000DDB000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: RegAsm.exe, 00000013.00000002.24265110684.0000000000E2E000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.com/download?cid=249E8FCE0A15C968&resid=249E8FCE0A15C968%211276&authkey=ADoYXV
Source: RegAsm.exe, 00000013.00000002.24264785299.0000000000DDB000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.com/l
Source: RegAsm.exe, 0000000D.00000002.24301433100.00000000010A5000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265379647.0000000000E64000.00000004.00000020.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Jump to behavior

E-Banking Fraud:

Yara detected LuminosityLink RAT

Show sources

Source: Yara match	File source: 0000000D.00000002.24321865954.000000001DD3A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1440, type: MEMORY

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_02240A3F NtSetInformationThread,	3_2_02240A3F
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_02240AA2 NtSetInformationThread,	3_2_02240AA2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F09EF3 NtSetInformationThread,	13_2_00F09EF3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F005E5 EnumWindows,NtSetInformationThread,	13_2_00F005E5
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F09B4C NtProtectVirtualMemory,	13_2_00F09B4C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F016BE NtSetInformationThread,	13_2_00F016BE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F00A7A NtSetInformationThread,	13_2_00F00A7A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F09E56 NtProtectVirtualMemory,	13_2_00F09E56
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F00631 NtSetInformationThread,	13_2_00F00631
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F00629 NtSetInformationThread,	13_2_00F00629
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F011F0 NtSetInformationThread,	13_2_00F011F0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F01719 NtSetInformationThread,	13_2_00F01719
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_204F2CD2 NtQuerySystemInformation,	13_2_204F2CD2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_204F2C97 NtQuerySystemInformation,	13_2_204F2C97
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Code function: 18_2_021C0A3F NtSetInformationThread,	18_2_021C0A3F
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Code function: 18_2_021C0AA2 NtSetInformationThread,	18_2_021C0AA2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C39EF3 NtSetInformationThread,	19_2_00C39EF3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C305E5 EnumWindows,NtSetInformationThread,	19_2_00C305E5
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C39B4C NtProtectVirtualMemory,	19_2_00C39B4C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C316BE NtSetInformationThread,	19_2_00C316BE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C39E56 NtProtectVirtualMemory,	19_2_00C39E56
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C30A7A NtSetInformationThread,	19_2_00C30A7A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C3A824 NtQueryInformationProcess,	19_2_00C3A824
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C30629 NtSetInformationThread,	19_2_00C30629
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C30631 NtSetInformationThread,	19_2_00C30631
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C311F0 NtSetInformationThread,	19_2_00C311F0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C3A30D NtQueryInformationProcess,	19_2_00C3A30D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C39F12 NtQueryInformationProcess,	19_2_00C39F12
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C31719 NtSetInformationThread,	19_2_00C31719

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File created: C:\Windows\SysWOW64\clientsvr.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F005E5	13_2_00F005E5
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE1E1E	13_2_1FEE1E1E
Source: C:\ProgramData\782401\anibtcent.exe.exe	Code function: 16_2_050F01B7	16_2_050F01B7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C305E5	19_2_00C305E5
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 21_2_00C801B7	21_2_00C801B7

Source: New Inquiry 903838737777721102029393003938.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: demisphereklediskene.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24036753540.0000000000413000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameStrenger.exe vs New Inquiry 903838737777721102029393003938.exe
Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24037858669.00000000005E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs New Inquiry 903838737777721102029393003938.exe
Source: New Inquiry 903838737777721102029393003938.exe	Binary or memory string: OriginalFilenameStrenger.exe vs New Inquiry 903838737777721102029393003938.exe

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Section loaded: vb6zz.dll	Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@16/8@10/2

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_204F2A92 AdjustTokenPrivileges,		13_2_204F2A92
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_204F2A5B AdjustTokenPrivileges,		13_2_204F2A5B

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File created: C:\Users\user\Hustankesgy3

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1500:120:WilError_02
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1584:120:WilError_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4084:120:WilError_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_02
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\7433cdb324b04dd5e3c3db213381216c7c539baa

Source: New Inquiry 903838737777721102029393003938.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9fbf7494605b6eb9632b0c9bfc1683d9\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9fbf7494605b6eb9632b0c9bfc1683d9\mscorlib.ni.dll	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9fbf7494605b6eb9632b0c9bfc1683d9\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9fbf7494605b6eb9632b0c9bfc1683d9\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: New Inquiry 903838737777721102029393003938.exe	Virustotal: Detection: 20%
Source: New Inquiry 903838737777721102029393003938.exe	ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\782401\anibtcent.exe.exe 'C:\ProgramData\782401\anibtcent.exe.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Hustankesgy3\demisphereklediskene.exe 'C:\Users\user\Hustankesgy3\demisphereklediskene.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Hustankesgy3\demisphereklediskene.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Hustankesgy3\demisphereklediskene.exe 'C:\Users\user\Hustankesgy3\demisphereklediskene.exe'
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'	Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\ProgramData\782401\anibtcent.exe.exe 'C:\ProgramData\782401\anibtcent.exe.exe'	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Hustankesgy3\demisphereklediskene.exe'	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9554_none_d08d6fa2442aa556\MSVCR80.dll

Jump to behavior

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 0000000D.00000002.24325004854.000000001FFF5000.00000004.00000001.sdmp, anibtcent.exe.exe, anibtcent.exe.exe.13.dr
Source:	Binary string: mscorrc.pdb source: RegAsm.exe, 0000000D.00000002.24324313659.000000001FF60000.00000002.00000001.sdmp, RegAsm.exe, 00000013.00000002.24283755110.000000001FDF0000.00000002.00000001.sdmp

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1440, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4328, type: MEMORY

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_0040E750 pushad ; ret	3_2_0040E7DF
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_00406A5A push ecx; retf	3_2_00406A5B
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_0040E77E pushad ; ret	3_2_0040E7DF
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_00406418 push ecx; retf	3_2_0040642F
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_00409FC6 push ecx; ret	3_2_00409FC7
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_0040A6C9 push ebx; retf	3_2_0040A6D3
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_00409FE7 push ebx; retf	3_2_00409FF3
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_0040A6EC push ebx; retf	3_2_0040A703
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_00409F88 push ebx; retf	3_2_00409F8F
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_0040A68E push ebx; retf	3_2_0040A703
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_00409FAC push ebx; retf	3_2_00409FBF
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_0040A0B0 push ecx; ret	3_2_0040A0C3
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_004063B8 push ecx; retf	3_2_0040642F
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_00409EBE push ebp; retf	3_2_00409EF3
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_02240A3F push cs; retf	3_2_02240A91
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Code function: 3_2_02243604 push edi; ret	3_2_0224360E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1DB256F5 push edx; iretd	13_2_1DB256F6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1DB22E29 push ds; iretd	13_2_1DB23206
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1DB23662 push ecx; ret	13_2_1DB2366D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE39A1 push ebp; retf	13_2_1FEE39A2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE3D9B push esi; retf	13_2_1FEE3DA2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE3D98 push esi; retf	13_2_1FEE3D9A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE3921 push esp; retf	13_2_1FEE3922
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE3EEB push edi; retf	13_2_1FEE3EF2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE3EE8 push edi; retf	13_2_1FEE3EEA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE0AD8 push F01DCB26h; retf	13_2_1FEE0ADD
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE3843 push esp; retf	13_2_1FEE384A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE3841 push esp; retf	13_2_1FEE3842
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_1FEE0006 push ss; retf	13_2_1FEE002E
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Code function: 18_2_021C0A3F push cs; retf	18_2_021C0A91
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 21_2_0241000C pushfd ; retf	21_2_02410053

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File created: C:\ProgramData\782401\anibtcent.exe.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File created: C:\Windows\SysWOW64\clientsvr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File created: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File created: C:\ProgramData\782401\anibtcent.exe.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File created: C:\Windows\SysWOW64\clientsvr.exe

Jump to dropped file

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HWKP

Jump to behavior

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit

Jump to behavior

Creates multiple autostart registry keys

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce monotonousnesses			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HWKP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce monotonousnesses	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce monotonousnesses	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce monotonousnesses	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce monotonousnesses	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HWKP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HWKP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HWKP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HWKP	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F08F5A		13_2_00F08F5A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C38F5A		19_2_00C38F5A

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24037990478.00000000005FA000.00000004.00000020.sdmp	Binary or memory string: _ROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: RegAsm.exe, 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, RegAsm.exe, 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe

RDTSC instruction interceptor: First address: 000000000224468B second address: 000000000224468B instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a call 00007F8484416248h 0x0000000f lfence 0x00000012 mov edx, dword ptr [7FFE0014h] 0x00000018 lfence 0x0000001b ret 0x0000001c sub edx, esi 0x0000001e ret 0x0000001f cmp ax, cx 0x00000022 test edx, eax 0x00000024 pop ecx 0x00000025 add edi, edx 0x00000027 dec ecx 0x00000028 cmp cx, dx 0x0000002b cmp ecx, 00000000h 0x0000002e jne 00007F8484416228h 0x00000030 push ecx 0x00000031 cmp ax, ax 0x00000034 call 00007F848441626Bh 0x00000039 call 00007F848441625Ah 0x0000003e lfence 0x00000041 mov edx, dword ptr [7FFE0014h] 0x00000047 lfence 0x0000004a ret 0x0000004b mov esi, edx 0x0000004d pushad 0x0000004e rdtsc

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Code function: 13_2_00F016BE rdtsc

13_2_00F016BE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Window / User API: threadDelayed 1395

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 6984	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 6168	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 1564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 1528	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\782401\anibtcent.exe.exe TID: 2812	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 6900	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 5616	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24064512847.0000000004909000.00000004.00000001.sdmp, RegAsm.exe, 0000000D.00000002.24305216551.0000000002B39000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000012.00000002.24253821451.00000000046A9000.00000004.00000001.sdmp, RegAsm.exe, 00000013.00000002.24267119140.0000000002959000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24064512847.0000000004909000.00000004.00000001.sdmp, RegAsm.exe, 0000000D.00000002.24305216551.0000000002B39000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000012.00000002.24253821451.00000000046A9000.00000004.00000001.sdmp, RegAsm.exe, 00000013.00000002.24267119140.0000000002959000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: vmicshutdown
Source: RegAsm.exe, 0000000D.00000002.24321865954.000000001DD3A000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24064512847.0000000004909000.00000004.00000001.sdmp, RegAsm.exe, 0000000D.00000002.24305216551.0000000002B39000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000012.00000002.24253821451.00000000046A9000.00000004.00000001.sdmp, RegAsm.exe, 00000013.00000002.24267119140.0000000002959000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24064512847.0000000004909000.00000004.00000001.sdmp, RegAsm.exe, 0000000D.00000002.24305216551.0000000002B39000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000012.00000002.24253821451.00000000046A9000.00000004.00000001.sdmp, RegAsm.exe, 00000013.00000002.24267119140.0000000002959000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24064512847.0000000004909000.00000004.00000001.sdmp, RegAsm.exe, 0000000D.00000002.24305216551.0000000002B39000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000012.00000002.24253821451.00000000046A9000.00000004.00000001.sdmp, RegAsm.exe, 00000013.00000002.24267119140.0000000002959000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: vmicvss
Source: RegAsm.exe, 0000000D.00000002.24301433100.00000000010A5000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265299276.0000000000E52000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW&
Source: RegAsm.exe, 0000000D.00000002.24300776016.000000000104B000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24264785299.0000000000DDB000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000013.00000002.24265233992.0000000000E4A000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWen-USn
Source: RegAsm.exe, 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, RegAsm.exe, 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24064512847.0000000004909000.00000004.00000001.sdmp, RegAsm.exe, 0000000D.00000002.24305216551.0000000002B39000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000012.00000002.24253821451.00000000046A9000.00000004.00000001.sdmp, RegAsm.exe, 00000013.00000002.24267119140.0000000002959000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: RegAsm.exe, 0000000D.00000002.24328207020.0000000021190000.00000002.00000001.sdmp	Binary or memory string: Insufficient privileges. Only administrators or users that are members of the Hyper-V Administrators user group are permitted to access virtual machines or containers. To add yourself to the Hyper-V Administrators user group, please see https://aka.ms/hcsadmin for more information.
Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24064512847.0000000004909000.00000004.00000001.sdmp, RegAsm.exe, 0000000D.00000002.24305216551.0000000002B39000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000012.00000002.24253821451.00000000046A9000.00000004.00000001.sdmp, RegAsm.exe, 00000013.00000002.24267119140.0000000002959000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24064512847.0000000004909000.00000004.00000001.sdmp, RegAsm.exe, 0000000D.00000002.24305216551.0000000002B39000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000012.00000002.24253821451.00000000046A9000.00000004.00000001.sdmp, RegAsm.exe, 00000013.00000002.24267119140.0000000002959000.00000004.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: New Inquiry 903838737777721102029393003938.exe, 00000003.00000002.24037990478.00000000005FA000.00000004.00000020.sdmp	Binary or memory string: _rogram Files\Qemu-ga\qemu-ga.exe
Source: demisphereklediskene.exe, 00000017.00000002.24332844184.0000000004B89000.00000004.00000001.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Code function: 13_2_00F09EF3 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0

13_2_00F09EF3

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Code function: 13_2_00F016BE rdtsc

13_2_00F016BE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F02A91 mov eax, dword ptr fs:[00000030h]	13_2_00F02A91
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F0949D mov eax, dword ptr fs:[00000030h]	13_2_00F0949D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F01E6C mov eax, dword ptr fs:[00000030h]	13_2_00F01E6C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F081B7 mov eax, dword ptr fs:[00000030h]	13_2_00F081B7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F08799 mov eax, dword ptr fs:[00000030h]	13_2_00F08799
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 13_2_00F04109 mov eax, dword ptr fs:[00000030h]	13_2_00F04109
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C32A91 mov eax, dword ptr fs:[00000030h]	19_2_00C32A91
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C3949D mov eax, dword ptr fs:[00000030h]	19_2_00C3949D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C31E6C mov eax, dword ptr fs:[00000030h]	19_2_00C31E6C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C38799 mov eax, dword ptr fs:[00000030h]	19_2_00C38799
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C381B7 mov eax, dword ptr fs:[00000030h]	19_2_00C381B7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_00C34109 mov eax, dword ptr fs:[00000030h]	19_2_00C34109

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: F00000			Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: C30000			Jump to behavior

Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'	Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\ProgramData\782401\anibtcent.exe.exe 'C:\ProgramData\782401\anibtcent.exe.exe'	Jump to behavior
Source: C:\Users\user\Hustankesgy3\demisphereklediskene.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Hustankesgy3\demisphereklediskene.exe'	Jump to behavior

Source: RegAsm.exe, 0000000D.00000002.24304442627.00000000016E1000.00000002.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24301285647.0000000000D21000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 0000000D.00000002.24304442627.00000000016E1000.00000002.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24301285647.0000000000D21000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 0000000D.00000002.24304442627.00000000016E1000.00000002.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24301285647.0000000000D21000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: RegAsm.exe, 0000000D.00000002.24304442627.00000000016E1000.00000002.00000001.sdmp, demisphereklediskene.exe, 00000017.00000002.24301285647.0000000000D21000.00000002.00000001.sdmp	Binary or memory string: 1Program Manager

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected LuminosityLink RAT

Show sources

Source: Yara match	File source: 0000000D.00000002.24321865954.000000001DD3A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1440, type: MEMORY

Remote Access Functionality:

Yara detected LuminosityLink RAT

Show sources

Source: Yara match	File source: 0000000D.00000002.24321865954.000000001DD3A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1440, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Registry Run Keys / Startup Folder31	Access Token Manipulation1	Masquerading21	Input Capture11	Security Software Discovery821	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	DLL Side-Loading1	Process Injection112	Virtualization/Sandbox Evasion33	LSASS Memory	Virtualization/Sandbox Evasion33	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder31	Disable or Modify Tools1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	DLL Side-Loading1	Access Token Manipulation1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information1	DCSync	System Information Discovery22	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	DLL Side-Loading1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
New Inquiry 903838737777721102029393003938.exe	21%	Virustotal		Browse
New Inquiry 903838737777721102029393003938.exe	19%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\782401\anibtcent.exe.exe	0%	Virustotal	Browse
C:\ProgramData\782401\anibtcent.exe.exe	0%	Metadefender	Browse
C:\ProgramData\782401\anibtcent.exe.exe	0%	ReversingLabs
C:\Users\user\Hustankesgy3\demisphereklediskene.exe	21%	Virustotal	Browse
C:\Users\user\Hustankesgy3\demisphereklediskene.exe	19%	ReversingLabs
C:\Windows\SysWOW64\clientsvr.exe	0%	Virustotal	Browse
C:\Windows\SysWOW64\clientsvr.exe	0%	Metadefender	Browse
C:\Windows\SysWOW64\clientsvr.exe	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
nobawi.dvrdns.org	194.5.97.46	true	false	unknown
onedrive.live.com	unknown	unknown	false	high
eaup2w.sn.files.1drv.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://eaup2w.sn.files.1drv.com/	RegAsm.exe, 0000000D.00000002.24301095324.000000000107D000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265379647.0000000000E64000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265110684.0000000000E2E000.00000004.00000020.sdmp	false	high
https://onedrive.live.com/l	RegAsm.exe, 00000013.00000002.24264785299.0000000000DDB000.00000004.00000020.sdmp	false	high
https://aka.ms/hcsadmin	RegAsm.exe, 0000000D.00000002.24328207020.0000000021190000.00000002.00000001.sdmp	false	high
https://onedrive.live.com/	RegAsm.exe, 0000000D.00000002.24300776016.000000000104B000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24264785299.0000000000DDB000.00000004.00000020.sdmp	false	high
https://eaup2w.sn.files.1drv.com/y4m4bqAkwHQUJx1iHbF6prKSSCddXNt-56Mg951zMrckoiAx-x88t2pks0UEJqWB7st	RegAsm.exe, 00000013.00000002.24265379647.0000000000E64000.00000004.00000020.sdmp, RegAsm.exe, 00000013.00000002.24265299276.0000000000E52000.00000004.00000020.sdmp	false	high
https://eaup2w.sn.files.1drv.com/y4mcRoU26afjmMcM96C_CG1xmFAJaGVWXqZWLE8oSmKi-bsn2pOmBTUtvaCnggDIr1k	RegAsm.exe, 0000000D.00000002.24301433100.00000000010A5000.00000004.00000020.sdmp, RegAsm.exe, 0000000D.00000002.24301548535.00000000010C1000.00000004.00000020.sdmp	false	high
https://onedrive.live.com/download?cid=249E8FCE0A15C968&resid=249E8FCE0A15C968%211276&authkey=ADoYXV	RegAsm.exe, 00000013.00000002.24265110684.0000000000E2E000.00000004.00000020.sdmp	false	high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	Flag	ASN	ASN Name	Malicious
194.5.97.46	Netherlands		208476	DANILENKODE	false

Private

IP
192.168.0.2

General Information

Joe Sandbox Version:	30.0.0 Red Diamond
Analysis ID:	112557
Start date:	17.09.2020
Start time:	09:13:31
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 8m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	New Inquiry 903838737777721102029393003938.exe
Cookbook file name:	default.jbs
Analysis system description:	W10 x64 1809 Native physical Machine for testing VM-aware malware (Office 2016, Internet Explorer 11, Java 8u231, Adobe Reader DC 19)
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@16/8@10/2
EGA Information:	Successful, ratio: 71.4%
HDC Information:	Successful, ratio: 53.8% (good quality ratio 19.1%) Quality average: 24.7% Quality standard deviation: 36.3%
HCA Information:	Successful, ratio: 96% Number of executed functions: 265 Number of non-executed functions: 19
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, LocalBridge.exe, backgroundTaskHost.exe, WmiPrvSE.exe Excluded IPs from analysis (whitelisted): 205.185.216.10, 205.185.216.42, 40.67.251.132, 23.55.161.163, 23.55.161.152, 13.107.42.13, 13.107.42.12, 40.90.22.186, 40.90.22.191, 40.90.22.183, 40.90.22.192, 40.90.22.189, 40.90.22.184, 40.90.22.188, 40.90.22.187, 51.143.111.7 Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, client.wns.windows.com, odc-web-geo.onedrive.akadns.net, odc-sn-files-geo.onedrive.akadns.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, emea2.notify.windows.com.akadns.net, login.msa.msidentity.com, l-0004.l-msedge.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, umwatsonrouting.trafficmanager.net, db5p.wns.notify.windows.com.akadns.net, odc-sn-files-brs.onedrive.akadns.net, l-0003.l-msedge.net, login.live.com, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, odc-sn-files.onedrive.akadns.net.l-0003.dc-msedge.net.l-0003.l-msedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, au-bg-shim.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net Execution Graph export aborted for target demisphereklediskene.exe, PID 1812 because there are no executed function Execution Graph export aborted for target demisphereklediskene.exe, PID 2140 because there are no executed function Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Signature Similarity

Sample Distance (10 = nearest)

10 9 8 7 6 5 4 3 2 1

Similar Samples

Samplename	Analysis ID	SHA256	Similarity

Simulations

Behavior and APIs

Time	Type	Description
09:17:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce monotonousnesses C:\Users\user\Hustankesgy3\demisphereklediskene.exe
09:17:34	API Interceptor	4x Sleep call for process: RegAsm.exe modified
09:17:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce HWKP "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
09:17:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce monotonousnesses C:\Users\user\Hustankesgy3\demisphereklediskene.exe
09:17:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce HWKP "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DANILENKODE	Notificare de expediere a serviciului de curierat FAN.exe	Get hash	malicious	Browse	194.5.98.4
	Stub.exe	Get hash	malicious	Browse	194.5.97.76
	CEsezvn5.exe	Get hash	malicious	Browse	194.5.97.98
	order_doc#79922021.pdf.exe	Get hash	malicious	Browse	194.5.97.76
	Specifications Drawing Sketch Details-img.exe	Get hash	malicious	Browse	194.5.98.23
	5wJh9Cykwx.exe	Get hash	malicious	Browse	194.5.98.68
	u51x5QFXXu.exe	Get hash	malicious	Browse	194.5.97.55
	2020.09.01.SS.08.39_Export.pdf.exe	Get hash	malicious	Browse	194.5.97.23
	jBMJ2TUHK4.exe	Get hash	malicious	Browse	194.5.98.95
	m5ug7w1BclUkH8g.exe	Get hash	malicious	Browse	194.5.98.225
	KR-310820.EXE	Get hash	malicious	Browse	194.5.97.15
	QgpyVFbQ7w.exe	Get hash	malicious	Browse	194.5.98.95
	Pos withdrawal reduced to 0.5%.exe	Get hash	malicious	Browse	194.5.97.16
	U5AxjHFcx0zbmCE.exe	Get hash	malicious	Browse	194.5.97.93
	SecuriteInfo.com.ArtemisF2D018C0AB1C.exe	Get hash	malicious	Browse	194.5.98.95
	SecuriteInfo.com.Trojan.Inject3.53454.32340.exe	Get hash	malicious	Browse	194.5.98.95
	RFQ_282008.exe	Get hash	malicious	Browse	194.5.97.15
	RFQ_HartBrothersLimited7685745646490SD.xlsm	Get hash	malicious	Browse	194.5.98.249
	PO-250820.exe	Get hash	malicious	Browse	194.5.97.15
	PO-260820.exe	Get hash	malicious	Browse	194.5.97.15

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\7433cdb324b04dd5e3c3db213381216c7c539baa Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	ASCII text, with no line terminators
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
MD5:	332825AF0394E728F74AFD416AF782DE
SHA1:	2E1F37FCDF50AD24B9CF565340B4192031B4DA4F
SHA-256:	7E8E21F8DAAE7B8A0C1FC6AB294A32226B12024405C6B841B402FC1E21A358E1
SHA-512:	D8D386CA3208A7F9AF56C4DDC717D14D5796DB9A265C75ACBA3CA5139332891172A68334B050C3C358B4CAE7165FDF14C1798FE7ABE2DC23AE9054060910D060
Malicious:	false
Reputation:	low
Preview:	782501

C:\ProgramData\782401\anibtcent.exe.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Size (bytes):	53248
Entropy (8bit):	4.489035167606714
Encrypted:	false
MD5:	6AFAE79556E125202DCF1D3FE74A3638
SHA1:	1F0CD73E2A999298F4AACC9F4F4435D0E0C5841E
SHA-256:	3A2671887FA27F16624D0E560985DE57C421B686AF6546ECF799F96B301E4DDD
SHA-512:	E418A6A5EE03253D9CE5EF5A414AF1F89940FA1BD47DA47110EA8CFBA037669DD052AC5E2B8AE45938C09B25B071ECC1307251059D77B494C359E0C8924AF081
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:dj[..................... .......... ........@.. ..............................H$....@.....................................O................................... ................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
MD5:	B3AC9D09E3A47D5FD00C37E075A70ECB
SHA1:	AD14E6D0E07B00BD10D77A06D68841B20675680B
SHA-256:	7A23C6E7CCD8811ECDF038D3A89D5C7D68ED37324BAE2D4954125D9128FA9432
SHA-512:	09B609EE1061205AA45B3C954EFC6C1A03C8FD6B3011FF88CF2C060E19B1D7FD51EE0CB9D02A39310125F3A66AA0146261BDEE3D804F472034DF711BC942E316
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\anibtcent.exe.exe.log Download File
Process:	C:\ProgramData\782401\anibtcent.exe.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
MD5:	B3AC9D09E3A47D5FD00C37E075A70ECB
SHA1:	AD14E6D0E07B00BD10D77A06D68841B20675680B
SHA-256:	7A23C6E7CCD8811ECDF038D3A89D5C7D68ED37324BAE2D4954125D9128FA9432
SHA-512:	09B609EE1061205AA45B3C954EFC6C1A03C8FD6B3011FF88CF2C060E19B1D7FD51EE0CB9D02A39310125F3A66AA0146261BDEE3D804F472034DF711BC942E316
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..

C:\Users\user\Hustankesgy3\demisphereklediskene.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	77824
Entropy (8bit):	4.268810997769698
Encrypted:	false
MD5:	01A54F73856CFB74A3BBBA47BCEC227B
SHA1:	ED2ED885DCD7BE832CDAE5C189BD7DB78CA9EAA2
SHA-256:	759C87F02D5850EE317454DC8242067D042A320F653946C9162B645C0AE68BA6
SHA-512:	C14F28C00A7344F039BFC30D658E3E5C1D3DB08EA7AC31F4574587F8FE17492DD2E0D73374CDEC51A90E79D5569F21645BC4E59EBE5A1362CC5E04A8CAAD8516
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 21%, Browse Antivirus: ReversingLabs, Detection: 19%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i......................*..............Rich....................PE..L......X.....................0....................@..........................@..............................................t...(....0..$...................................................................0... ....................................text...d........................... ..`.data...............................@....rsrc...$....0....... ..............@..@...I............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\clientsvr.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Size (bytes):	53248
Entropy (8bit):	4.489035167606714
Encrypted:	false
MD5:	6AFAE79556E125202DCF1D3FE74A3638
SHA1:	1F0CD73E2A999298F4AACC9F4F4435D0E0C5841E
SHA-256:	3A2671887FA27F16624D0E560985DE57C421B686AF6546ECF799F96B301E4DDD
SHA-512:	E418A6A5EE03253D9CE5EF5A414AF1F89940FA1BD47DA47110EA8CFBA037669DD052AC5E2B8AE45938C09B25B071ECC1307251059D77B494C359E0C8924AF081
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:dj[..................... .......... ........@.. ..............................H$....@.....................................O................................... ................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	1010
Entropy (8bit):	4.301794875780381
Encrypted:	false
MD5:	89358C11D21070BAC4F92BFA5F9034FF
SHA1:	8D94E1B07DE5B7BC0A819709478FBC62F627296F
SHA-256:	B5C37651006A8E8BA3D665795B374F5047796B0EFB4B664134654CDF869EBBF0
SHA-512:	5D519C044F7B1781D78632B7857B87DD4ADE4AD39868A79D50C2055D917D43898540A05CF5DD4A65AC68E71F8D7751D24353153D5289BBE60118F7FC31AC8FA1
Malicious:	false
Reputation:	low
Preview:	Microsoft (R) .NET Framework Assembly Registration Utility 2.0.50727.9031..Copyright (C) Microsoft Corporation 1998-2004. All rights reserved.....Syntax: RegAsm AssemblyName [Options]..Options:.. /unregister Unregister types.. /tlb[:FileName] Export the assembly to the specified type library.. and register it.. /regfile[:FileName] Generate a reg file with the specified name.. instead of registering the types. This option.. cannot be used with the /u or /tlb options.. /codebase Set the code base in the registry.. /registered Only refer to already registered type libraries.. /asmpath:Directory Look for assembly references here.. /nologo Prevents RegAsm from displaying logo.. /silent Silent mode. Prevents displaying of success messages.. /verbose Displays extra information.. /? or /help Display this usage

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.268810997769698
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	New Inquiry 903838737777721102029393003938.exe
File size:	77824
MD5:	01a54f73856cfb74a3bbba47bcec227b
SHA1:	ed2ed885dcd7be832cdae5c189bd7db78ca9eaa2
SHA256:	759c87f02d5850ee317454dc8242067d042a320f653946c9162b645c0ae68ba6
SHA512:	c14f28c00a7344f039bfc30d658e3e5c1d3db08ea7ac31f4574587f8fe17492dd2e0d73374cdec51a90e79d5569f21645bc4e59ebe5a1362cc5e04a8caad8516
SSDEEP:	768:tidhxH/lEJLqTyouZbjbKel+SA2sJ80Mos:tchVWJLkyoKbR+SsJ817
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L......X.....................0....................@........

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401198
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x58E2F1AE [Tue Apr 4 01:06:54 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	68aad53882cd0699d0056766eec5d383

Entrypoint Preview

Instruction
push 0040152Ch
call 00007F8484E1D895h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], cl
into
jbe 00007F8484E1D8EBh
ret
cmp al, 59h
dec eax
mov ebp, F52EDF18h
mov edi, 0000DE0Dh
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push edi
push 6E657469h
jnc 00007F8484E1D912h
popad
je 00007F8484E1D918h
imul esi, dword ptr [edi+33h], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
add al, 7Fh
mov al, 11h
popfd
xchg eax, ebp
sbb eax, C8A14621h
mov al, 14h
pushad

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10874	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13000	0x924	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x94	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfb64	0x10000	False	0.325119018555	data	4.5495521333	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x11000	0x13b0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x13000	0x924	0x1000	False	0.173583984375	data	2.00822109273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x137f4	0x130	data
RT_ICON	0x1350c	0x2e8	data
RT_ICON	0x133e4	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x133b4	0x30	data
RT_VERSION	0x13150	0x264	data	French	France

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, _adj_fdiv_m64, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x040c 0x04b0
InternalName	Strenger
FileVersion	1.00
CompanyName	BaconSplitter
Comments	BaconSplitter
ProductName	Whitenspagettiw3
ProductVersion	1.00
OriginalFilename	Strenger.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
French	France

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/17/20-09:17:35.647111	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	62644	1.1.1.1	192.168.0.80
09/17/20-09:17:45.373911	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	57998	1.1.1.1	192.168.0.80
09/17/20-09:17:49.824955	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	62566	1.1.1.1	192.168.0.80

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 17, 2020 09:17:35.654803991 CEST	49780	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:38.653953075 CEST	49780	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:44.667840958 CEST	49780	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:45.192441940 CEST	3021	49780	194.5.97.46	192.168.0.80
Sep 17, 2020 09:17:45.375614882 CEST	49781	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:48.385880947 CEST	49781	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:48.396872044 CEST	3021	49781	194.5.97.46	192.168.0.80
Sep 17, 2020 09:17:48.901237965 CEST	49781	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:49.494385004 CEST	3021	49781	194.5.97.46	192.168.0.80
Sep 17, 2020 09:17:49.826248884 CEST	49784	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:50.117470980 CEST	3021	49784	194.5.97.46	192.168.0.80
Sep 17, 2020 09:17:50.619613886 CEST	49784	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:50.794392109 CEST	3021	49784	194.5.97.46	192.168.0.80
Sep 17, 2020 09:17:51.306924105 CEST	49784	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:54.958060980 CEST	3021	49784	194.5.97.46	192.168.0.80
Sep 17, 2020 09:17:55.088757038 CEST	49785	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:17:55.265065908 CEST	3021	49785	194.5.97.46	192.168.0.80
Sep 17, 2020 09:17:55.774595022 CEST	49785	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:18:01.788693905 CEST	49785	3021	192.168.0.80	194.5.97.46
Sep 17, 2020 09:18:02.425591946 CEST	3021	49785	194.5.97.46	192.168.0.80

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 17, 2020 09:16:15.561140060 CEST	49451	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:16:15.565572977 CEST	53	49451	1.1.1.1	192.168.0.80
Sep 17, 2020 09:16:21.787764072 CEST	55506	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:16:21.791841984 CEST	53	55506	1.1.1.1	192.168.0.80
Sep 17, 2020 09:16:31.149914026 CEST	63845	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:16:31.169645071 CEST	53	63845	1.1.1.1	192.168.0.80
Sep 17, 2020 09:16:34.521147966 CEST	56004	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:16:34.532773018 CEST	53	56004	1.1.1.1	192.168.0.80
Sep 17, 2020 09:17:29.691212893 CEST	57708	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:17:29.695420980 CEST	53	57708	1.1.1.1	192.168.0.80
Sep 17, 2020 09:17:30.439835072 CEST	56079	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:17:30.530215025 CEST	53	56079	1.1.1.1	192.168.0.80
Sep 17, 2020 09:17:35.487384081 CEST	62644	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:17:35.647110939 CEST	53	62644	1.1.1.1	192.168.0.80
Sep 17, 2020 09:17:45.353795052 CEST	57998	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:17:45.373910904 CEST	53	57998	1.1.1.1	192.168.0.80
Sep 17, 2020 09:17:48.758219957 CEST	49721	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:17:48.767934084 CEST	53	49721	1.1.1.1	192.168.0.80
Sep 17, 2020 09:17:49.451086998 CEST	53676	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:17:49.516685009 CEST	53	53676	1.1.1.1	192.168.0.80
Sep 17, 2020 09:17:49.611742020 CEST	62566	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:17:49.824954987 CEST	53	62566	1.1.1.1	192.168.0.80
Sep 17, 2020 09:17:55.077337027 CEST	52075	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:17:55.087174892 CEST	53	52075	1.1.1.1	192.168.0.80
Sep 17, 2020 09:18:01.974023104 CEST	51394	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:18:01.993537903 CEST	53	51394	1.1.1.1	192.168.0.80
Sep 17, 2020 09:18:02.650759935 CEST	56038	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:18:02.655469894 CEST	53	56038	1.1.1.1	192.168.0.80
Sep 17, 2020 09:18:03.229505062 CEST	62469	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:18:03.233412981 CEST	53	62469	1.1.1.1	192.168.0.80
Sep 17, 2020 09:18:03.276026011 CEST	59275	53	192.168.0.80	1.1.1.1
Sep 17, 2020 09:18:03.287719965 CEST	53	59275	1.1.1.1	192.168.0.80

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 17, 2020 09:17:29.691212893 CEST	192.168.0.80	1.1.1.1	0x196b	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:30.439835072 CEST	192.168.0.80	1.1.1.1	0x5ee6	Standard query (0)	eaup2w.sn.files.1drv.com	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:35.487384081 CEST	192.168.0.80	1.1.1.1	0x56aa	Standard query (0)	nobawi.dvrdns.org	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:45.353795052 CEST	192.168.0.80	1.1.1.1	0x4529	Standard query (0)	nobawi.dvrdns.org	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:48.758219957 CEST	192.168.0.80	1.1.1.1	0x4adb	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:49.451086998 CEST	192.168.0.80	1.1.1.1	0x83c6	Standard query (0)	eaup2w.sn.files.1drv.com	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:49.611742020 CEST	192.168.0.80	1.1.1.1	0xfc10	Standard query (0)	nobawi.dvrdns.org	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:55.077337027 CEST	192.168.0.80	1.1.1.1	0x9167	Standard query (0)	nobawi.dvrdns.org	A (IP address)	IN (0x0001)
Sep 17, 2020 09:18:02.650759935 CEST	192.168.0.80	1.1.1.1	0x4bb2	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Sep 17, 2020 09:18:03.276026011 CEST	192.168.0.80	1.1.1.1	0x73ea	Standard query (0)	eaup2w.sn.files.1drv.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 17, 2020 09:17:29.695420980 CEST	1.1.1.1	192.168.0.80	0x196b	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 17, 2020 09:17:30.530215025 CEST	1.1.1.1	192.168.0.80	0x5ee6	No error (0)	eaup2w.sn.files.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 17, 2020 09:17:35.647110939 CEST	1.1.1.1	192.168.0.80	0x56aa	No error (0)	nobawi.dvrdns.org		194.5.97.46	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:45.373910904 CEST	1.1.1.1	192.168.0.80	0x4529	No error (0)	nobawi.dvrdns.org		194.5.97.46	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:48.767934084 CEST	1.1.1.1	192.168.0.80	0x4adb	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 17, 2020 09:17:49.516685009 CEST	1.1.1.1	192.168.0.80	0x83c6	No error (0)	eaup2w.sn.files.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 17, 2020 09:17:49.824954987 CEST	1.1.1.1	192.168.0.80	0xfc10	No error (0)	nobawi.dvrdns.org		194.5.97.46	A (IP address)	IN (0x0001)
Sep 17, 2020 09:17:55.087174892 CEST	1.1.1.1	192.168.0.80	0x9167	No error (0)	nobawi.dvrdns.org		194.5.97.46	A (IP address)	IN (0x0001)
Sep 17, 2020 09:18:02.655469894 CEST	1.1.1.1	192.168.0.80	0x4bb2	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 17, 2020 09:18:03.287719965 CEST	1.1.1.1	192.168.0.80	0x73ea	No error (0)	eaup2w.sn.files.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: New Inquiry 903838737777721102029393003938.exe PID: 6652 Parent PID: 3968

General

Start time:	09:15:53
Start date:	17/09/2020
Path:	C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'
Imagebase:	0x400000
File size:	77824 bytes
MD5 hash:	01A54F73856CFB74A3BBBA47BCEC227B
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 1576 Parent PID: 6652

General

Start time:	09:17:25
Start date:	17/09/2020
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'
Imagebase:	0xb0000
File size:	53248 bytes
MD5 hash:	6AFAE79556E125202DCF1D3FE74A3638
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 1440 Parent PID: 6652

General

Start time:	09:17:25
Start date:	17/09/2020
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\New Inquiry 903838737777721102029393003938.exe'
Imagebase:	0xae0000
File size:	53248 bytes
MD5 hash:	6AFAE79556E125202DCF1D3FE74A3638
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_LuminosityLink, Description: Yara detected LuminosityLink RAT, Source: 0000000D.00000002.24321865954.000000001DD3A000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 1584 Parent PID: 1440

General

Start time:	09:17:26
Start date:	17/09/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b6340000
File size:	822272 bytes
MD5 hash:	C221707E5CE93515AC87507E19181E2A
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: anibtcent.exe.exe PID: 4188 Parent PID: 1440

General

Start time:	09:17:34
Start date:	17/09/2020
Path:	C:\ProgramData\782401\anibtcent.exe.exe
Wow64 process (32bit):	true
Commandline:	'C:\ProgramData\782401\anibtcent.exe.exe'
Imagebase:	0x850000
File size:	53248 bytes
MD5 hash:	6AFAE79556E125202DCF1D3FE74A3638
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Virustotal, Browse Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 1500 Parent PID: 4188

General

Start time:	09:17:35
Start date:	17/09/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b6340000
File size:	822272 bytes
MD5 hash:	C221707E5CE93515AC87507E19181E2A
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: demisphereklediskene.exe PID: 1812 Parent PID: 4560

General

Start time:	09:17:39
Start date:	17/09/2020
Path:	C:\Users\user\Hustankesgy3\demisphereklediskene.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Hustankesgy3\demisphereklediskene.exe'
Imagebase:	0x400000
File size:	77824 bytes
MD5 hash:	01A54F73856CFB74A3BBBA47BCEC227B
Has administrator privileges:	false
Programmed in:	Visual Basic
Antivirus matches:	Detection: 21%, Virustotal, Browse Detection: 19%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 4328 Parent PID: 1812

General

Start time:	09:17:43
Start date:	17/09/2020
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Hustankesgy3\demisphereklediskene.exe'
Imagebase:	0x860000
File size:	53248 bytes
MD5 hash:	6AFAE79556E125202DCF1D3FE74A3638
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 4084 Parent PID: 4328

General

Start time:	09:17:43
Start date:	17/09/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b6340000
File size:	822272 bytes
MD5 hash:	C221707E5CE93515AC87507E19181E2A
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: RegAsm.exe PID: 2652 Parent PID: 4560

General

Start time:	09:17:47
Start date:	17/09/2020
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe'
Imagebase:	0x330000
File size:	53248 bytes
MD5 hash:	6AFAE79556E125202DCF1D3FE74A3638
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5952 Parent PID: 2652

General

Start time:	09:17:48
Start date:	17/09/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b6340000
File size:	822272 bytes
MD5 hash:	C221707E5CE93515AC87507E19181E2A
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: demisphereklediskene.exe PID: 2140 Parent PID: 4560

General

Start time:	09:17:55
Start date:	17/09/2020
Path:	C:\Users\user\Hustankesgy3\demisphereklediskene.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Hustankesgy3\demisphereklediskene.exe'
Imagebase:	0x400000
File size:	77824 bytes
MD5 hash:	01A54F73856CFB74A3BBBA47BCEC227B
Has administrator privileges:	false
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: New Inquiry 903838737777721102029393003938.exe PID: 6652 Parent PID: 3968 New Inquiry 903838737777721102029393003938.exeCOMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	8.7%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	5

Executed Functions

Function 004105E4, Relevance: 19.6, APIs: 13, Instructions: 123
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E004105E4(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v44;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr* _v72;
				signed int _v76;
				signed int _v88;
				intOrPtr* _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _t78;
				signed int _t83;
				signed int _t88;
				char* _t89;
				void* _t90;
				void* _t101;
				void* _t103;
				intOrPtr _t104;

				_t100 = __esi;
				_t99 = __edi;
				_t91 = __ebx;
				_t104 = _t103 - 0xc;
				 *[fs:0x0] = _t104;
				L004010C0();
				_v16 = _t104;
				_v12 = E00401098;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0x000000fe;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x50,  *[fs:0x0], 0x4010c6, _t101);
				if( *0x411594 != 0) {
					_v92 = 0x411594;
				} else {
					_push(0x411594);
					_push(0x402090);
					L00401174();
					_v92 = 0x411594;
				}
				_v64 =  *_v92;
				_t78 =  *((intOrPtr*)( *_v64 + 0x14))(_v64,  &_v44);
				asm("fclex");
				_v68 = _t78;
				if(_v68 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x402080);
					_push(_v64);
					_push(_v68);
					L0040116E();
					_v96 = _t78;
				}
				_v72 = _v44;
				_t83 =  *((intOrPtr*)( *_v72 + 0x60))(_v72,  &_v40);
				asm("fclex");
				_v76 = _t83;
				if(_v76 >= 0) {
					_v100 = _v100 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x4020a0);
					_push(_v72);
					_push(_v76);
					L0040116E();
					_v100 = _t83;
				}
				_v88 = _v40;
				_v40 = _v40 & 0x00000000;
				L0040117A();
				L00401168();
				_t88 =  *((intOrPtr*)( *_a4 + 0x288))(_a4,  &_v44);
				asm("fclex");
				_v64 = _t88;
				if(_v64 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x288);
					_push(0x401f54);
					_push(_a4);
					_push(_v64);
					L0040116E();
					_v104 = _t88;
				}
				_push(0);
				_push(0);
				_push(_v44);
				_t89 =  &_v60;
				_push(_t89);
				L0040115C();
				_push(_t89);
				L00401162();
				_v36 = _t89;
				L00401168();
				L00401156(); // executed
				_t90 = E004107AE(_t91,  &_v60, _t99, _t100); // executed
				_v8 = 0;
				_push(E0041078F);
				L00401150();
				L00401150();
				return _t90;
			}

0x004105e4
0x004105e4
0x004105e4
0x004105e7
0x004105f6
0x00410600
0x00410608
0x0041060b
0x00410618
0x00410620
0x0041062b
0x00410635
0x0041064f
0x00410637
0x00410637
0x0041063c
0x00410641
0x00410646
0x00410646
0x0041065b
0x0041066a
0x0041066d
0x0041066f
0x00410676
0x0041068f
0x00410678
0x00410678
0x0041067a
0x0041067f
0x00410682
0x00410685
0x0041068a
0x0041068a
0x00410696
0x004106a5
0x004106a8
0x004106aa
0x004106b1
0x004106ca
0x004106b3
0x004106b3
0x004106b5
0x004106ba
0x004106bd
0x004106c0
0x004106c5
0x004106c5
0x004106d1
0x004106d4
0x004106de
0x004106e6
0x004106f7
0x004106fd
0x004106ff
0x00410706
0x00410722
0x00410708
0x00410708
0x0041070d
0x00410712
0x00410715
0x00410718
0x0041071d
0x0041071d
0x00410726
0x00410728
0x0041072a
0x0041072d
0x00410730
0x00410731
0x00410739
0x0041073a
0x0041073f
0x00410745
0x0041074d
0x00410752
0x00410757
0x0041075e
0x00410781
0x00410789
0x0041078e

APIs

__vbaChkstk.MSVBVM60(?,004010C6), ref: 00410600
__vbaNew2.MSVBVM60(00402090,00411594,?,?,?,?,004010C6), ref: 00410641
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402080,00000014), ref: 00410685
__vbaHresultCheckObj.MSVBVM60(00000000,?,004020A0,00000060), ref: 004106C0
__vbaStrMove.MSVBVM60(00000000,?,004020A0,00000060), ref: 004106DE
__vbaFreeObj.MSVBVM60(00000000,?,004020A0,00000060), ref: 004106E6
__vbaHresultCheckObj.MSVBVM60(00000000,00401098,00401F54,00000288), ref: 00410718
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00410731
__vbaI4Var.MSVBVM60(00000000,?,?,?,004010C6), ref: 0041073A
__vbaFreeObj.MSVBVM60(00000000,?,?,?,004010C6), ref: 00410745
__vbaFreeVar.MSVBVM60(00000000,?,?,?,004010C6), ref: 0041074D
__vbaFreeStr.MSVBVM60(0041078F,00000000,?,?,?,004010C6), ref: 00410781
__vbaFreeStr.MSVBVM60(0041078F,00000000,?,?,?,004010C6), ref: 00410789

Memory Dump Source

Source File: 00000003.00000002.24036576698.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.24036522568.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.24036687091.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.24036753540.0000000000413000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_New Inquiry 903838737777721102029393003938.jbxd

Similarity

API ID: __vba$Free$CheckHresult$CallChkstkLateMoveNew2
String ID:
API String ID: 1245641248-0
Opcode ID: 9a465e81a76bde142842b4f258309277150979447a63d957fb85e618464083e3
Instruction ID: 872232f5f29706813e3bb7c0173e2787999fc991f4768f39e88a0e5453f75b58
Opcode Fuzzy Hash: 9a465e81a76bde142842b4f258309277150979447a63d957fb85e618464083e3
Instruction Fuzzy Hash: F651C275900208EFCB14EFA5C949BDDBBB5AF08704F10402AF205BB2A1D779A995DF58

Uniqueness

Uniqueness Score: 100.00%

Function 00401198, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			_entry_(signed int __eax, signed int __ebx, intOrPtr* __ecx, intOrPtr* __edx, intOrPtr* __edi, signed int __esi, intOrPtr* _a4, intOrPtr _a68, signed int _a110) {
				intOrPtr _v8;
				signed int _v28;
				void* _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr* _v72;
				signed int _v76;
				signed int _v88;
				signed int* _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				intOrPtr* _t232;
				intOrPtr* _t233;
				signed char _t234;
				signed char _t235;
				signed int _t236;
				signed int _t237;
				intOrPtr* _t238;
				intOrPtr* _t239;
				intOrPtr* _t240;
				intOrPtr* _t241;
				intOrPtr* _t242;
				void* _t243;
				intOrPtr* _t244;
				intOrPtr* _t245;
				signed int _t246;
				intOrPtr* _t247;
				intOrPtr* _t248;
				signed int _t249;
				signed char _t250;
				signed char _t252;
				intOrPtr* _t254;
				intOrPtr* _t255;
				signed char _t256;
				signed int _t257;
				intOrPtr* _t259;
				intOrPtr* _t260;
				intOrPtr* _t261;
				signed char _t263;
				intOrPtr* _t264;
				intOrPtr* _t265;
				void* _t267;
				signed char _t268;
				intOrPtr* _t270;
				intOrPtr* _t271;
				intOrPtr* _t272;
				signed int _t273;
				intOrPtr* _t276;
				intOrPtr* _t277;
				intOrPtr* _t278;
				intOrPtr* _t280;
				intOrPtr* _t281;
				intOrPtr* _t282;
				signed char _t284;
				signed char _t285;
				intOrPtr* _t286;
				intOrPtr* _t287;
				intOrPtr* _t288;
				intOrPtr* _t290;
				intOrPtr* _t291;
				void* _t292;
				void* _t293;
				intOrPtr* _t294;
				void* _t295;
				void* _t296;
				intOrPtr* _t297;
				intOrPtr* _t298;
				signed int _t313;
				signed int _t318;
				signed int _t323;
				char* _t324;
				void* _t325;
				intOrPtr* _t326;
				intOrPtr* _t327;
				intOrPtr* _t328;
				signed char _t329;
				signed char _t330;
				intOrPtr* _t333;
				intOrPtr* _t334;
				void* _t335;
				intOrPtr* _t337;
				signed int _t338;
				signed char _t340;
				signed int _t341;
				intOrPtr* _t342;
				signed char _t344;
				intOrPtr* _t345;
				intOrPtr* _t347;
				signed int _t351;
				void* _t354;
				signed int _t356;
				signed int _t358;
				signed char _t359;
				void* _t360;
				intOrPtr* _t361;
				void* _t362;
				intOrPtr* _t363;
				intOrPtr* _t364;
				intOrPtr* _t365;
				signed char _t366;
				signed char _t367;
				intOrPtr* _t368;
				intOrPtr* _t369;
				void* _t376;
				intOrPtr* _t377;
				signed int* _t379;
				signed int* _t385;
				signed int _t386;
				signed int _t387;
				void* _t389;
				void* _t391;
				signed int* _t392;
				void* _t393;
				void* _t394;
				intOrPtr _t395;
				void* _t398;
				intOrPtr _t399;

				_t386 = __esi;
				_t378 = __edx;
				_t361 = __ecx;
				_push("VB5!6&*"); // executed
				L00401192(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t232 = __eax - 1;
				 *_t232 =  *_t232 + _t232;
				 *_t232 =  *_t232 + _t232;
				 *_t232 =  *_t232 + _t232;
				 *__edi =  *__edi + __ecx;
				_t399 =  *__edi;
				asm("bswap esi");
				if(_t399 <= 0) {
					asm("pushad");
					asm("invalid");
					asm("salc");
					__eflags =  *((char*)(__ebx + _t389)) - 0x17;
					__eflags = _t232 - 0x2b;
					_pop(ss);
					asm("in eax, 0xba");
					asm("adc cl, [edi-0x2f]");
					asm("out dx, al");
					asm("ror byte [0x3a17e6d3], cl");
					_t385 = __edi - 1;
					asm("lodsd");
					_t233 = _t232;
					asm("stosb");
					 *((intOrPtr*)(_t233 - 0x2d)) =  *((intOrPtr*)(_t233 - 0x2d)) + _t233;
					_t234 = __ebx ^  *(__ecx - 0x48ee309a);
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					 *_t234 =  *_t234 + _t234;
					goto 0;
					 *_t234 =  *_t234 + _t234;
					_t235 = _t234 |  *_t234;
					_t351 = _t233 - 1;
					__eflags = _t351;
					asm("popad");
					if(_t351 < 0) {
						L9:
						_pop(es);
						_t20 =  &(_t385[0x1c]);
						 *_t20 = _t385[0x1c] + _t361;
						__eflags =  *_t20;
						if( *_t20 == 0) {
							goto L18;
						} else {
							asm("outsd");
							asm("outsb");
							_t337 = (_t235 ^  *_t235) + 0xe100438;
							_t385 = 0x1201ef04;
							 *_t337 =  *_t337 + _t337;
							 *_t351 =  *_t351 + 1;
							 *_t337 =  *_t337 - _t337;
							 *_t337 =  *_t337 + _t337;
							_t236 = _t337 +  *0x1201ef04;
							 *0x1201EF74 =  *0x1201EF74 + _t361;
							__eflags =  *0x1201EF74;
							if( *0x1201EF74 == 0) {
								goto L20;
							} else {
								asm("outsd");
								asm("outsb");
								 *_t236 =  *_t236 ^ _t236;
								_push(es);
								 *0x1201ef04 =  *0x1201ef04 + _t236;
								 *0x1201EF74 =  *0x1201EF74 + _t361;
								__eflags =  *0x1201EF74;
								if( *0x1201EF74 != 0) {
									asm("outsd");
									asm("outsb");
									 *_t236 =  *_t236 ^ _t236;
									_t338 = _t236 + 0xd980960;
									__eflags = _t338;
									_t385 = 0x1201ef04;
									goto L13;
								}
							}
						}
					} else {
						asm("outsd");
						asm("o16 gs insb");
						 *_t235 =  *_t235 ^ _t235;
						_t338 = _t235 | 0x55000701;
						_t398 = _t391 + 1;
						_t360 = _t351 - 1;
						_push(__edx);
						_pop(_t377);
						_push(_t360);
						_push(_t398);
						 *_t377 =  *_t377 + _t360;
						 *_t338 =  *_t338 + _t338;
						_t378 = __edx + 1;
						 *((intOrPtr*)(_t385 + _t338)) =  *((intOrPtr*)(_t385 + _t338)) + _t338;
						_a68 = _a68 + _t378;
						_t351 = _t360 - 1;
						_t361 = _t378;
						_push(_t351);
						_push(_t398);
						 *0x1aca =  *0x1aca + _t378;
						asm("aad 0x1a");
						 *_t338 =  *_t338 + _t338;
						asm("movsb");
						asm("adc al, [eax]");
						 *((intOrPtr*)(_t351 + 0x12)) =  *((intOrPtr*)(_t351 + 0x12)) + _t338;
						 *_t338 =  *_t338 + _t338;
						_t391 = _t398 + 1;
						 *((intOrPtr*)(__esi + 3)) =  *((intOrPtr*)(__esi + 3)) + _t338;
						 *__ecx =  *__ecx + 1;
						 *_t338 =  *_t338 - _t338;
						 *_t338 =  *_t338 + _t338;
						 *_t385 =  *_t385 + _t338;
						_t14 =  &(_t385[0x1c]);
						 *_t14 = _t385[0x1c] + __ecx;
						__eflags =  *_t14;
						if( *_t14 == 0) {
							L13:
							asm("out dx, eax");
							 *_t378 =  *_t378 + _t378;
							 *_t351 =  *_t351 + 1;
							_t340 = _t338 +  *_t338 & 0x00000000;
							 *_t340 =  *_t340 + _t340;
							_t341 = _t340 + 5;
							__eflags = _t341;
							goto L14;
						} else {
							asm("outsd");
							asm("outsb");
							_t341 = _t338 ^  *_t338;
							_push(es);
							 *_t385 =  *_t385 + _t341;
							_t16 =  &(_t385[0x1c]);
							 *_t16 = _t385[0x1c] + __ecx;
							__eflags =  *_t16;
							if( *_t16 == 0) {
								L14:
								_t236 = 0x78655400 + _t341;
								__eflags = _t236;
								if(_t236 == 0) {
									goto L19;
								} else {
									 *_t378 =  *_t378 + _t236;
									_t342 = _t236 + 0x78;
									 *_t342 =  *_t342 + _t361;
									_t236 = _t342 + 0x01ef1167 |  *0x78655400;
									__eflags = _t236;
									if(_t236 != 0) {
										 *_t378 =  *_t378 + _t378;
										_t344 = _t236 +  *_t236;
										__eflags = _t344;
										goto L17;
									}
								}
								goto L21;
							} else {
								asm("outsd");
								asm("outsb");
								_t347 = (_t341 ^  *_t341) + 0xe880d98;
								_t385 = 0x1201ef04;
								 *_t347 =  *_t347 + _t347;
								 *_t351 =  *_t351 + 1;
								 *_t347 =  *_t347 - _t347;
								 *_t347 =  *_t347 + _t347;
								_t344 = _t347 +  *0x1201ef04;
								 *0x1201EF74 =  *0x1201EF74 + __ecx;
								__eflags =  *0x1201EF74;
								if( *0x1201EF74 == 0) {
									L17:
									_t351 = _t351 + _t351;
									_t345 = _t344 +  *((intOrPtr*)(_t344 + _t344));
									_push(es);
									 *_t345 =  *_t345 + _t345;
									 *((intOrPtr*)(_t345 + 0x21)) =  *((intOrPtr*)(_t345 + 0x21)) + _t345;
									_t235 = _t345 + 1;
									__eflags = _t235;
									L18:
									 *_t361 =  *_t361 + _t235;
									 *_t378 =  *_t378 + _t235;
									_t236 = _t235 + _t351;
									asm("sbb al, 0x40");
									 *_t236 =  *_t236 + _t236;
									 *_t236 =  *_t236 + _t236;
									_t351 = _t351 + _t351;
									asm("invalid");
									L19:
									asm("invalid");
									asm("invalid");
									asm("invalid");
									 *_t236 =  *_t236 + _t236;
									 *_t236 =  *_t236 + _t236;
									asm("sbb eax, 0x101c0040");
									L20:
									asm("sbb al, 0x10");
									_t361 = _t361 + 1;
									 *_t236 =  *_t236 + _t236;
									__eflags =  *_t236;
									L21:
									 *_t236 =  *_t236 + _t236;
									_t237 = _t236 + _t351;
									__eflags = _t237;
									asm("outsd");
									if (_t237 >= 0) goto L22;
								} else {
									asm("outsd");
									asm("outsb");
									_t235 = _t344 ^  *_t344;
									_push(es);
									 *0x1201ef04 =  *0x1201ef04 + _t235;
									__eflags =  *0x1201ef04;
									goto L9;
								}
							}
						}
					}
					 *_t237 =  *_t237 + _t237;
					 *_t237 =  *_t237 + _t237;
					 *_t237 =  *_t237 + _t237;
					 *_t237 =  *_t237 + _t237;
					 *_t237 =  *_t237 + _t237;
					 *_t237 =  *_t237 + _t237;
					__eflags =  *_t237;
					if( *_t237 != 0) {
						_t335 = _t237 + 1;
						 *_t361 =  *_t361 + _t335;
						 *_t351 =  *_t351 + _t335;
						_t237 = _t335 + _t351;
						asm("sbb al, 0x40");
						 *_t237 =  *_t237 + _t237;
						 *_t237 =  *_t237 + _t237;
						_t351 = _t351 + _t351;
						asm("invalid");
						asm("invalid");
					}
					asm("invalid");
					 *_t237 =  *_t237 + 1;
					 *_t237 =  *_t237 + _t237;
					_t238 = _t237 + _t237;
					asm("sbb eax, 0x10400040");
					_t362 = _t361 + 1;
					 *_t238 =  *_t238 + _t238;
					 *_t238 =  *_t238 + _t238;
					 *((intOrPtr*)(_t238 + 0x7e2a)) =  *((intOrPtr*)(_t238 + 0x7e2a)) + _t238;
					 *_t238 =  *_t238 + _t238;
					 *_t238 =  *_t238 + _t238;
					 *_t238 =  *_t238 + _t238;
					 *_t238 =  *_t238 + _t238;
					 *_t238 =  *_t238 + _t238;
					 *((intOrPtr*)(_t351 + _t378 + 0x10040)) =  *((intOrPtr*)(_t351 + _t378 + 0x10040)) + _t362;
					_t239 = _t238;
					asm("fcomp qword [eax+eax*2]");
					 *_t239 =  *_t239 + _t239;
					 *_t239 =  *_t239 + _t239;
					asm("invalid");
					asm("invalid");
					asm("invalid");
					 *_t239 =  *_t239 + 1;
					 *_t239 =  *_t239 + _t239;
					_t240 = _t239 + _t378;
					asm("sbb eax, 0x10500040");
					_t363 = _t362 + 1;
					 *_t240 =  *_t240 + _t240;
					 *_t240 =  *_t240 + _t240;
					 *_t240 =  *_t240 + _t378;
					 *_t240 =  *_t240 + _t240;
					 *_t240 =  *_t240 + _t240;
					 *_t240 =  *_t240 + _t240;
					 *_t240 =  *_t240 + _t240;
					 *_t240 =  *_t240 + _t240;
					 *_t240 =  *_t240 + _t240;
					asm("in al, 0x13");
					_t241 = _t240 + 1;
					 *_t363 =  *_t363 + _t241;
					 *0x401cdc00 =  *0x401cdc00 + _t241;
					 *_t241 =  *_t241 + _t241;
					 *_t241 =  *_t241 + _t241;
					_t354 = _t351 + _t351 -  *_t386 + _t351 + _t351 -  *_t386;
					asm("invalid");
					asm("invalid");
					asm("invalid");
					 *_t241 =  *_t241 + 1;
					 *_t241 =  *_t241 + _t241;
					 *_t241 =  *_t241 + _t241;
					_push(ds);
					_t242 = _t241 + 1;
					 *((intOrPtr*)(_t242 + 0x10)) =  *((intOrPtr*)(_t242 + 0x10)) + _t242;
					_t364 = _t363 + 1;
					 *_t242 =  *_t242 + _t242;
					 *_t242 =  *_t242 + _t242;
					 *((intOrPtr*)(_t242 + 0x7e29)) =  *((intOrPtr*)(_t242 + 0x7e29)) + _t242;
					 *_t242 =  *_t242 + _t242;
					 *_t242 =  *_t242 + _t242;
					 *_t242 =  *_t242 + _t242;
					 *_t242 =  *_t242 + _t242;
					 *_t242 =  *_t242 + _t242;
					 *((intOrPtr*)(_t391 + _t378)) =  *((intOrPtr*)(_t391 + _t378)) + _t354;
					_t243 = _t242 + 1;
					 *_t364 =  *_t364 + _t243;
					 *_t386 =  *_t386 + _t243;
					_t244 = _t243 + _t354;
					asm("sbb al, 0x40");
					 *_t244 =  *_t244 + _t244;
					 *_t244 =  *_t244 + _t244;
					asm("invalid");
					asm("invalid");
					asm("invalid");
					 *_t244 =  *_t244 + 1;
					 *_t244 =  *_t244 + _t244;
					 *((intOrPtr*)(_t244 + 0x1e)) =  *((intOrPtr*)(_t244 + 0x1e)) + _t378;
					_t245 = _t244 + 1;
					 *((intOrPtr*)(_t245 + 0x10)) =  *((intOrPtr*)(_t245 + 0x10)) + _t378;
					_t365 = _t364 + 1;
					 *_t245 =  *_t245 + _t245;
					 *_t245 =  *_t245 + _t245;
					_t246 = _t245 + _t378;
					_t356 = _t354 + _t354 -  *_t386;
					__eflags = _t356;
					do {
						if (__eflags <= 0) goto L26;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						_push(_t391);
						asm("adc al, 0x40");
						 *_t365 =  *_t365 + _t246;
						 *_t385 =  *_t385 + _t246;
						_t246 = _t246 + _t356;
						asm("sbb al, 0x40");
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						_t356 = _t356 + _t356;
						asm("invalid");
						asm("invalid");
						asm("invalid");
						 *_t246 =  *_t246 + 1;
						 *_t246 =  *_t246 + _t246;
						 *((intOrPtr*)(_t246 - 0x7fffbfe2)) =  *((intOrPtr*)(_t246 - 0x7fffbfe2)) + _t246;
						asm("adc [ecx], al");
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						__eflags =  *_t246;
						asm("adc [ebx], ch");
						if ( *_t246 <= 0) goto L27;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						 *_t246 =  *_t246 + _t246;
						 *((intOrPtr*)(_t246 + _t246 * 2)) = ss;
						 *_t246 =  *_t246 + _t378;
						 *_t246 =  *_t246 + _t246;
						__eflags =  *_t246;
					} while (__eflags > 0);
					asm("adc [ebp+0x46211d95], ebx");
					_t247 =  *0x6014b0c8;
					asm("invalid");
					asm("salc");
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					asm("adc [edx], al");
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					 *_t247 =  *_t247 + _t247;
					_t248 = _t247 + _t378;
					asm("adc [eax], eax");
					_t392 = _t391 - 1;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t378;
					 *_t248 =  *_t248 + _t248;
					_t358 = _t356 + 1 - _t378;
					_pop(_t366);
					_t367 = _t366 |  *(_t248 + 0x41);
					 *((char*)(_t358 + _t386 * 4 - 0x6f)) = _t248;
					_t387 =  *_t392 * 0x76;
					asm("wait");
					_pop(ds);
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					 *_t248 =  *_t248 + _t248;
					_t249 = _t248 - 1;
					asm("jecxz 0x2");
					 *_t249 =  *_t249 + _t249;
					 *_t249 =  *_t249 + _t249;
					 *((intOrPtr*)(_t367 + 0x9c0040)) =  *((intOrPtr*)(_t367 + 0x9c0040)) + _t249;
					 *_t249 =  *_t249 + _t249;
					_push(_t387);
					_t379 = _t378 + 1;
					_t250 = _t249 ^ 0x2a263621;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					 *_t387 =  *_t387 + _t358;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					 *_t250 =  *_t250 + _t250;
					_t252 = _t250 |  *_t250 | 0x00000004;
					 *_t252 =  *_t252 + _t252;
					 *_t252 =  *_t252 + _t252;
					 *_t252 =  *_t252 + _t252;
					 *_t252 =  *_t252 + _t252;
					 *_t252 =  *_t252 + _t252;
					_t254 = (_t252 | 0x00000017) + 1;
					 *((intOrPtr*)(_t254 + 0x30 + _t387 * 8)) =  *((intOrPtr*)(_t254 + 0x30 + _t387 * 8)) + _t254;
					 *_t254 =  *_t254 + _t254;
					asm("invalid");
					 *_t254 =  *_t254 - 1;
					 *_t254 =  *_t254 + _t254;
					 *_t367 =  *_t367 + _t254;
					 *_t254 =  *_t254 + _t254;
					 *_t379 =  *_t379 + _t254;
					__eflags =  *_t379;
					_t255 = _t254 +  *_t254;
					 *_t255 =  *_t255 + _t255;
					goto 0x8c401579;
					asm("adc al, 0x40");
					 *((intOrPtr*)(_t379 + _t358)) =  *((intOrPtr*)(_t379 + _t358)) + _t379;
					_t256 = _t255 + 1;
					 *((intOrPtr*)( &(_t379[0x1e0010]) + _t367)) =  *((intOrPtr*)( &(_t379[0x1e0010]) + _t367)) + _t256;
					 *_t256 =  *_t256 + _t256;
					 *_t256 =  *_t256 + 0x920000;
					 *_t256 =  *_t256 + _t256;
					_t257 = _t358;
					_t359 = _t256;
					 *_t257 =  *_t257 + _t257;
					 *_t257 =  *_t257 + _t257;
					 *_t257 =  *_t257 + _t257;
					 *_t257 =  *_t257 + _t257;
					 *_t257 =  *_t257 + _t257;
					 *_t257 =  *_t257 + _t257;
					 *_t257 =  *_t257 + _t257;
					 *_t257 =  *_t257 + _t257;
					 *_t257 =  *_t257 + _t257;
					_t68 = _t359 + 0x74;
					 *_t68 = _t379 +  *(_t359 + 0x74);
					__eflags =  *_t68;
					if(__eflags < 0) {
						L33:
						 *_t257 =  *_t257 & _t257;
						 *_t257 =  *_t257 + _t257;
						 *_t257 =  *_t257 + _t257;
						_push(ss);
						_t259 = _t257 - 1 + 1;
						 *_t367 =  *_t367 + _t259;
						 *_t259 =  *_t259 + _t259;
						 *((intOrPtr*)(_t259 + 0x16)) =  *((intOrPtr*)(_t259 + 0x16)) + _t379;
						_t257 = _t259 + 1;
						 *_t257 =  *_t257 + _t257;
						 *_t257 =  *_t257 + _t257;
						_t87 =  &(_t379[0x10]) + _t387;
						 *_t87 =  *( &(_t379[0x10]) + _t387) + _t367;
						__eflags =  *_t87;
						goto L34;
					} else {
						asm("outsb");
						asm("a16 jb 0x4");
						_push(_t385);
						_push(0x6e657469);
						if(__eflags >= 0) {
							L34:
							_push(ss);
							_t260 = _t257 + 1;
							 *_t367 =  *_t367 + _t260;
							 *_t260 =  *_t260 + _t260;
							 *((intOrPtr*)(_t260 + 0x16)) =  *((intOrPtr*)(_t260 + 0x16)) + _t379;
							_t261 = _t260 + 1;
							 *_t261 =  *_t261 + _t261;
							_t385[0x1b001a00] = _t379 + _t385[0x1b001a00];
							 *((intOrPtr*)(_t261 + 0x16)) =  *((intOrPtr*)(_t261 + 0x16)) + _t359;
							_t257 = _t261 + 1;
							_t97 = _t389 +  &(_t379[0x10]);
							 *_t97 =  *(_t389 +  &(_t379[0x10])) + _t257;
							__eflags =  *_t97;
						} else {
							asm("popad");
							asm("a16 jz 0x78");
							_t387 = _a110 * 0x67617073;
							__eflags = _t387;
							if(_t387 != 0) {
								_t387 = _t385[0xc] * 0x1000100;
								_t333 = _t257 + _t359;
								asm("sbb al, 0x40");
								 *_t333 =  *_t333 + _t333;
								 *_t333 =  *_t333 + _t333;
								 *((intOrPtr*)(_t333 + 5)) =  *((intOrPtr*)(_t333 + 5)) + _t379;
								_t376 = _t367 + 1;
								_t359 = _t359 + _t359;
								asm("invalid");
								 *_t333 =  *_t333 + 1;
								 *_t333 =  *_t333 + _t333;
								 *((intOrPtr*)(_t333 + 0x1d)) =  *((intOrPtr*)(_t333 + 0x1d)) + _t333;
								_t334 = _t333 + 1;
								 *((intOrPtr*)(_t334 + _t379)) =  *((intOrPtr*)(_t334 + _t379)) + _t376;
								_t367 = _t376 + 1;
								 *_t334 =  *_t334 + _t334;
								 *_t334 =  *_t334 + _t334;
								 *((intOrPtr*)(_t334 + 0x7e2a)) =  *((intOrPtr*)(_t334 + 0x7e2a)) + _t379;
								 *_t334 =  *_t334 + _t334;
								 *_t334 =  *_t334 + _t334;
								 *_t334 =  *_t334 + _t334;
								 *_t334 =  *_t334 + _t334;
								 *_t334 =  *_t334 + _t334;
								 *((intOrPtr*)(_t334 + 0x16)) =  *((intOrPtr*)(_t334 + 0x16)) + _t367;
								_t257 = _t334 + 1;
								 *_t367 =  *_t367 + _t257;
								 *_t257 =  *_t257 + _t257;
								_t83 = _t257 + 0x21;
								 *_t83 =  *(_t257 + 0x21) + _t367;
								__eflags =  *_t83;
								goto L33;
							}
						}
					}
					 *_t257 =  *_t257 + _t257;
					 *_t257 =  *_t257 + _t257;
					__eflags =  *_t257;
					asm("fs insb");
					if (__eflags > 0) goto L36;
					if(__eflags < 0) {
						L39:
						_t105 = _t257 - 0x4a;
						 *_t105 = _t379 +  *(_t257 - 0x4a);
						__eflags =  *_t105;
						if ( *_t105 < 0) goto L40;
						_push(_t392);
						 *_t257 =  *_t257 & _t257;
						asm("invalid");
						asm("invalid");
						 *_t257 =  *_t257 + _t257;
						 *_t257 =  *_t257 + _t257;
						_push(_t257);
						_push(ss);
						_t263 = _t379 + _t257 + 1;
						__eflags = _t263;
					} else {
						_t263 = _t257 + 1;
						 *((intOrPtr*)(_t263 + 0x40004021)) =  *((intOrPtr*)(_t263 + 0x40004021)) + _t367;
						 *_t385 =  *_t385 + _t359;
						 *((intOrPtr*)(_t263 + _t263)) =  *((intOrPtr*)(_t263 + _t263)) + _t379;
						 *_t263 =  *_t263 + _t263;
						_t392 =  &(_t392[0]);
						 *_t263 =  *_t263 & _t263;
						asm("invalid");
						asm("invalid");
						 *_t263 =  *_t263 + _t263;
						 *_t263 =  *_t263 + _t263;
						 *_t263 =  *_t263 + _t263;
						 *_t263 =  *_t263 + _t263;
						__eflags =  *_t263;
						if( *_t263 >= 0) {
							_t257 = _t263 + 1;
							__eflags = _t257;
							goto L39;
						}
					}
					asm("rcl byte [0x11800040], 1");
					_t264 = _t263 + 1;
					 *((intOrPtr*)(_t387 - 0x73ffbfef)) =  *((intOrPtr*)(_t387 - 0x73ffbfef)) + _t264;
					asm("adc [eax], eax");
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					 *_t264 =  *_t264 + _t264;
					asm("hlt");
					 *_t264 =  *_t264 + _t264;
					_t265 = _t264 + _t359;
					asm("sbb al, 0x40");
					 *_t265 =  *_t265 + _t265;
					 *_t265 =  *_t265 + _t265;
					_t267 = _t265 + _t265 + 0x8700041;
					_t368 = _t367 + 1;
					 *((intOrPtr*)(_t267 + 0x8000013)) =  *((intOrPtr*)(_t267 + 0x8000013)) + _t368;
					asm("adc [ecx], al");
					asm("invalid");
					_t268 = _t267 + 1;
					 *_t268 =  *_t268 + _t268;
					asm("adc [ecx], al");
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					 *_t268 =  *_t268 + _t268;
					_t270 = (_t268 ^ 0x00000013) + 1;
					 *_t368 =  *_t368 + _t270;
					 *_t270 =  *_t270 + _t270;
					 *_t368 =  *_t368 + _t270;
					 *_t270 =  *_t270 + _t270;
					_t271 = _t270 + _t359;
					asm("sbb al, 0x40");
					 *_t271 =  *_t271 + _t271;
					 *_t271 =  *_t271 + _t271;
					 *_t271 =  *_t271 + _t379;
					_t272 = _t271 + 0xffff0041;
					asm("invalid");
					 *_t272 =  *_t272 + _t272;
					 *_t272 =  *_t272 + _t272;
					 *0x10080040 =  *0x10080040 ^ _t359;
					_t369 = _t368 + 1;
					 *_t272 =  *_t272 + _t272;
					 *_t272 =  *_t272 + _t272;
					_t273 = _t272 + _t272;
					__eflags = _t273;
					if(_t273 < 0) {
						 *_t273 =  *_t273 + _t273;
						 *_t273 =  *_t273 + _t273;
						 *_t273 =  *_t273 + _t273;
						 *_t273 =  *_t273 + _t273;
						 *_t273 =  *_t273 + _t273;
						 *_t273 =  *_t273 + _t273;
						_t326 = _t273 + _t273;
						asm("sbb [eax], eax");
						 *_t326 =  *_t326 + _t326;
						 *_t326 =  *_t326 + _t326;
						_pop(ds);
						_t327 = _t326 + 1;
						 *_t327 =  *_t327 + _t327;
						 *_t327 =  *_t327 + _t327;
						_t328 = _t327 + _t327;
						asm("sbb [eax], eax");
						 *_t328 =  *_t328 + _t328;
						 *_t328 =  *_t328 + _t328;
						asm("enter 0x4019, 0x0");
						 *_t328 =  *_t328 + _t328;
						 *_t328 =  *_t328 + _t328;
						asm("les ebx, [ecx]");
						_t329 = _t328 + 1;
						 *0xc8000000 =  *0xc8000000 + _t329;
						asm("sbb [eax], eax");
						 *_t329 =  *_t329 + _t329;
						_t359 = 1;
						_push(0x90006c00);
						asm("sbb al, [eax]");
						__eflags = _t329 & 0x0000001c;
						_t369 = _t369 + 1;
						 *_t329 =  *_t329 + _t329;
						 *_t329 =  *_t329 + _t329;
						_t113 = 1 + _t387 * 4;
						 *_t113 =  *(1 + _t387 * 4) + _t329;
						__eflags =  *_t113;
						if (__eflags < 0) goto L43;
						if(__eflags != 0) {
							_t330 = _t329 + 1;
							_t385[0x100010] = _t385[0x100010] + _t330;
							asm("adc eax, [eax]");
							 *(_t330 ^ 0x00000000) =  *(_t330 ^ 0x00000000) + (_t330 ^ 0x00000000);
							_pop(ds);
							_t329 =  &(_t392[0]);
							 *_t379 =  *_t379 + _t329;
							 *1 =  *1 + _t329;
							 *_t329 =  *_t329 + _t329;
							 *_t329 =  *_t329 + _t329;
							 *_t329 =  *_t329 + _t329;
							 *_t329 =  *_t329 + _t329;
							_t122 =  &(_t379[0xffffffffed940011]);
							 *_t122 = _t379 + _t379[0xffffffffed940011];
							__eflags =  *_t122;
						}
						asm("sbb al, [eax]");
						_t379 = 0x7c;
						_t126 = _t385 + _t359 + 0x20040;
						 *_t126 =  *(_t385 + _t359 + 0x20040) + _t329;
						__eflags =  *_t126;
						asm("movsb");
						ds = _t329;
						_t273 = _t329 + 1;
						 *0x7c =  *0x7c + _t273;
						__eflags =  *0x7c;
					}
					_t276 = _t273 +  *_t273 +  *((intOrPtr*)(_t273 +  *_t273)) + 1;
					 *_t359 =  *_t359 + _t379;
					 *_t276 =  *_t276 + _t359;
					 *_t276 =  *_t276 + _t276;
					 *((intOrPtr*)(_t385 + _t359 + 0x30040)) =  *((intOrPtr*)(_t385 + _t359 + 0x30040)) + _t379;
					_t277 = _t276 +  *_t276;
					 *_t277 =  *_t277 + _t277;
					 *_t277 =  *_t277 + _t277;
					 *_t277 =  *_t277 + _t277;
					 *_t277 =  *_t277 + _t277;
					asm("clc");
					asm("sbb al, [eax]");
					 *_t277 =  *_t277 + _t277;
					_t278 = _t277 + 1;
					 *_t359 =  *_t359 + _t278;
					 *_t359 =  *_t359 + _t278;
					 *_t278 =  *_t278 + _t278;
					asm("sbb [eax], al");
					__eflags = _t278;
					 *_t278 =  *_t278 + _t278;
					_t280 = _t278 - 0x20 + 1;
					 *((intOrPtr*)(_t280 + _t280)) =  *((intOrPtr*)(_t280 + _t280)) + _t280;
					_t281 = _t280 +  *_t280;
					 *_t281 =  *_t281 + _t281;
					 *_t281 =  *_t281 + _t281;
					 *_t281 =  *_t281 + _t281;
					 *_t281 =  *_t281 + _t281;
					_t393 = _t277;
					asm("sbb eax, [eax]");
					asm("pushad");
					 *_t281 =  *_t281 + _t359;
					_t282 = _t281 + 1;
					 *((intOrPtr*)(_t282 + _t282)) =  *((intOrPtr*)(_t282 + _t282)) + _t282;
					_t284 = _t282 +  *_t282 + 1;
					 *_t385 =  *_t385 + _t359;
					 *_t284 =  *_t284 + _t284;
					 *_t284 =  *_t284 + _t284;
					_t394 = _t393 + 1;
					 *_t284 =  *_t284 & _t284;
					asm("invalid");
					asm("invalid");
					 *_t284 =  *_t284 + _t284;
					 *_t284 =  *_t284 + _t284;
					 *_t284 =  *_t284 + _t284;
					 *_t284 =  *_t284 + _t284;
					asm("aam 0x1b");
					_t285 = _t284 + 1;
					_t138 = _t285 - 0x4a;
					 *_t138 = 0x7c +  *(_t285 - 0x4a);
					__eflags =  *_t138;
					if ( *_t138 < 0) goto L48;
					 *_t285 =  *_t285 & _t285;
					asm("invalid");
					asm("invalid");
					_t286 = _t285 + 1;
					 *_t359 =  *_t359 + 0x7c;
					 *((intOrPtr*)(_t286 + _t286)) =  *((intOrPtr*)(_t286 + _t286)) + _t286;
					 *((intOrPtr*)(_t385 + _t359 + 0x10040)) =  *((intOrPtr*)(_t385 + _t359 + 0x10040)) + 0x7c;
					_t287 = _t286 +  *_t286;
					 *_t287 =  *_t287 + _t287;
					 *_t287 =  *_t287 + _t287;
					 *_t287 =  *_t287 + _t287;
					 *_t287 =  *_t287 + _t287;
					 *((intOrPtr*)(_t287 + 0x40)) =  *((intOrPtr*)(_t287 + 0x40)) + _t359;
					 *_t369 =  *_t369 + _t287;
					 *_t359 =  *_t359 + _t287;
					_t288 = _t287 + 0x7c;
					asm("sbb al, 0x40");
					 *_t288 =  *_t288 + _t288;
					 *_t288 =  *_t288 + _t288;
					asm("sbb [eax], eax");
					_t290 = _t288 + _t369 - 1;
					asm("sbb [eax], eax");
					asm("adc byte [ecx], 0x40");
					 *((intOrPtr*)(_t387 - 0x73ffbfef)) =  *((intOrPtr*)(_t387 - 0x73ffbfef)) + _t290;
					asm("adc [eax], eax");
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					 *_t290 =  *_t290 + _t290;
					asm("lock sbb [eax], eax");
					_t291 = _t290 - 1;
					asm("sbb [eax], eax");
					asm("adc byte [ecx], 0x40");
					 *((intOrPtr*)(_t387 - 0x73ffbfef)) =  *((intOrPtr*)(_t387 - 0x73ffbfef)) + _t291;
					asm("adc [eax], eax");
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					 *_t291 =  *_t291 + _t291;
					asm("sbb [edx], bl");
					_t292 = _t291 + 1;
					 *((intOrPtr*)(_t292 + 0x19)) =  *((intOrPtr*)(_t292 + 0x19)) + _t369;
					_t293 = _t292 + 1;
					 *((intOrPtr*)(_t293 - 0x79ffbfef)) =  *((intOrPtr*)(_t293 - 0x79ffbfef)) + _t293;
					asm("adc [eax], eax");
					 *_t369 = ss;
					_t294 = _t293 + 1;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *_t294 =  *_t294 + _t294;
					 *((intOrPtr*)(_t294 + 0x1a)) =  *((intOrPtr*)(_t294 + 0x1a)) + _t294;
					_t295 = _t294 + 1;
					 *((intOrPtr*)(_t295 + 0x19)) =  *((intOrPtr*)(_t295 + 0x19)) + _t369;
					_t296 = _t295 + 1;
					 *((intOrPtr*)(_t296 - 0x79ffbfef)) =  *((intOrPtr*)(_t296 - 0x79ffbfef)) + _t296;
					asm("adc [eax], eax");
					 *_t369 = ss;
					_t297 = _t296 + 1;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					 *_t297 =  *_t297 + _t297;
					_t298 = _t297 + _t369;
					asm("sbb al, 0x40");
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					_t162 = _t298 + 0x1a;
					 *_t162 =  *(_t298 + 0x1a) + _t369;
					__eflags =  *_t162;
					asm("sbb [eax], eax");
					asm("adc byte [ecx], 0x40");
					 *((intOrPtr*)(_t387 - 0x73ffbfef)) =  *((intOrPtr*)(_t387 - 0x73ffbfef)) + _t298;
					asm("adc [eax], eax");
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					 *_t298 =  *_t298 + _t298;
					_v28 = _v28 - 0x3f;
					_t395 = _t394 - 0xc;
					 *[fs:0x0] = _t395;
					L004010C0();
					_v48 = _t395;
					_v44 = E00401098;
					_v40 = _v28 & 0x00000001;
					_v28 = _v28 & 0x000000fe;
					 *((intOrPtr*)( *_v28 + 4))(_v28, _t385, _t387, _t359, 0x50,  *[fs:0x0], 0x4010c6, _t389, 0x4800401a, 0x5000401c, _t394);
					__eflags =  *0x411594;
					if( *0x411594 != 0) {
						_v92 = 0x411594;
					} else {
						_push(0x411594);
						_push(0x402090);
						L00401174();
						_v92 = 0x411594;
					}
					_v64 =  *_v92;
					_t313 =  *((intOrPtr*)( *_v64 + 0x14))(_v64,  &_v44);
					asm("fclex");
					_v68 = _t313;
					__eflags = _v68;
					if(_v68 >= 0) {
						_t190 =  &_v96;
						 *_t190 = _v96 & 0x00000000;
						__eflags =  *_t190;
					} else {
						_push(0x14);
						_push(0x402080);
						_push(_v64);
						_push(_v68);
						L0040116E();
						_v96 = _t313;
					}
					_v72 = _v44;
					_t318 =  *((intOrPtr*)( *_v72 + 0x60))(_v72,  &_v40);
					asm("fclex");
					_v76 = _t318;
					__eflags = _v76;
					if(_v76 >= 0) {
						_t203 =  &_v100;
						 *_t203 = _v100 & 0x00000000;
						__eflags =  *_t203;
					} else {
						_push(0x60);
						_push(0x4020a0);
						_push(_v72);
						_push(_v76);
						L0040116E();
						_v100 = _t318;
					}
					_v88 = _v40;
					_v40 = _v40 & 0x00000000;
					L0040117A();
					L00401168();
					_t323 =  *((intOrPtr*)( *_a4 + 0x288))(_a4,  &_v44);
					asm("fclex");
					_v64 = _t323;
					__eflags = _v64;
					if(_v64 >= 0) {
						_t221 =  &_v104;
						 *_t221 = _v104 & 0x00000000;
						__eflags =  *_t221;
					} else {
						_push(0x288);
						_push(0x401f54);
						_push(_a4);
						_push(_v64);
						L0040116E();
						_v104 = _t323;
					}
					_push(0);
					_push(0);
					_push(_v44);
					_t324 =  &_v60;
					_push(_t324);
					L0040115C();
					_push(_t324);
					L00401162();
					_v36 = _t324;
					L00401168();
					L00401156(); // executed
					_t325 = E004107AE(_t359,  &_v60, _t385, _t387); // executed
					_v8 = 0;
					_push(E0041078F);
					L00401150();
					L00401150();
					return _t325;
				} else {
					return _t232;
				}
			}

0x00401198
0x00401198
0x00401198
0x00401198
0x0040119d
0x004011a2
0x004011a4
0x004011a6
0x004011a8
0x004011aa
0x004011ac
0x004011ad
0x004011af
0x004011b1
0x004011b3
0x004011b3
0x004011b4
0x004011b6
0x00401201
0x00401202
0x00401204
0x00401205
0x00401206
0x00401208
0x00401209
0x0040120b
0x0040120f
0x00401210
0x00401216
0x00401217
0x0040121e
0x00401220
0x00401221
0x00401224
0x00401225
0x00401227
0x00401229
0x0040122b
0x0040122d
0x0040122f
0x00401231
0x00401233
0x00401235
0x00401237
0x00401239
0x0040123b
0x0040123d
0x0040123f
0x00401241
0x00401243
0x00401245
0x00401247
0x00401249
0x00401250
0x00401252
0x00401254
0x00401254
0x00401255
0x00401256
0x004012cc
0x004012cc
0x004012cd
0x004012cd
0x004012cd
0x004012d0
0x00000000
0x004012d2
0x004012d2
0x004012d3
0x004012d6
0x004012db
0x004012e0
0x004012e2
0x004012e4
0x004012e6
0x004012e8
0x004012ea
0x004012ea
0x004012ed
0x00000000
0x004012ef
0x004012ef
0x004012f0
0x004012f1
0x004012f3
0x004012f4
0x004012f6
0x004012f6
0x004012f9
0x004012fb
0x004012fc
0x004012fd
0x004012ff
0x004012ff
0x00401304
0x00000000
0x00401304
0x004012f9
0x004012ed
0x00401258
0x00401258
0x00401259
0x0040125d
0x0040125f
0x00401264
0x00401265
0x00401266
0x00401267
0x00401268
0x00401269
0x0040126a
0x0040126c
0x0040126e
0x0040126f
0x00401272
0x00401275
0x00401277
0x00401278
0x00401279
0x0040127a
0x00401280
0x00401282
0x00401284
0x00401285
0x00401287
0x0040128a
0x0040128c
0x0040128d
0x00401290
0x00401292
0x00401294
0x00401296
0x00401298
0x00401298
0x00401298
0x0040129b
0x00401306
0x00401306
0x00401307
0x0040130b
0x0040130d
0x0040130f
0x00401311
0x00401311
0x00000000
0x0040129d
0x0040129d
0x0040129e
0x0040129f
0x004012a1
0x004012a2
0x004012a4
0x004012a4
0x004012a4
0x004012a7
0x00401312
0x00401312
0x00401312
0x00401317
0x00000000
0x00401319
0x00401319
0x0040131b
0x0040131d
0x00401324
0x00401324
0x0040132a
0x0040132c
0x0040132e
0x0040132e
0x00000000
0x0040132e
0x0040132a
0x00000000
0x004012a9
0x004012a9
0x004012aa
0x004012ad
0x004012b2
0x004012b7
0x004012b9
0x004012bb
0x004012bd
0x004012bf
0x004012c1
0x004012c1
0x004012c4
0x0040132f
0x0040132f
0x00401331
0x00401334
0x00401335
0x00401337
0x0040133a
0x0040133a
0x0040133b
0x0040133b
0x0040133d
0x0040133f
0x00401341
0x00401343
0x00401345
0x00401347
0x00401349
0x0040134a
0x0040134a
0x0040134c
0x0040134e
0x00401350
0x00401352
0x00401355
0x00401358
0x00401358
0x0040135a
0x0040135b
0x0040135b
0x0040135d
0x0040135d
0x0040135f
0x0040135f
0x00401361
0x00401362
0x004012c6
0x004012c6
0x004012c7
0x004012c8
0x004012ca
0x004012cb
0x004012cb
0x00000000
0x004012cb
0x004012c4
0x004012a7
0x0040129b
0x00401364
0x00401366
0x00401368
0x0040136a
0x0040136c
0x0040136e
0x0040136e
0x00401370
0x00401372
0x00401373
0x00401375
0x00401377
0x00401379
0x0040137b
0x0040137d
0x0040137f
0x00401381
0x00401383
0x00401383
0x00401385
0x00401387
0x00401389
0x0040138b
0x0040138d
0x00401392
0x00401393
0x00401395
0x00401397
0x0040139d
0x0040139f
0x004013a1
0x004013a3
0x004013a5
0x004013a7
0x004013ae
0x004013b0
0x004013b3
0x004013b5
0x004013b9
0x004013bb
0x004013bd
0x004013bf
0x004013c1
0x004013c3
0x004013c5
0x004013ca
0x004013cb
0x004013cd
0x004013cf
0x004013d4
0x004013d6
0x004013d8
0x004013da
0x004013dc
0x004013de
0x004013e0
0x004013e2
0x004013e3
0x004013e5
0x004013eb
0x004013ed
0x004013ef
0x004013f1
0x004013f3
0x004013f5
0x004013f7
0x004013f9
0x004013fb
0x004013fd
0x004013fe
0x004013ff
0x00401402
0x00401403
0x00401405
0x00401407
0x0040140d
0x0040140f
0x00401411
0x00401413
0x00401415
0x00401417
0x0040141a
0x0040141b
0x0040141d
0x0040141f
0x00401421
0x00401423
0x00401425
0x00401429
0x0040142b
0x0040142d
0x0040142f
0x00401431
0x00401433
0x00401436
0x00401437
0x0040143a
0x0040143b
0x0040143d
0x0040143f
0x00401441
0x00401441
0x00401442
0x00401442
0x00401444
0x00401446
0x00401448
0x0040144a
0x0040144c
0x0040144e
0x00401450
0x00401451
0x00401453
0x00401455
0x00401457
0x00401459
0x0040145b
0x0040145d
0x0040145f
0x00401461
0x00401463
0x00401465
0x00401467
0x00401469
0x0040146b
0x00401471
0x00401474
0x00401476
0x00401476
0x00401478
0x0040147a
0x0040147c
0x0040147e
0x00401480
0x00401482
0x00401484
0x00401486
0x00401488
0x0040148b
0x0040148e
0x0040148e
0x0040148e
0x00401492
0x00401498
0x0040149d
0x0040149f
0x004014a0
0x004014a2
0x004014a4
0x004014a6
0x004014a8
0x004014aa
0x004014ac
0x004014ae
0x004014b0
0x004014b2
0x004014b4
0x004014b6
0x004014b8
0x004014ba
0x004014bc
0x004014be
0x004014c0
0x004014c2
0x004014c4
0x004014c6
0x004014c8
0x004014ca
0x004014cd
0x004014cf
0x004014d1
0x004014d3
0x004014d5
0x004014d8
0x004014d9
0x004014db
0x004014de
0x004014e0
0x004014e2
0x004014e3
0x004014e6
0x004014ea
0x004014ee
0x004014ef
0x004014f0
0x004014f2
0x004014f4
0x004014f6
0x004014f8
0x004014fa
0x004014fc
0x004014fe
0x00401500
0x00401502
0x00401504
0x00401506
0x00401508
0x0040150a
0x0040150c
0x0040150e
0x00401510
0x00401512
0x00401514
0x00401516
0x00401518
0x0040151a
0x0040151c
0x0040151d
0x0040151f
0x00401521
0x00401523
0x0040152a
0x0040152c
0x0040152d
0x0040152e
0x00401533
0x00401535
0x00401537
0x00401539
0x0040153b
0x0040153d
0x0040153f
0x00401542
0x00401544
0x00401546
0x00401548
0x0040154a
0x0040154c
0x00401550
0x00401552
0x00401554
0x00401556
0x00401558
0x0040155a
0x0040155e
0x0040155f
0x00401563
0x00401565
0x00401567
0x00401569
0x0040156b
0x0040156d
0x0040156f
0x0040156f
0x00401570
0x00401572
0x00401574
0x00401579
0x0040157b
0x0040157e
0x0040157f
0x00401586
0x00401588
0x0040158e
0x00401590
0x00401590
0x00401591
0x00401593
0x00401595
0x00401597
0x00401599
0x0040159b
0x0040159d
0x0040159f
0x004015a1
0x004015a3
0x004015a3
0x004015a3
0x004015a6
0x0040160d
0x0040160d
0x00401610
0x00401612
0x00401615
0x00401616
0x00401617
0x00401619
0x0040161b
0x0040161e
0x0040161f
0x00401621
0x00401623
0x00401623
0x00401623
0x00000000
0x004015a8
0x004015a8
0x004015a9
0x004015ad
0x004015ae
0x004015b3
0x00401625
0x00401625
0x00401626
0x00401627
0x00401629
0x0040162b
0x0040162e
0x0040162f
0x00401631
0x00401637
0x0040163a
0x0040163b
0x0040163b
0x0040163b
0x004015b5
0x004015b5
0x004015b6
0x004015c1
0x004015c1
0x004015c9
0x004015cc
0x004015d3
0x004015d5
0x004015d7
0x004015d9
0x004015db
0x004015de
0x004015df
0x004015e1
0x004015e3
0x004015e5
0x004015e7
0x004015ea
0x004015eb
0x004015ee
0x004015ef
0x004015f1
0x004015f3
0x004015f9
0x004015fb
0x004015fd
0x004015ff
0x00401601
0x00401603
0x00401606
0x00401607
0x00401609
0x0040160b
0x0040160b
0x0040160b
0x00000000
0x0040160b
0x004015c9
0x004015b3
0x00401640
0x00401642
0x00401642
0x00401644
0x00401646
0x00401648
0x0040166b
0x0040166b
0x0040166b
0x0040166b
0x0040166e
0x00401670
0x00401671
0x00401674
0x00401676
0x00401678
0x0040167a
0x0040167c
0x0040167d
0x0040167f
0x0040167f
0x0040164a
0x0040164a
0x0040164b
0x00401651
0x00401653
0x00401656
0x00401658
0x00401659
0x0040165c
0x0040165e
0x00401660
0x00401662
0x00401664
0x00401666
0x00401666
0x00401668
0x0040166a
0x0040166a
0x00000000
0x0040166a
0x00401668
0x00401680
0x00401686
0x00401687
0x0040168d
0x00401690
0x00401692
0x00401694
0x00401696
0x00401698
0x0040169a
0x0040169c
0x0040169e
0x004016a0
0x004016a2
0x004016a4
0x004016a6
0x004016a8
0x004016aa
0x004016ac
0x004016ae
0x004016b0
0x004016b2
0x004016b4
0x004016b6
0x004016b8
0x004016ba
0x004016bc
0x004016be
0x004016c0
0x004016c2
0x004016c4
0x004016c6
0x004016c8
0x004016ca
0x004016cc
0x004016ce
0x004016d0
0x004016d2
0x004016d4
0x004016d6
0x004016d8
0x004016da
0x004016dc
0x004016de
0x004016e0
0x004016e2
0x004016e4
0x004016e6
0x004016e8
0x004016ea
0x004016ec
0x004016ee
0x004016f0
0x004016f2
0x004016f4
0x004016f6
0x004016f8
0x004016fa
0x004016fc
0x004016fe
0x00401700
0x00401702
0x00401704
0x00401706
0x00401708
0x0040170a
0x0040170c
0x0040170d
0x0040170f
0x00401711
0x00401713
0x00401715
0x00401719
0x0040171e
0x0040171f
0x00401725
0x00401728
0x0040172a
0x0040172b
0x0040172d
0x00401730
0x00401732
0x00401734
0x00401736
0x00401738
0x0040173a
0x0040173c
0x0040173e
0x00401740
0x00401742
0x00401744
0x00401746
0x00401748
0x0040174a
0x0040174c
0x0040174e
0x00401750
0x00401752
0x00401754
0x00401756
0x00401758
0x0040175a
0x0040175c
0x0040175e
0x00401760
0x00401762
0x00401764
0x00401766
0x00401768
0x0040176a
0x0040176c
0x0040176e
0x00401770
0x00401772
0x00401774
0x00401776
0x00401778
0x0040177a
0x0040177c
0x0040177e
0x00401780
0x00401782
0x00401784
0x00401786
0x00401788
0x0040178a
0x0040178c
0x0040178e
0x00401790
0x00401792
0x00401794
0x00401796
0x00401798
0x0040179a
0x0040179c
0x0040179e
0x004017a0
0x004017a2
0x004017a4
0x004017a6
0x004017a8
0x004017aa
0x004017ac
0x004017ae
0x004017b0
0x004017b2
0x004017b4
0x004017b6
0x004017b8
0x004017ba
0x004017bc
0x004017be
0x004017c0
0x004017c2
0x004017c4
0x004017c6
0x004017c8
0x004017ca
0x004017cc
0x004017ce
0x004017d0
0x004017d2
0x004017d4
0x004017d6
0x004017d8
0x004017da
0x004017dc
0x004017de
0x004017e0
0x004017e2
0x004017e4
0x004017e6
0x004017e8
0x004017ea
0x004017ec
0x004017ee
0x004017f0
0x004017f2
0x004017f4
0x004017f6
0x004017f8
0x004017fa
0x004017fc
0x004017fe
0x00401800
0x00401802
0x00401804
0x00401806
0x00401808
0x0040180a
0x0040180c
0x0040180e
0x00401810
0x00401812
0x00401814
0x00401816
0x00401818
0x0040181a
0x0040181c
0x0040181e
0x00401820
0x00401822
0x00401824
0x00401826
0x00401828
0x0040182a
0x0040182c
0x0040182e
0x00401830
0x00401832
0x00401834
0x00401836
0x00401838
0x0040183a
0x0040183c
0x0040183e
0x00401840
0x00401842
0x00401844
0x00401846
0x00401848
0x0040184a
0x0040184c
0x0040184e
0x00401850
0x00401852
0x00401854
0x00401856
0x00401858
0x0040185a
0x0040185c
0x0040185e
0x00401860
0x00401862
0x00401864
0x00401866
0x00401868
0x0040186a
0x0040186c
0x0040186e
0x00401870
0x00401872
0x00401874
0x00401876
0x00401878
0x0040187a
0x0040187c
0x0040187e
0x00401880
0x00401882
0x00401884
0x00401886
0x00401888
0x0040188a
0x0040188c
0x0040188e
0x00401890
0x00401892
0x00401894
0x00401896
0x00401898
0x0040189a
0x0040189c
0x0040189e
0x004018a0
0x004018a2
0x004018a4
0x004018a6
0x004018a8
0x004018aa
0x004018ac
0x004018ae
0x004018b0
0x004018b2
0x004018b4
0x004018b6
0x004018b8
0x004018ba
0x004018bc
0x004018be
0x004018c0
0x004018c2
0x004018c4
0x004018c6
0x004018c8
0x004018ca
0x004018cc
0x004018ce
0x004018d0
0x004018d2
0x004018d4
0x004018d6
0x004018d8
0x004018da
0x004018dc
0x004018de
0x004018e0
0x004018e2
0x004018e4
0x004018e6
0x004018e8
0x004018ea
0x004018ec
0x004018ee
0x004018f0
0x004018f2
0x004018f4
0x004018f6
0x004018f8
0x004018fa
0x004018fc
0x004018fe
0x00401900
0x00401902
0x00401904
0x00401906
0x00401908
0x0040190a
0x0040190c
0x0040190e
0x00401910
0x00401912
0x00401914
0x00401916
0x00401918
0x0040191a
0x0040191c
0x0040191e
0x00401920
0x00401922
0x00401924
0x00401926
0x00401928
0x0040192a
0x0040192c
0x0040192e
0x00401930
0x00401932
0x00401934
0x00401936
0x00401938
0x0040193a
0x0040193c
0x0040193e
0x00401942
0x00401943
0x00401945
0x00401947
0x00401949
0x0040194b
0x0040194d
0x0040194f
0x00401951
0x00401953
0x00401955
0x0040195a
0x0040195c
0x0040195e
0x00401960
0x00401966
0x00401967
0x00401969
0x0040196b
0x0040196b
0x0040196d
0x0040196f
0x00401971
0x00401973
0x00401975
0x00401977
0x00401979
0x0040197b
0x0040197d
0x00401980
0x00401982
0x00401984
0x00401986
0x00401987
0x00401989
0x0040198b
0x0040198d
0x00401990
0x00401992
0x00401994
0x00401998
0x0040199a
0x0040199c
0x0040199e
0x0040199f
0x004019a5
0x004019a8
0x004019aa
0x004019ac
0x004019b1
0x004019b4
0x004019b6
0x004019b7
0x004019b9
0x004019bb
0x004019bb
0x004019bb
0x004019be
0x004019c0
0x004019c2
0x004019c3
0x004019ca
0x004019ce
0x004019d1
0x004019d2
0x004019d3
0x004019d5
0x004019d7
0x004019d9
0x004019db
0x004019dd
0x004019df
0x004019df
0x004019df
0x004019df
0x004019e1
0x004019e5
0x004019e7
0x004019e7
0x004019e7
0x004019e8
0x004019e9
0x004019ea
0x004019eb
0x004019eb
0x004019eb
0x004019f0
0x004019f1
0x004019f3
0x004019f5
0x004019f7
0x004019fe
0x00401a00
0x00401a02
0x00401a04
0x00401a06
0x00401a08
0x00401a09
0x00401a0f
0x00401a12
0x00401a13
0x00401a15
0x00401a17
0x00401a1a
0x00401a1c
0x00401a1e
0x00401a22
0x00401a23
0x00401a26
0x00401a28
0x00401a2a
0x00401a2c
0x00401a2e
0x00401a30
0x00401a31
0x00401a34
0x00401a37
0x00401a3a
0x00401a3b
0x00401a40
0x00401a41
0x00401a43
0x00401a46
0x00401a48
0x00401a49
0x00401a4c
0x00401a4e
0x00401a50
0x00401a52
0x00401a54
0x00401a56
0x00401a58
0x00401a5a
0x00401a5b
0x00401a5b
0x00401a5b
0x00401a5e
0x00401a61
0x00401a64
0x00401a66
0x00401a68
0x00401a69
0x00401a6b
0x00401a6f
0x00401a76
0x00401a78
0x00401a7a
0x00401a7c
0x00401a7e
0x00401a87
0x00401a8b
0x00401a8d
0x00401a8f
0x00401a91
0x00401a93
0x00401a95
0x00401a99
0x00401a9c
0x00401a9d
0x00401aa0
0x00401aa3
0x00401aa9
0x00401aac
0x00401aae
0x00401ab0
0x00401ab2
0x00401ab4
0x00401ab6
0x00401ab8
0x00401aba
0x00401abc
0x00401abe
0x00401ac0
0x00401ac2
0x00401ac4
0x00401ac6
0x00401ac8
0x00401aca
0x00401acc
0x00401ace
0x00401ad0
0x00401ad2
0x00401ad4
0x00401ad6
0x00401ad8
0x00401ada
0x00401adc
0x00401ade
0x00401ae0
0x00401ae2
0x00401ae4
0x00401ae6
0x00401ae8
0x00401aea
0x00401aec
0x00401aee
0x00401af0
0x00401af2
0x00401af4
0x00401af6
0x00401af8
0x00401afa
0x00401afc
0x00401b00
0x00401b01
0x00401b04
0x00401b07
0x00401b0d
0x00401b10
0x00401b12
0x00401b14
0x00401b16
0x00401b18
0x00401b1a
0x00401b1c
0x00401b1e
0x00401b20
0x00401b22
0x00401b24
0x00401b26
0x00401b28
0x00401b2a
0x00401b2c
0x00401b2e
0x00401b30
0x00401b32
0x00401b34
0x00401b36
0x00401b38
0x00401b3a
0x00401b3c
0x00401b3e
0x00401b40
0x00401b42
0x00401b44
0x00401b46
0x00401b48
0x00401b4a
0x00401b4c
0x00401b4e
0x00401b50
0x00401b52
0x00401b54
0x00401b56
0x00401b58
0x00401b5a
0x00401b5c
0x00401b5e
0x00401b60
0x00401b62
0x00401b63
0x00401b66
0x00401b67
0x00401b6d
0x00401b70
0x00401b72
0x00401b73
0x00401b75
0x00401b77
0x00401b79
0x00401b7b
0x00401b7d
0x00401b7f
0x00401b81
0x00401b83
0x00401b85
0x00401b87
0x00401b89
0x00401b8b
0x00401b8d
0x00401b8f
0x00401b91
0x00401b93
0x00401b95
0x00401b97
0x00401b99
0x00401b9b
0x00401b9d
0x00401b9f
0x00401ba1
0x00401ba3
0x00401ba5
0x00401ba7
0x00401ba9
0x00401bab
0x00401bad
0x00401baf
0x00401bb1
0x00401bb3
0x00401bb5
0x00401bb7
0x00401bb9
0x00401bbb
0x00401bbd
0x00401bbf
0x00401bc1
0x00401bc3
0x00401bc5
0x00401bc7
0x00401bc9
0x00401bcb
0x00401bcd
0x00401bcf
0x00401bd1
0x00401bd3
0x00401bd5
0x00401bd7
0x00401bda
0x00401bdb
0x00401bde
0x00401bdf
0x00401be5
0x00401be8
0x00401bea
0x00401beb
0x00401bed
0x00401bef
0x00401bf1
0x00401bf3
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfb
0x00401bfd
0x00401bff
0x00401c01
0x00401c03
0x00401c05
0x00401c07
0x00401c09
0x00401c0b
0x00401c0d
0x00401c0f
0x00401c11
0x00401c13
0x00401c15
0x00401c17
0x00401c19
0x00401c1b
0x00401c1d
0x00401c1f
0x00401c21
0x00401c23
0x00401c25
0x00401c27
0x00401c29
0x00401c2b
0x00401c2d
0x00401c2f
0x00401c31
0x00401c33
0x00401c35
0x00401c37
0x00401c39
0x00401c3b
0x00401c3d
0x00401c3f
0x00401c41
0x00401c43
0x00401c45
0x00401c47
0x00401c49
0x00401c4b
0x00401c4d
0x00401c4f
0x00401c51
0x00401c53
0x00401c55
0x00401c57
0x00401c59
0x00401c5b
0x00401c5d
0x00401c5f
0x00401c61
0x00401c63
0x00401c65
0x00401c67
0x00401c69
0x00401c6b
0x00401c6b
0x00401c6b
0x00401c71
0x00401c74
0x00401c77
0x00401c7d
0x00401c80
0x00401c82
0x00401c84
0x00401c86
0x00401c88
0x00401c8a
0x00401c8c
0x00401c8e
0x00401c90
0x00401c92
0x00401c94
0x00401c96
0x00401c98
0x00401c9a
0x00401c9c
0x00401c9e
0x00401ca0
0x00401ca2
0x00401ca4
0x00401ca6
0x00401ca8
0x00401caa
0x00401cac
0x00401cae
0x00401cb0
0x00401cb2
0x00401cb4
0x00401cb6
0x00401cb8
0x00401cba
0x00401cbc
0x00401cbe
0x00401cc0
0x00401cc2
0x00401cc4
0x00401cc6
0x00401cc8
0x00401cca
0x00401ccc
0x004105e7
0x004105f6
0x00410600
0x00410608
0x0041060b
0x00410618
0x00410620
0x0041062b
0x0041062e
0x00410635
0x0041064f
0x00410637
0x00410637
0x0041063c
0x00410641
0x00410646
0x00410646
0x0041065b
0x0041066a
0x0041066d
0x0041066f
0x00410672
0x00410676
0x0041068f
0x0041068f
0x0041068f
0x00410678
0x00410678
0x0041067a
0x0041067f
0x00410682
0x00410685
0x0041068a
0x0041068a
0x00410696
0x004106a5
0x004106a8
0x004106aa
0x004106ad
0x004106b1
0x004106ca
0x004106ca
0x004106ca
0x004106b3
0x004106b3
0x004106b5
0x004106ba
0x004106bd
0x004106c0
0x004106c5
0x004106c5
0x004106d1
0x004106d4
0x004106de
0x004106e6
0x004106f7
0x004106fd
0x004106ff
0x00410702
0x00410706
0x00410722
0x00410722
0x00410722
0x00410708
0x00410708
0x0041070d
0x00410712
0x00410715
0x00410718
0x0041071d
0x0041071d
0x00410726
0x00410728
0x0041072a
0x0041072d
0x00410730
0x00410731
0x00410739
0x0041073a
0x0041073f
0x00410745
0x0041074d
0x00410752
0x00410757
0x0041075e
0x00410781
0x00410789
0x0041078e
0x004011b8
0x004011b8
0x004011b8

APIs

#100.MSVBVM60(VB5!6&*), ref: 0040119D

Strings

VB5!6&*, xrefs: 00401198

Memory Dump Source

Source File: 00000003.00000002.24036576698.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.24036522568.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.24036687091.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.24036753540.0000000000413000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_New Inquiry 903838737777721102029393003938.jbxd

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 4d8cb2d3f81444f5cb99dfa7fd9710e90a9e34f4963007c297919c59f9fe458b
Instruction ID: aa754eb57dd15ec0aef5cc63c44c39ddb5d135e13c13bfd1b46676cc5d04ed35
Opcode Fuzzy Hash: 4d8cb2d3f81444f5cb99dfa7fd9710e90a9e34f4963007c297919c59f9fe458b
Instruction Fuzzy Hash: A2D0A49588E3C22ED3072275082245A3F31095B6A239E41EBD0A0EE8F3E1AC4959C32A

Uniqueness

Uniqueness Score: 1.25%

Non-executed Functions

Function 02240A3F, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.24038739824.0000000002240000.00000040.00000001.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2240000_New Inquiry 903838737777721102029393003938.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2768ccaee01506907b3031a94b546294cf9f301d5795d432e8b2cfca0e0beeb0
Instruction ID: 5dcbdfc15b004cc4b8d83867f7d6d9e8136785e8e9c782f0ed5111fce50e8153
Opcode Fuzzy Hash: 2768ccaee01506907b3031a94b546294cf9f301d5795d432e8b2cfca0e0beeb0
Instruction Fuzzy Hash: 812166725246939FDB278678C8467D0BFE0EB063147195A89C6818F183D31A515BCF82

Uniqueness

Uniqueness Score: 0.00%

Function 02240AA2, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.24038739824.0000000002240000.00000040.00000001.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2240000_New Inquiry 903838737777721102029393003938.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dd1c2e588d1a0c4da992bc5ea56af7046ebaaca36f0d30ddd6c4c4f6cbeac3
Instruction ID: 7723c52281215d0d31817466ecdde85184003831dd462841636116c420a210c9
Opcode Fuzzy Hash: a3dd1c2e588d1a0c4da992bc5ea56af7046ebaaca36f0d30ddd6c4c4f6cbeac3
Instruction Fuzzy Hash: A30178725643938FC7335778C452AC0BBB4EB163187149A98C8D68F193C3181053CF92

Uniqueness

Uniqueness Score: 0.00%

Function 004107AE, Relevance: 6.0, APIs: 4, Instructions: 49
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E004107AE(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v56;
				signed int _v60;
				signed int _t24;
				void* _t25;
				void* _t29;
				intOrPtr _t34;
				void* _t37;

				_t31 = __esi;
				_t30 = __edi;
				_t27 = __ecx;
				_t26 = __ebx;
				_push(__ecx);
				_push(__ecx);
				_push(0x4010c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t34;
				_push(0x28);
				L004010C0();
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = _t34;
				_v8 = 0x4010a8;
				if( *0x411010 != 0) {
					_v56 = 0x411010;
				} else {
					_push(0x411010);
					_push(0x401948);
					L00401174();
					_v56 = 0x411010;
				}
				_v44 =  *_v56;
				_t24 =  *((intOrPtr*)( *_v44 + 0x1bc))(_v44, 0);
				asm("fclex");
				_v48 = _t24;
				if(_v48 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x1bc);
					_push(0x401f54);
					_push(_v44);
					_push(_v48);
					L0040116E();
					_v60 = _t24;
				}
				_t25 = L00402673(_t24, _t26, _t27, _t29, _t30, _t31, _t37);
				_push(E00410859);
				L00401150();
				return _t25;
			}

0x004107ae
0x004107ae
0x004107ae
0x004107ae
0x004107b1
0x004107b2
0x004107b3
0x004107be
0x004107bf
0x004107c6
0x004107c9
0x004107ce
0x004107cf
0x004107d0
0x004107d1
0x004107d4
0x004107e2
0x004107fc
0x004107e4
0x004107e4
0x004107e9
0x004107ee
0x004107f3
0x004107f3
0x00410808
0x00410815
0x0041081b
0x0041081d
0x00410824
0x00410840
0x00410826
0x00410826
0x0041082b
0x00410830
0x00410833
0x00410836
0x0041083b
0x0041083b
0x00410844
0x00410849
0x00410853
0x00410858

APIs

__vbaChkstk.MSVBVM60(00000000,004010C6,?,?,?,00410757,00000000,?,?,?,004010C6), ref: 004107C9
__vbaNew2.MSVBVM60(00401948,00411010,?,?,?,00000000,004010C6,?,?,?,00410757), ref: 004107EE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401F54,000001BC), ref: 00410836
__vbaFreeStr.MSVBVM60(00410859), ref: 00410853

Memory Dump Source

Source File: 00000003.00000002.24036576698.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.24036522568.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.24036687091.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.24036753540.0000000000413000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_New Inquiry 903838737777721102029393003938.jbxd

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID:
API String ID: 4127847336-0
Opcode ID: 9b3847193618ab2bc30815ff975c85f412867dc867ad22866b2cd7a15ab5917b
Instruction ID: 058696c4c43b0ce3c50059c63063b7da128e561d0ec1160893236ba59c8f909c
Opcode Fuzzy Hash: 9b3847193618ab2bc30815ff975c85f412867dc867ad22866b2cd7a15ab5917b
Instruction Fuzzy Hash: CC114870E41248AFDB10EF95C846BDDBBB4EB08754F20442AF100766A0C3BD58C49B68

Uniqueness

Uniqueness Score: 100.00%

Analysis Process: RegAsm.exe PID: 1440 Parent PID: 6652 RegAsm.exeUNIQUE

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	18.4%
Signature Coverage:	50.6%
Total number of Nodes:	707
Total number of Limit Nodes:	8

Executed Functions

Function 00F005E5, Relevance: 11.5, APIs: 2, Strings: 4, Instructions: 958
nativethreadUNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(00F00613,?,00000000,00F0643A,00F05F92,?,00F031E6,?,?,?,?,?,00000000,00000004,00000000,00000000), ref: 00F005F4
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00F00AC8

Strings

249E, xrefs: 00F05A6E
shell32, xrefs: 00F05F1D
249E, xrefs: 00F05A84
1.!T, xrefs: 00F00AA4

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T$249E$249E$shell32
API String ID: 1954852945-4191954164
Opcode ID: ef336fe1ccbfa999da492ee3b533c1c2b5a0f666d657459043e314add5ecdc56
Instruction ID: 63585eaced13dddedab5cf431a785117f0380d6aeaeed29a62a87e52cae622cf
Opcode Fuzzy Hash: ef336fe1ccbfa999da492ee3b533c1c2b5a0f666d657459043e314add5ecdc56
Instruction Fuzzy Hash: F152F393E1E9143BD6A05D29FCE239BA2E65751310BB4D2099E519F78FE7ACF80253C0

Uniqueness

Uniqueness Score: 100.00%

Function 00F016BE, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 558
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.!T, xrefs: 00F00AA4

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 1.!T
API String ID: 0-3147410236
Opcode ID: f37ffea9538b30e627322f44a590c35cec46f9b9056e11cc572dd1554f423dad
Instruction ID: 175aa7b91d0f3a392c5fab84139d926a31f1eda7c46d742b1964759715f87559
Opcode Fuzzy Hash: f37ffea9538b30e627322f44a590c35cec46f9b9056e11cc572dd1554f423dad
Instruction Fuzzy Hash: BA023571B40309AFEF305E64CC96BDA3767AF46750F644128FE849B1C1CBB99889BB10

Uniqueness

Uniqueness Score: 100.00%

Function 00F00631, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 486
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F081CF: LoadLibraryA.KERNEL32(?,B769339E,?,00F00A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00F004BD,00000000), ref: 00F0822B

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00F00AC8

Strings

1.!T, xrefs: 00F00AA4

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: 075b58a0557ade9534a3dec0b9382b3f104376bb3c31c7d4d482421de13dbc5e
Instruction ID: e484142993a572a07505ebc82e0b781c011902aa697f42112058c028315f2482
Opcode Fuzzy Hash: 075b58a0557ade9534a3dec0b9382b3f104376bb3c31c7d4d482421de13dbc5e
Instruction Fuzzy Hash: 89E1DA93E1E5147FE6A04D29E8E23AEA2D20750350FB8D1099E51AF78DE7ACFC4653C0

Uniqueness

Uniqueness Score: 1.91%

Function 00F011F0, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 295
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00F00AC8

Strings

1.!T, xrefs: 00F00AA4

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: be423587d4f69cb26d68848b99c0aff552a16ecf015ed77986f47de5f307b8fb
Instruction ID: 6a1a5d4619e0ffb2d2eab1a66888287c63953659477df0ad3e059f9f1b4dc970
Opcode Fuzzy Hash: be423587d4f69cb26d68848b99c0aff552a16ecf015ed77986f47de5f307b8fb
Instruction Fuzzy Hash: 43915974B40305AFEF306EA48C96BDA3753AF427A0F64411AFD85971C1DFB9C886B612

Uniqueness

Uniqueness Score: 1.91%

Function 00F01719, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 290
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00F00AC8

Strings

1.!T, xrefs: 00F00AA4

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: ae82644baae1b2402e6816c366610ef02a75366e36d6af6e31ebde68cc31dee5
Instruction ID: 4ed075508648dfc69010a51a4d5c1dc89fa5b8b2f17082b610cd0c417b48bb02
Opcode Fuzzy Hash: ae82644baae1b2402e6816c366610ef02a75366e36d6af6e31ebde68cc31dee5
Instruction Fuzzy Hash: D1918970F40305AAFF306E64CC96BDA3653AF867A0F640129FD84971C1DFB89C8AB615

Uniqueness

Uniqueness Score: 1.91%

Function 00F00629, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 234
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F081CF: LoadLibraryA.KERNEL32(?,B769339E,?,00F00A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00F004BD,00000000), ref: 00F0822B

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00F00AC8

Strings

1.!T, xrefs: 00F00AA4

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: 26056ae46e39905a1e3d51aefb313d98131d031c7a56edcbf01291416ea960fa
Instruction ID: 32c78f095d7919bba1b5574ebcc4dc73269df6708b387c3671adfac56e085aba
Opcode Fuzzy Hash: 26056ae46e39905a1e3d51aefb313d98131d031c7a56edcbf01291416ea960fa
Instruction Fuzzy Hash: 69614970F40305AAEF306A648CD6BDA36526F417A0F64412AFD85971C1CFBCD88AB615

Uniqueness

Uniqueness Score: 1.91%

Function 00F00A7A, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 219
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00F00AC8

Part of subcall function 00F081CF: LoadLibraryA.KERNEL32(?,B769339E,?,00F00A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00F004BD,00000000), ref: 00F0822B

Strings

1.!T, xrefs: 00F00AA4

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: 4d18b91f56fdd8792a63588e8d1d224e2a450ae394e87829301782603fa06be9
Instruction ID: 1cbba4a89c3b6965a055aa8ba7aa60d661366358a7d3dd82717cc610d90fd020
Opcode Fuzzy Hash: 4d18b91f56fdd8792a63588e8d1d224e2a450ae394e87829301782603fa06be9
Instruction Fuzzy Hash: 02516A70F40305AAFF345A649CD6BDA37066F427A0F68012AFD85971C1CFA9D88AB612

Uniqueness

Uniqueness Score: 1.91%

Function 00F09EF3, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.!T, xrefs: 00F00AA4

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 1.!T
API String ID: 0-3147410236
Opcode ID: 3354b6e6c4ee9e5599cef383cbfd7b4a2cffadf4d1ffec653b6aa3ce2308c8d6
Instruction ID: fd6834105e18a59f9c6097c6cc47e15d9afe35ba0a9b0b383f7876e65cd5e817
Opcode Fuzzy Hash: 3354b6e6c4ee9e5599cef383cbfd7b4a2cffadf4d1ffec653b6aa3ce2308c8d6
Instruction Fuzzy Hash: 66210AB5B40306AEEF30AE748D61BDD36C28F84760FB48126BE416B2C4DE78D8437615

Uniqueness

Uniqueness Score: 100.00%

Function 00F02A91, Relevance: 3.1, APIs: 2, Instructions: 106
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000800,?,00000000,00000011,00000000,00000000,?,00000000,00000000,Function_0000A810,00000000,00000000,00000000), ref: 00F02B2E

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cb8104912665ef0133ece89a500bfd49e73c1bea20618522217c05156157e0d2
Instruction ID: ff4b9686de0e36174efe990d10fbca71da5eaae0867dd9c4588638afa4014297
Opcode Fuzzy Hash: cb8104912665ef0133ece89a500bfd49e73c1bea20618522217c05156157e0d2
Instruction Fuzzy Hash: 2A3101B0604301AFEB246E24CD4DBE873A2BF017A4F544248EE519B0D2DBB4D880EA11

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE1E1E, Relevance: 2.8, Strings: 2, Instructions: 324
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+, xrefs: 1FEE241D
^7, xrefs: 1FEE203A

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID: +$^7
API String ID: 0-4122397898
Opcode ID: d139511b3c7a85fdccb8993fb85b391b2a713777d4256932a2e5b12485ed7cbb
Instruction ID: ede169dc9619c7640135b743b03d3795acaacb2ba50d461f7b177e4ffaf0aebb
Opcode Fuzzy Hash: d139511b3c7a85fdccb8993fb85b391b2a713777d4256932a2e5b12485ed7cbb
Instruction Fuzzy Hash: 1EE15FB0D00219CFEB14CFA8E99479DBBB2FF84354F208229E416AB396D775A945CF11

Uniqueness

Uniqueness Score: 100.00%

Function 204F2A5B, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 204F2ADB

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: bb42e42a53dfca5094beef99908e408b1d8ab597f3182577064dcb31458deb7d
Instruction ID: 29b691a787cf08ce38b5f1a02350ef07e557fcb4bd97e131887ed07332cb02e7
Opcode Fuzzy Hash: bb42e42a53dfca5094beef99908e408b1d8ab597f3182577064dcb31458deb7d
Instruction Fuzzy Hash: E021AE76509784AFDB128F65DC44B52BFB4EF06310F0884DAED858B263D375E918CBA2

Uniqueness

Uniqueness Score: 0.18%

Function 204F2C97, Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 204F2D0D

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: ef743420c98d905ddf9180b47d33a44eab3fb6e2b290532216873debf0d2ba71
Instruction ID: 4ae86b3853a2899bb06e79352c26c1d01a203b80d44b8c9d56ec23e74d5ec2ad
Opcode Fuzzy Hash: ef743420c98d905ddf9180b47d33a44eab3fb6e2b290532216873debf0d2ba71
Instruction Fuzzy Hash: 83219D754097C4AFD7128B20DC45A52FFB0EF17214F0984CBED848B1A3D2699A19DB62

Uniqueness

Uniqueness Score: 0.01%

Function 204F2A92, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 204F2ADB

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: a93428845387b635967f6f3ada0f32a0c43506b78d5f27ab44f7614fe49641b4
Instruction ID: 420ed5a67dfff93129594929bd6400b67a388f0ad44a823c96b03687717e9adb
Opcode Fuzzy Hash: a93428845387b635967f6f3ada0f32a0c43506b78d5f27ab44f7614fe49641b4
Instruction Fuzzy Hash: 3111A0356003449FDB20CF95D988B56FBE4EF04220F08C4AADD498B652D779E918DFA2

Uniqueness

Uniqueness Score: 0.18%

Function 204F2CD2, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 204F2D0D

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 1f069f753299cbe68ed6896889a1ef4be9200b85a25bc6b642fe18a9296ef1ec
Instruction ID: 4fe4cc912dccf024f674e50bc5cd15fd180c4c0e71ca5b6ffe973128192c331c
Opcode Fuzzy Hash: 1f069f753299cbe68ed6896889a1ef4be9200b85a25bc6b642fe18a9296ef1ec
Instruction Fuzzy Hash: 0601AD355006449FEB20CF45D988B52FFA0EF44320F18C49ADD894B712C37AE918DFA2

Uniqueness

Uniqueness Score: 0.01%

Function 00F09B4C, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,00F09515,00000040,00F00A94,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F09B65

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032

Uniqueness

Uniqueness Score: 0.03%

Function 1FEE1850, Relevance: 5.2, Strings: 4, Instructions: 201
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JJ, xrefs: 1FEE199D
uV_V^, xrefs: 1FEE1924
V_V^, xrefs: 1FEE1A8D
EV_V^, xrefs: 1FEE18BB

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID: JJ$EV_V^$uV_V^$V_V^
API String ID: 0-2967845765
Opcode ID: ce512fe6a5d4d8dc32d0014a45f3ba01b0775d15d83fcdc3e713e635d2b324b5
Instruction ID: c6391741812328c3ecd9b0556eddf294eac491afe31ad50236bcda37aa8bd4f5
Opcode Fuzzy Hash: ce512fe6a5d4d8dc32d0014a45f3ba01b0775d15d83fcdc3e713e635d2b324b5
Instruction Fuzzy Hash: E98175B0A00204CFDB10EFB9C4946EDBBF2AB85304F508959D057AB391DB7AA945CF96

Uniqueness

Uniqueness Score: 100.00%

Function 00F052B9, Relevance: 3.1, APIs: 2, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00F05AC4,00000000,00000000,00000000,00000000,00F0124E,00000000,00000000,00000000,00000000,0000006D,0000020C,?,00F05A48,00000000,000000FF), ref: 00F052C9
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,00000004,00000000,?,00000000), ref: 00F0532E

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: bc5163e42e9add266c6683ac9f16a41edb28294c7a844079115d7c557696cb88
Instruction ID: 820cde72d2ab3fb4074ef3521dbc317c3ba4fb1654814bf29179b312da00da35
Opcode Fuzzy Hash: bc5163e42e9add266c6683ac9f16a41edb28294c7a844079115d7c557696cb88
Instruction Fuzzy Hash: 7131613024438AEBEF358E64CD55BEE3666AF04740F508029FD4E9A1D1E7B19984FF20

Uniqueness

Uniqueness Score: 4.01%

Function 1FEE2638, Relevance: 2.7, Strings: 2, Instructions: 171
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

T_V^, xrefs: 1FEE2747
5U_V^, xrefs: 1FEE27EA

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID: 5U_V^$T_V^
API String ID: 0-1992429273
Opcode ID: bee9347ee2fa5de8214e89284e6c930c9c0f26377a861ffb17b6aef32689411c
Instruction ID: b93b1080946594afe713e27d790d222513157da45afffbee66e37e96e5636c13
Opcode Fuzzy Hash: bee9347ee2fa5de8214e89284e6c930c9c0f26377a861ffb17b6aef32689411c
Instruction Fuzzy Hash: 0E61BF31B002108FD704EF38D9A479D37E2BBC5714F6589A8D0079F392DB76A946CB92

Uniqueness

Uniqueness Score: 100.00%

Function 1FEE262B, Relevance: 2.6, Strings: 2, Instructions: 129
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

T_V^, xrefs: 1FEE2747
5U_V^, xrefs: 1FEE27EA

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID: 5U_V^$T_V^
API String ID: 0-1992429273
Opcode ID: e013de02c33803ac0cbdb02898b77b9a2ed51601010130128044a542bb8cecab
Instruction ID: ebbe4e09f8a3dcf9383f18c16b49d26bb16692a0e00208406f5c9dc1829e8c5a
Opcode Fuzzy Hash: e013de02c33803ac0cbdb02898b77b9a2ed51601010130128044a542bb8cecab
Instruction Fuzzy Hash: F541EF71A002608FD704EF38C49576D7BB2AB86314F6585ACD40B9F382CB76EC46CB92

Uniqueness

Uniqueness Score: 100.00%

Function 00F017CE, Relevance: 1.9, APIs: 1, Instructions: 369
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNEL32(80000001,00F068D8,00000000,00000000,00000000,000F003F,00000000,?,?,00F01137,?,?,00000000,00000000,000000FF,00000007), ref: 00F017FE

Part of subcall function 00F01820: RegSetValueExA.KERNEL32(?,00F068C2,00000000,00000001,?,?,?,?,?,?,00F01137,?,?,00000000,00000000,000000FF), ref: 00F01831

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateValue
String ID:
API String ID: 2259555733-0
Opcode ID: d9f395971c2ca6145ebf6f93edd2d5dc9cf51339c3d344746328083a87b90d0b
Instruction ID: df3224735ee7695bd37039545709cca4ab766c42fb1b294b847f88a9515ba62f
Opcode Fuzzy Hash: d9f395971c2ca6145ebf6f93edd2d5dc9cf51339c3d344746328083a87b90d0b
Instruction Fuzzy Hash: 20C17AD3D1E5543FA2A18D29E9A23AEE6E117613007B8D2498E519FB8EF36CFC0153C1

Uniqueness

Uniqueness Score: 0.14%

Function 00F09F12, Relevance: 1.8, APIs: 1, Instructions: 335filenativethreadUNIQUE

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00F00AC8
CreateFileW.KERNEL32(?,?,?,?,000000C0,?,?,00000000,?,00F004BD,00000000), ref: 00F0A7D8

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateFileInformationThread
String ID:
API String ID: 2580995559-0
Opcode ID: 00133cc32faff595a26c4de06b7b911790b2ec6a7b4a7baf7a59f1db3d213b15
Instruction ID: 93f3d983b54c90a45d90d3c3588df8f13f782939a1eb41f3a165c06ca607a7be
Opcode Fuzzy Hash: 00133cc32faff595a26c4de06b7b911790b2ec6a7b4a7baf7a59f1db3d213b15
Instruction Fuzzy Hash: 11B1E693E1E5156FA6A49D2DE8D13AFA2E257A03107F8D1188E119F78DE3ACFC4253C1

Uniqueness

Uniqueness Score: 100.00%

Function 00F0A30D, Relevance: 1.8, APIs: 1, Instructions: 329filenativethreadUNIQUE

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00F00AC8
CreateFileW.KERNEL32(?,?,?,?,000000C0,?,?,00000000,?,00F004BD,00000000), ref: 00F0A7D8

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateFileInformationThread
String ID:
API String ID: 2580995559-0
Opcode ID: be58969baf69663eeee644a64fb9ef284b25a6643e8ecf1cff3a39de77eeaf43
Instruction ID: 5aa26fa036ad608adecce74571da29aa50c6d554b1c172716bed1ecb92adb548
Opcode Fuzzy Hash: be58969baf69663eeee644a64fb9ef284b25a6643e8ecf1cff3a39de77eeaf43
Instruction Fuzzy Hash: 2CB1E893E1E5156FA6A48D2DE8D13AFA2E257A03107F8D1188E119F78DE3ACFC4253C1

Uniqueness

Uniqueness Score: 100.00%

Function 00F02B50, Relevance: 1.8, APIs: 1, Instructions: 275threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(000000FE,00000000), ref: 00F02F78

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 6670c59fd34363fb74b30b30c27a4bf1a5391331b13fca0eaddc9fd4ae2d1e1f
Instruction ID: 588ba526f6859e4ed735627b89a88120e583cf20e1c4f6089979a1b07c4b1a50
Opcode Fuzzy Hash: 6670c59fd34363fb74b30b30c27a4bf1a5391331b13fca0eaddc9fd4ae2d1e1f
Instruction Fuzzy Hash: 32913393E5E5183F66A04C2DF8A67AEA2E243907007F4D2049F126F78DF3ACBC4206C0

Uniqueness

Uniqueness Score: 1.31%

Function 1DB1A686, Relevance: 1.6, APIs: 1, Instructions: 97registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EB4), ref: 1DB1A731

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: eba814ec7f4b3e92fc02a618638aea8c89830aed828184392d121930831640f3
Instruction ID: e51fef598bcf34ee980d52231238bb77c4f911b710c97a9876bf649b0de857a9
Opcode Fuzzy Hash: eba814ec7f4b3e92fc02a618638aea8c89830aed828184392d121930831640f3
Instruction Fuzzy Hash: 8D31B0B10093806FE7128B649C84FA7FFB8EF06210F08859BE985DB193D224A909C761

Uniqueness

Uniqueness Score: 0.01%

Function 1DB1BC1A, Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1DB1BCBF

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 29408ef27eadf676ecd10efe29dbd220d22ea5ad1f5f99b447db4fa0db002479
Instruction ID: d0f5fc20d16eb3d436a5fa669e67462fd694254eff46821cc2738a9e1c1c6fa5
Opcode Fuzzy Hash: 29408ef27eadf676ecd10efe29dbd220d22ea5ad1f5f99b447db4fa0db002479
Instruction Fuzzy Hash: B931367150E3C19FD7038B759865A92BFB49F03220B0E84EBD885CF1A3D6689849CB72

Uniqueness

Uniqueness Score: 0.03%

Function 204F0CAF, Relevance: 1.6, APIs: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 204F0D6A

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: f4063259004a132ed2c595b8f3f74895f817687fcb35110f2ec8213bd6aebf13
Instruction ID: f1dfff9c332c0f951c719f6193e8576c74ae28f3e5560dfaa50c4bf4d14af43d
Opcode Fuzzy Hash: f4063259004a132ed2c595b8f3f74895f817687fcb35110f2ec8213bd6aebf13
Instruction Fuzzy Hash: AA31A1715097C0AFE7138B60DC54B52BFB4EF47210F0884DAE9858F2A3C369A908CB62

Uniqueness

Uniqueness Score: 0.34%

Function 00F093ED, Relevance: 1.6, APIs: 1, Instructions: 94libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,B769339E,?,00F00A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00F004BD,00000000), ref: 00F0822B

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 75225bba369b5256672b6e8c27de006746047b5c26f70e36a30c11dd7c9d6c16
Instruction ID: f1b80b91cd7e37bc29872323b04103e3c0bd7e8d6d7d4b748be8016babe91a36
Opcode Fuzzy Hash: 75225bba369b5256672b6e8c27de006746047b5c26f70e36a30c11dd7c9d6c16
Instruction Fuzzy Hash: 5F214E74A043075ADB14AE64C9E07F72752AF567A0F94412CFCC587186DB64C847B600

Uniqueness

Uniqueness Score: 0.01%

Function 204F1D9C, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000EB4), ref: 204F1E63

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: b48d83cc5b8df8f7b7cad42e44b38390fbe26ac973970951cd0cfb9665c704f8
Instruction ID: 07c2d5e4e0a374ae32c47fe320b58a6943aa5423d35eef2bbeeb64a4325e379f
Opcode Fuzzy Hash: b48d83cc5b8df8f7b7cad42e44b38390fbe26ac973970951cd0cfb9665c704f8
Instruction Fuzzy Hash: 4F31B1B1500344AFE721DB50CC84FA6FBACEF45310F04859AFA459B192D774AA48CB61

Uniqueness

Uniqueness Score: 0.39%

Function 1DB1AB04, Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 1DB1ABA5

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 65b20f877a98658658b8ac0931475cf76e73a766ba9908bd228feb68ff53d235
Instruction ID: cf9919f712f4755b8a91e7bd9a29c1ec0b6f9f77e2b904680a3a89fb190b61ff
Opcode Fuzzy Hash: 65b20f877a98658658b8ac0931475cf76e73a766ba9908bd228feb68ff53d235
Instruction Fuzzy Hash: FD318BB1504380AFE722CF25DC44B67BBE8EF05620F08849AE9858B252D335E909CB71

Uniqueness

Uniqueness Score: 0.01%

Function 204F1808, Relevance: 1.6, APIs: 1, Instructions: 90timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 204F18A5

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 2a1197e371d659bc757d101097b704bde29d43f4a41a1e64025856a862099b81
Instruction ID: 7f9b31f573b93771f25a0f1a3f204914a8495174e86abd62718b1262022bcd49
Opcode Fuzzy Hash: 2a1197e371d659bc757d101097b704bde29d43f4a41a1e64025856a862099b81
Instruction Fuzzy Hash: DB31D5725097846FE712CF60DC85B96BFB8EF46320F0884DAE985DB163D325A909CB71

Uniqueness

Uniqueness Score: 0.34%

Function 1DB1A779, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 1DB1A834

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 790e7666de8a4c7dc8c07a177f95c8a21e6fb9a1760423fa8b71ab2444a0d115
Instruction ID: 093f94c19135e8b6bd974ae6f08fd81172156843cb772e141b9463b6deb509c5
Opcode Fuzzy Hash: 790e7666de8a4c7dc8c07a177f95c8a21e6fb9a1760423fa8b71ab2444a0d115
Instruction Fuzzy Hash: 7331AF755093846FE722CF21DC84FA3FFE8EF06610F08849AE985CB153D264E549CB61

Uniqueness

Uniqueness Score: 0.02%

Function 204F1104, Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000EB4), ref: 204F119B

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 3ce4836539b7002a2fe906fb3d00845c3e0cbf16cdcecfc98677a57d3f5037ac
Instruction ID: 864fc36995e8eb8659b8b88f4377b4976e782cfe53304b92f76ac90b517ac08c
Opcode Fuzzy Hash: 3ce4836539b7002a2fe906fb3d00845c3e0cbf16cdcecfc98677a57d3f5037ac
Instruction Fuzzy Hash: F931C1B21043846FE712CB64DC85FA7FFB8EF46210F08849AE945DB262D724E908CB61

Uniqueness

Uniqueness Score: 0.41%

Function 204F048A, Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 204F0531

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 787cb62086c8c4cf092e805c8489af563c3617a8e0e884c862e9c3a5bf1b107e
Instruction ID: 007ad4eab1eec6838e78044a9a627941ff301bea45af3e015928a545182b3df7
Opcode Fuzzy Hash: 787cb62086c8c4cf092e805c8489af563c3617a8e0e884c862e9c3a5bf1b107e
Instruction Fuzzy Hash: E23191B15093846FE712CB65CC84B96FFF8EF46210F08849AE984CB293D365E908CB61

Uniqueness

Uniqueness Score: 0.03%

Function 204F0588, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000EB4,?,?), ref: 204F063E

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 673e2e72832aaa05f5fa58a07e2c7dbef49c8923df04d08c4138063bfe7fe9e3
Instruction ID: e15de7f2f76ff714523f702c96446e6839048b965380de0a18217552cbeb4e3d
Opcode Fuzzy Hash: 673e2e72832aaa05f5fa58a07e2c7dbef49c8923df04d08c4138063bfe7fe9e3
Instruction Fuzzy Hash: 5C31B97550D3C05FD3038B259C51B62BF78EF47620F0A45DAD8848B553D265A91AC7B2

Uniqueness

Uniqueness Score: 0.60%

Function 204F139C, Relevance: 1.6, APIs: 1, Instructions: 88fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 204F144E

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 3180d1c83261d3bd4e801e9e1382bb458d5fb867fad448bca9389a0cc9540122
Instruction ID: 8349d33f18590ba24fc9da883f3beb9d08c6058366d58d7263f8589a5004b518
Opcode Fuzzy Hash: 3180d1c83261d3bd4e801e9e1382bb458d5fb867fad448bca9389a0cc9540122
Instruction Fuzzy Hash: AF31D3B2405784AFE712CB54DC45F96FFF8EF06320F04859AE9848B263D375A909CB61

Uniqueness

Uniqueness Score: 0.27%

Function 204F0106, Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 204F01A6

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: a3db464e601f723766ca5529509fb48befa10d9077b40df8028b5604f0de2ad2
Instruction ID: 94c1d19415d9db3df3f1b661e8801bdc616f406202957da3b073b772cf7247c0
Opcode Fuzzy Hash: a3db464e601f723766ca5529509fb48befa10d9077b40df8028b5604f0de2ad2
Instruction Fuzzy Hash: 9B318C7150E3C05FD7138B748C59A56BFB4EF43210B0A84DBE885CF2A3D229A909CB32

Uniqueness

Uniqueness Score: 0.24%

Function 204F1DBE, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000EB4), ref: 204F1E63

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: ee4b02a5a2055bd9cb252cd062f26ea49606cb13d02c003f64800fb7b9b0e214
Instruction ID: 233aa6294dcb99010ebff9b19ec01d4d1adeb0addf99846c0f22b8004b9cfc51
Opcode Fuzzy Hash: ee4b02a5a2055bd9cb252cd062f26ea49606cb13d02c003f64800fb7b9b0e214
Instruction Fuzzy Hash: D921D1B1500304AFF721DB54CC88FA6F7ACEF44710F10885AEE499A291DB75AA498B71

Uniqueness

Uniqueness Score: 0.39%

Function 1DB1BED6, Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1DB1BF54

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 161fc5ed7581c514e418b8e2505d1a90b96363a68652d9c32e7156c53d936989
Instruction ID: adf6160a4b05cbf4b096a79afcac7cd00776e3de9a3c0aca2aad942046285cbe
Opcode Fuzzy Hash: 161fc5ed7581c514e418b8e2505d1a90b96363a68652d9c32e7156c53d936989
Instruction Fuzzy Hash: F8316F7550E3C45FD7038B359CA5652BFB49F03224F1D84DBD889CF1A3D269A849CB62

Uniqueness

Uniqueness Score: 0.02%

Function 204F07AB, Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(?,00000EB4), ref: 204F0843

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: OpenPolicy
String ID:
API String ID: 2030686058-0
Opcode ID: 488fba505f0672cfc9697c3cd52c3db341a7003aefc40cb150f867e0b40c001d
Instruction ID: 5457b31df467599563efe1eadf44327146737557314bc9514ac5e0c0964aa749
Opcode Fuzzy Hash: 488fba505f0672cfc9697c3cd52c3db341a7003aefc40cb150f867e0b40c001d
Instruction Fuzzy Hash: 892194B15053846FE721DF64DC84FA6FFB8EF46610F08849AE985DB152D364A908CB61

Uniqueness

Uniqueness Score: 2.12%

Function 1DB1AA34, Relevance: 1.6, APIs: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,?,?), ref: 1DB1AADA

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 829667967c482d7b3e290053db98527feeb33086f7e5c479f088364eecf9364d
Instruction ID: db205963df738bcb65dd37b01d34ef4f347c83feab70d37610633ef95970b118
Opcode Fuzzy Hash: 829667967c482d7b3e290053db98527feeb33086f7e5c479f088364eecf9364d
Instruction Fuzzy Hash: 2F21B5755093C06FD3138B25CC51B62BFB8EF87610F0D85CBE9848B663D225A91AC7B6

Uniqueness

Uniqueness Score: 0.02%

Function 204F2818, Relevance: 1.6, APIs: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(?,00000EB4,?,?), ref: 204F28BA

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 29465fcc2bdaef85341817bd95d83d5e128aa6c605e488ef54f0618853c8fcf0
Instruction ID: 03628755abf4fbdb43ba7a5050aab5a027382df406ab8b30fb08cd21b72b72d2
Opcode Fuzzy Hash: 29465fcc2bdaef85341817bd95d83d5e128aa6c605e488ef54f0618853c8fcf0
Instruction Fuzzy Hash: C321B57190D3C45FD302CB658C51B66BFB4EF87610F0980CBD9848F2A3D624A919C7B2

Uniqueness

Uniqueness Score: 0.07%

Function 204F1912, Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 204F199C

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: a0ac6d6c0ec865a5176b9809c8f4f0eed847a1c7c9af7da8bbed29b126d58835
Instruction ID: 23465440e54e5e6cc763f18f4fabd3c91088519cce3879c27eea1d0f6bf89c85
Opcode Fuzzy Hash: a0ac6d6c0ec865a5176b9809c8f4f0eed847a1c7c9af7da8bbed29b126d58835
Instruction Fuzzy Hash: D321B2B21053846FE722CF61DC85FA7FBACEF45210F04849AE945DB152D364EA48CBB1

Uniqueness

Uniqueness Score: 0.08%

Function 204F12BA, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 204F1345

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 78f4431de3e76463db790a9a6aa99104d398875d853432b2d34b51dfbbb023b2
Instruction ID: 1d5f9fafddfa50bb3a8ad5019d549da4733eb2b1083733f6aa53400be6badfa9
Opcode Fuzzy Hash: 78f4431de3e76463db790a9a6aa99104d398875d853432b2d34b51dfbbb023b2
Instruction Fuzzy Hash: 7B21A1B1505384AFE711CB65CC45F66FFA8EF05220F0884AEED848B292D375E948CB61

Uniqueness

Uniqueness Score: 0.34%

Function 1DB1AB26, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 1DB1ABA5

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3249c5650fa98e326a8bcb6939650275629acb44c2626de43d3a070197263b70
Instruction ID: 3cf16e662a5dff0eb63a7fc44c638bfdb274d6e308fe5a0535bee7551897fe0e
Opcode Fuzzy Hash: 3249c5650fa98e326a8bcb6939650275629acb44c2626de43d3a070197263b70
Instruction Fuzzy Hash: 1B21BDB1600280AFE722DF25DC84F67FBE8EF08620F048569E9498B252D735F509CB72

Uniqueness

Uniqueness Score: 0.01%

Function 204F1012, Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 204F10B0

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: adb2f7af1ff99fecb4a9e62cf9fd1b6448356bd994e4d4d96d2d684051293c81
Instruction ID: 82404a931d0c29a5ee2ebf105e4d042c48b733adf824e0170d83cbb5a94fb72f
Opcode Fuzzy Hash: adb2f7af1ff99fecb4a9e62cf9fd1b6448356bd994e4d4d96d2d684051293c81
Instruction Fuzzy Hash: 4D21A172504384AFE721CF51CC84FA7FFB8EF45210F08859AE9859B2A2D725E948CB61

Uniqueness

Uniqueness Score: 0.02%

Function 204F112A, Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000EB4), ref: 204F119B

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: efbfb4249e74c1cfe070af3d525ba72c60c59f150b700815517d73504c244bc9
Instruction ID: 2a24ee1ad5ae52a281be9319d53433619dc3424ffab6aacb0cb8ffdc42790420
Opcode Fuzzy Hash: efbfb4249e74c1cfe070af3d525ba72c60c59f150b700815517d73504c244bc9
Instruction Fuzzy Hash: BD2104B1600244AFF720DF68DC84FAAFBACEF45210F14C45AED45DB252D634E905CA71

Uniqueness

Uniqueness Score: 0.41%

Function 1DB1AD78, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 1DB1AE09

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ad9532f8338950e6f9f6994c53f5e66efa024abfed2cb56b1628dd4b0caeb105
Instruction ID: e481c9134d18bd2c0c306ff4434808205a958978f5a100b6c52721674cb6e502
Opcode Fuzzy Hash: ad9532f8338950e6f9f6994c53f5e66efa024abfed2cb56b1628dd4b0caeb105
Instruction Fuzzy Hash: 052192725093806FD722CF21DC84FA6FFB8EF46214F08849AE9459F153C225A909CB72

Uniqueness

Uniqueness Score: 0.01%

Function 1DB1A95A, Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 1DB1A9EC

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a4b02ba4d32d351efdffd38d11e8e81176da08ab0fd800f217f07678742d874e
Instruction ID: 652e10ceea0d143a94635eb8e29995c3058c3918c578176f0dbd9dec20aaed1e
Opcode Fuzzy Hash: a4b02ba4d32d351efdffd38d11e8e81176da08ab0fd800f217f07678742d874e
Instruction Fuzzy Hash: 3D2190B21047806FE721CF11DC84FA7FFE8EF45610F04849AE9469B252D264E949CB71

Uniqueness

Uniqueness Score: 0.15%

Function 00F02B4A, Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(000000FE,00000000), ref: 00F02F78

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 7793c82ec79c2428207682b383148305938dfb2e6feb53ae70cce6dc9d2de6ad
Instruction ID: cbde9b2b9c54b2cad6c56e7accc0ea2007323af2c01b5717a54b52c8eb6c69e9
Opcode Fuzzy Hash: 7793c82ec79c2428207682b383148305938dfb2e6feb53ae70cce6dc9d2de6ad
Instruction Fuzzy Hash: C31126B1740301AFEB201E688D89FEA3365DF05764FE00252FE129B1D1D7A4D8C2AA25

Uniqueness

Uniqueness Score: 1.31%

Function 1DB1A6B2, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EB4), ref: 1DB1A731

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e297648b60a11dd998a31c3fa1cb3279dec064ad08b5a50305871972c7b47807
Instruction ID: a8d44dac9e078b9792fe721af5ed16fc960333e20c741ca15c4620d0ef1d382c
Opcode Fuzzy Hash: e297648b60a11dd998a31c3fa1cb3279dec064ad08b5a50305871972c7b47807
Instruction Fuzzy Hash: 1F21CDB2500204AFF721DF54DC84FABFBECEF45620F04855AE9469B252D634E6098AB2

Uniqueness

Uniqueness Score: 0.01%

Function 1DB1B81F, Relevance: 1.6, APIs: 1, Instructions: 74libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EB4), ref: 1DB1B8BF

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4a52d2f73c695358817bb264a9f20f5e36c56878ed46ff34c32b86962c6b4c38
Instruction ID: 1db79b76f8e18fcc0fea5b38c4beea7f35023c402ee5f6f90755b40c700cdb0c
Opcode Fuzzy Hash: 4a52d2f73c695358817bb264a9f20f5e36c56878ed46ff34c32b86962c6b4c38
Instruction Fuzzy Hash: A721DA715453C46FE712CB11DC85BA2FFA8DF42720F0880DAE9859F193D268AA49CB76

Uniqueness

Uniqueness Score: 0.01%

Function 204F204D, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,?), ref: 204F20CA

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 28082c1627735fbf43f471e295606332aee3c9c1021df18786521b2605b66d97
Instruction ID: 1caf90e5a7663f5bd3db2ddcfd3ef5979c3a1fc05d93ef6b11e1e5c13ea8f1df
Opcode Fuzzy Hash: 28082c1627735fbf43f471e295606332aee3c9c1021df18786521b2605b66d97
Instruction Fuzzy Hash: EE21A1755093C45FD712CB24DC54B92BFA4EF47214F0984DAEE848F253D6359908CB71

Uniqueness

Uniqueness Score: 1.51%

Function 1DB1ACB7, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 1DB1AD3D

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: da4543034ba5053069b2e58ec0f5e5af1cf81786277bae6e746426934b23fc46
Instruction ID: 6bca323b3237137e0b74146f16c0ee00471fbcd1d250632ca38fa58d3ffcbadd
Opcode Fuzzy Hash: da4543034ba5053069b2e58ec0f5e5af1cf81786277bae6e746426934b23fc46
Instruction Fuzzy Hash: CB21D8B54097C06FE712CB219C84BA2BFA8DF43710F0880D7E9859F153D264A909C772

Uniqueness

Uniqueness Score: 0.07%

Function 204F07D2, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(?,00000EB4), ref: 204F0843

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: OpenPolicy
String ID:
API String ID: 2030686058-0
Opcode ID: ce0e2416acaad99164f354827dea812fc99b6607f9e99d07d37c528fe819a3fc
Instruction ID: f4ffa75fb36f56872be050f4f75debbf4e311f1c340a443cf5fd8fcfbf23e1f0
Opcode Fuzzy Hash: ce0e2416acaad99164f354827dea812fc99b6607f9e99d07d37c528fe819a3fc
Instruction Fuzzy Hash: E421A1B1500304AFF720EF54DC84FAAFBA8EF95610F14845AED45DA242D778E905CAB1

Uniqueness

Uniqueness Score: 2.12%

Function 204F04BE, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 204F0531

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 3c486cc52149bfa6c1da7c6ca982ca66a6ed0a932909c93bede547444dacb1d0
Instruction ID: 37da4865b54fd15accea0d4c90c909a84757d1cba3a04cdeb149285dee40e5e3
Opcode Fuzzy Hash: 3c486cc52149bfa6c1da7c6ca982ca66a6ed0a932909c93bede547444dacb1d0
Instruction Fuzzy Hash: BC218EB1600244AFE710DF65DC89B56FBE8EF54610F1484AAED48CB242D7B9F908CB75

Uniqueness

Uniqueness Score: 0.03%

Function 1DB1A7BA, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 1DB1A834

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b7931f5651ec0cc06c72940e07e8669b44e8f79ef7f962f3792d4c1c0e533b4a
Instruction ID: 8338ebf532e8fdbd7be7587da471e94424f32a8514a5445c8097e2b972550192
Opcode Fuzzy Hash: b7931f5651ec0cc06c72940e07e8669b44e8f79ef7f962f3792d4c1c0e533b4a
Instruction Fuzzy Hash: BD21C075600200AFE721CF15DC84FA7FBECEF44610F04855AE94ADB252D760F60ACAB2

Uniqueness

Uniqueness Score: 0.02%

Function 204F1932, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 204F199C

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 78f62872125b28b890cbd84e848c71d8151263879275a999eba7272c05823ee5
Instruction ID: bd186910e20acf010a1d8ffd20443945780143ac0257a1a04dea19793a203dca
Opcode Fuzzy Hash: 78f62872125b28b890cbd84e848c71d8151263879275a999eba7272c05823ee5
Instruction Fuzzy Hash: E511A2B2500244AFE721DF95DC89FABF7ACEF44220F14846AE945DB252D774E604CBB1

Uniqueness

Uniqueness Score: 0.08%

Function 204F12DA, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 204F1345

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 2147004f5036c844091ae64cc680222f15a443e80a2e29d1e7be27778f5da1e2
Instruction ID: 84fa587a8258de2410024d55ec5e8ffbca6730fe3faddb33ef83ddde91775995
Opcode Fuzzy Hash: 2147004f5036c844091ae64cc680222f15a443e80a2e29d1e7be27778f5da1e2
Instruction Fuzzy Hash: AD21C0B1600244AFF710DF65CC89B66FBE8EF04620F14846AED488B752D779E908CA76

Uniqueness

Uniqueness Score: 0.34%

Function 204F2BDD, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 204F2C4E

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: ac3c60fcf81e45a8eecf3c78f77f939bf091e20d01b92db7eff35eee8846b00e
Instruction ID: 91e9ccace218db3e39c53fc002bd33a2b6ade67f16323e32501cdadc65daeb78
Opcode Fuzzy Hash: ac3c60fcf81e45a8eecf3c78f77f939bf091e20d01b92db7eff35eee8846b00e
Instruction Fuzzy Hash: 49215E715093C49FD712CB65DC85B96BFE8EF06210F0984EBE985CB263D335A908CB61

Uniqueness

Uniqueness Score: 0.51%

Function 204F13DA, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 204F144E

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 67b41c4ba82ae72184bfbd5fbd2c6841b64fba57421e54915841bd775949fcce
Instruction ID: 48af8629eb6fb1f68a17d5924597338e16296dba2d79be8e89668b5826167895
Opcode Fuzzy Hash: 67b41c4ba82ae72184bfbd5fbd2c6841b64fba57421e54915841bd775949fcce
Instruction Fuzzy Hash: 7E21CD71500244AFE721DF55DC89F96FBE8EF48720F04855EE9888B252D779A608CBA2

Uniqueness

Uniqueness Score: 0.27%

Function 204F0CFE, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 204F0D6A

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 8eb49019f4dab847a834c9bdf2d3b9fd2182495f752f50eb9c8a7969f6d1812a
Instruction ID: 7bbba61d5c1c6760eda02b3267a9893641f90d366eb82fdd7a798f6b0b825f8e
Opcode Fuzzy Hash: 8eb49019f4dab847a834c9bdf2d3b9fd2182495f752f50eb9c8a7969f6d1812a
Instruction Fuzzy Hash: EF21DEB1500344AFE721DF95DC84B96FBE8EF48320F04845EED898B252C376B908CB62

Uniqueness

Uniqueness Score: 0.34%

Function 1DB1AE53, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1DB1AECB

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e7e26094bf83ddb6cd41b85fc59f33e959f558d0c0ac24f9015e979f48f29ee
Instruction ID: 4700ac8af9532c7fc356d135f2ea0b90b3bffe791d69ee83a69521e6569cd781
Opcode Fuzzy Hash: 2e7e26094bf83ddb6cd41b85fc59f33e959f558d0c0ac24f9015e979f48f29ee
Instruction Fuzzy Hash: 3321A1B55093C45FDB12CB29DC95B92BFE8EF02314F0980EAE885CF253D325A949CB61

Uniqueness

Uniqueness Score: 0.03%

Function 204F22B4, Relevance: 1.6, APIs: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 204F2336

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 4958234c359bb24a55bbdf530ea39d4b02425c1e18cdb989504f36c832963142
Instruction ID: 79d37ee1658dab2c7ab2f9f3e591e746fc7b7b4f37d021209bf562e4b16170bd
Opcode Fuzzy Hash: 4958234c359bb24a55bbdf530ea39d4b02425c1e18cdb989504f36c832963142
Instruction Fuzzy Hash: D521A171409384AFD722CF65C884A52FFF4EF06210F0984DEED858B262D375A958CB61

Uniqueness

Uniqueness Score: 0.55%

Function 1DB1A97A, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 1DB1A9EC

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d1d8bd8c8f9a2c51afb8e2fb979acdfeddd84498f95d4603a2bef805a66d909e
Instruction ID: 0dc7f41342cb92c424921b4d4ff348d4226a8ebaf7c416b418ce805fc9c284da
Opcode Fuzzy Hash: d1d8bd8c8f9a2c51afb8e2fb979acdfeddd84498f95d4603a2bef805a66d909e
Instruction Fuzzy Hash: 7911BEB2600640AFE721DF11DC85BA7FBECEF44610F04855AED469B252D670F949CAB2

Uniqueness

Uniqueness Score: 0.15%

Function 204F103E, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 204F10B0

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a2864ca7ee8a34bf6e3fd36468d30d944c2d94371bf9d36c78503302e8568d2e
Instruction ID: ad0842c2da3ba0ce0a653936f6209e4305a44009cae3e23df3aaeb9cc4d13e69
Opcode Fuzzy Hash: a2864ca7ee8a34bf6e3fd36468d30d944c2d94371bf9d36c78503302e8568d2e
Instruction Fuzzy Hash: A611B172600244AFE720DF55CC88FA6FBE8EF44620F04C55AE945DB662DB78E944CA72

Uniqueness

Uniqueness Score: 0.02%

Function 1DB1A148, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000EB4,?,?), ref: 1DB1A1BD

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 269e3dab72fdacccc38108b433bdc01adee94e922edb009106fd4fda76a325d8
Instruction ID: 02379a2367e231b45952a62ddd58e83a5e5286438e9151b4b86f93212a1a587f
Opcode Fuzzy Hash: 269e3dab72fdacccc38108b433bdc01adee94e922edb009106fd4fda76a325d8
Instruction Fuzzy Hash: E511AF719093806FD311CB25CC45B66FFB8EF86620F08819EED488B682D334B915CBA2

Uniqueness

Uniqueness Score: 0.22%

Function 204F1846, Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 204F18A5

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: d5048103537f2fda4bf5dcbbd17aeb68527f2f75b0c6a74067aa7a09e8c24829
Instruction ID: db27a1872251b9bdb3fb0ed125feffa5be82985943e3ed7a13dd0449a484e3b9
Opcode Fuzzy Hash: d5048103537f2fda4bf5dcbbd17aeb68527f2f75b0c6a74067aa7a09e8c24829
Instruction Fuzzy Hash: 6D11E272500344AFE721DF95DC88FAAFBA8EF44720F14C46AE945CB262D779A904CB71

Uniqueness

Uniqueness Score: 0.34%

Function 204F28F0, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 204F295A

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 0d0e3ef00755413f0e5a06d7b215568d33e0398b055258a8f853b971d9a0807b
Instruction ID: 5f609daf5406a77846829e8b0f52f002f0cac974ec5c597424f1a5722c7b3e8e
Opcode Fuzzy Hash: 0d0e3ef00755413f0e5a06d7b215568d33e0398b055258a8f853b971d9a0807b
Instruction Fuzzy Hash: CD116DB26053849FD711CF65DD89B57BFE8EF06220F0884AAED85CB252D374E908CB61

Uniqueness

Uniqueness Score: 0.02%

Function 00F01DBC, Relevance: 1.6, APIs: 1, Instructions: 61fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00F004A2,?,?,00000000,00000000,?,?,40000000,00000002,00000000,00000002,00000100,00000000,00F01DB9,?), ref: 00F01E14

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e06e6225796106c020deae872fc385efe68ab222df04d69fcdbd4d0f591d42f9
Instruction ID: d8beddd7ce9bb41cf11e2a2d3195b11327e6f65d70d77092ce820cd65c3ca9f8
Opcode Fuzzy Hash: e06e6225796106c020deae872fc385efe68ab222df04d69fcdbd4d0f591d42f9
Instruction Fuzzy Hash: C611D2307843057AFB309A24CC1BFEB3656AF80BA0F544519FE94AA1D2E7E5AC81F651

Uniqueness

Uniqueness Score: 0.01%

Function 1DB1ADAA, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 1DB1AE09

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 06d0dde877975f60af403596c4ee6c60639142255b1236b4b48baa153b355044
Instruction ID: fc81642a18d94be7f3a08c39faa3b3e1e233e7732c728868e93387c8bcfa91ad
Opcode Fuzzy Hash: 06d0dde877975f60af403596c4ee6c60639142255b1236b4b48baa153b355044
Instruction Fuzzy Hash: 7711C172500240AFE722DF55DC84BA7FBE8EF44720F14845AE9499B252C775A505CBB2

Uniqueness

Uniqueness Score: 0.01%

Function 1DB1B856, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EB4), ref: 1DB1B8BF

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1bd9cb875b01bbbf98856ac2b51c9518df1fd06086008ef99ea965aac1988446
Instruction ID: d56cbcf1fa8897478f81ae33b15757aaf18fca0296734ad2e09f6a08a1970197
Opcode Fuzzy Hash: 1bd9cb875b01bbbf98856ac2b51c9518df1fd06086008ef99ea965aac1988446
Instruction Fuzzy Hash: FE114871500340AFF721DF11DC85BA6FB98DF41B20F04C099ED495F281C6B4A648CA66

Uniqueness

Uniqueness Score: 0.01%

Function 204F015E, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 204F01A6

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 9b6ed684b9fcd9380fff5eb70ccd4768c729e739e77ce32dcfd607005aa2706c
Instruction ID: 722fc82f475fd1318df2ad178e21e4163cc5c8b860bf9ddd2ef053e639a4f2c3
Opcode Fuzzy Hash: 9b6ed684b9fcd9380fff5eb70ccd4768c729e739e77ce32dcfd607005aa2706c
Instruction Fuzzy Hash: F5117C716002449FEB10CF69DD89B56FBE8EB54320F18C4AADD49CB342D67AE904CA62

Uniqueness

Uniqueness Score: 0.24%

Function 204F2912, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 204F295A

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 9b6ed684b9fcd9380fff5eb70ccd4768c729e739e77ce32dcfd607005aa2706c
Instruction ID: c6f01500ddfed3d85060012ab4e43a553411bc94112569104cb8668b94c9ba45
Opcode Fuzzy Hash: 9b6ed684b9fcd9380fff5eb70ccd4768c729e739e77ce32dcfd607005aa2706c
Instruction Fuzzy Hash: AE1130B17002459FDB50DF59D989B56FBE8EF04220F08C4AADD49CB352D679E904CAA1

Uniqueness

Uniqueness Score: 0.02%

Function 1DB1BC7A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1DB1BCBF

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 708e2f9666d751625b3cb3cc5e537c5b47c116522f66bb33636386438bee83de
Instruction ID: 913c8da3bb5133763dff4181c76a4eac1cc590a54892962cbfd9990515edab26
Opcode Fuzzy Hash: 708e2f9666d751625b3cb3cc5e537c5b47c116522f66bb33636386438bee83de
Instruction Fuzzy Hash: 7511C4716002819FE700DF29EC85B56FBD8EF05620F08C4AADC0ACF242EB75E504CB66

Uniqueness

Uniqueness Score: 0.03%

Function 1DB1ACEA, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EB4,36F215F7,00000000,00000000,00000000,00000000), ref: 1DB1AD3D

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d45275a22f2a5983aa33e7a1181dc5726a9a2130910659289ba82ce3500a9778
Instruction ID: 35e77528113cf17f522bc7ce7b5cfa75e3e78ece26aa9b936d73a9f3aca02d1b
Opcode Fuzzy Hash: d45275a22f2a5983aa33e7a1181dc5726a9a2130910659289ba82ce3500a9778
Instruction Fuzzy Hash: E50122B1500640AFE711DF12DC84BA7FBE8DF40B21F04C09AED499F252C674B608CA72

Uniqueness

Uniqueness Score: 0.07%

Function 204F2C0E, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 204F2C4E

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 26d5ffcc4d0a59731e11da0aeef13865bcb6ea46776b51c29a9acfd9d96656eb
Instruction ID: dbe32639736211a4be3cb0309bcadd350fa2e1fb0464fa5bdcdd494919459694
Opcode Fuzzy Hash: 26d5ffcc4d0a59731e11da0aeef13865bcb6ea46776b51c29a9acfd9d96656eb
Instruction Fuzzy Hash: 7B1161756002889FD710CF99D989B5AFBE4EF44220F08C4AADD49CB352D779E944CBA2

Uniqueness

Uniqueness Score: 0.51%

Function 204F22EA, Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 204F2336

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: cf36fd75d5656498df726f9756d986f06dec59af26dc4f9853e476d3b9cf2826
Instruction ID: 5a53cad7b63ee623f1ac527f66cfccf90da3ea2076cbf41b4d591e01a85d6082
Opcode Fuzzy Hash: cf36fd75d5656498df726f9756d986f06dec59af26dc4f9853e476d3b9cf2826
Instruction Fuzzy Hash: 631170715007449FDB21CF95D988B56FBE4EF04210F08C5AADD498B612D339E919DFA1

Uniqueness

Uniqueness Score: 0.55%

Function 204F208A, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,?), ref: 204F20CA

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 8d1a1085fc5d9a0eb5438eb75d41b1c347545f76cb7d46a10ea2737c2ab119d1
Instruction ID: 4cf1c3cd71cc8d9123710ff54b177a478142615b985a307558a9b743c1f46a97
Opcode Fuzzy Hash: 8d1a1085fc5d9a0eb5438eb75d41b1c347545f76cb7d46a10ea2737c2ab119d1
Instruction Fuzzy Hash: E011A1726006449FD710CF55D988B56FBE4EF04220F08C4AADE09CB252D739E944CBA2

Uniqueness

Uniqueness Score: 1.51%

Function 1DB1AE8E, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1DB1AECB

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e77c0630a594d0e8f449aa72601250bf594c3c84bb811911fd03d7b9557d2475
Instruction ID: 21bc60c2e5aae0b999efca3466451e8e596b06187da3e30934381634326210d8
Opcode Fuzzy Hash: e77c0630a594d0e8f449aa72601250bf594c3c84bb811911fd03d7b9557d2475
Instruction Fuzzy Hash: 0101D272A003809FDB10CF29E884766FBE8EF00220F08C4AADC09CF246D735E405CE62

Uniqueness

Uniqueness Score: 0.03%

Function 1DB1A2B4, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1DB1A308

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8e4947d7ba929e8a5d4a02bc54a147f1d28216c3a2c89d6cccddf955bafea802
Instruction ID: 19bc70b65ec32d4b5664cd029d7eea78209a5ed184a50ed7759388d0d07a6973
Opcode Fuzzy Hash: 8e4947d7ba929e8a5d4a02bc54a147f1d28216c3a2c89d6cccddf955bafea802
Instruction Fuzzy Hash: 73018075509384AFD711CF15EC84B62FFA8EF46620F0880DAED899F252D375A918CB72

Uniqueness

Uniqueness Score: 0.01%

Function 1DB1BF1A, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1DB1BF54

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 339b465c02c3cd9ca619fbeb7846403b8f9291058b564bfac5ed011e9fb6237c
Instruction ID: 9603b50b84ddccd4f8213672f5a296fd98129dce08731a0095783441ec8a03c0
Opcode Fuzzy Hash: 339b465c02c3cd9ca619fbeb7846403b8f9291058b564bfac5ed011e9fb6237c
Instruction Fuzzy Hash: AC01B175A002809FD710CF29EC85756FBA8EF01620F08C0AADC0ACF246D775E404CF62

Uniqueness

Uniqueness Score: 0.02%

Function 1DB1A172, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000EB4,?,?), ref: 1DB1A1BD

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 3f3a3ee5dec43c3cd9d8d013ea64a7edc01cbd5d924b5ceea446236fc4df42d7
Instruction ID: d01ae29eb2dd1dc41fd7904de6e347093cd4cd31b74d9dae7070e1acc490b166
Opcode Fuzzy Hash: 3f3a3ee5dec43c3cd9d8d013ea64a7edc01cbd5d924b5ceea446236fc4df42d7
Instruction Fuzzy Hash: B40171B1900200AFD310DF16DC46B26FBB8EB85A20F14815AED089B641D775F915CAE5

Uniqueness

Uniqueness Score: 0.22%

Function 204F286A, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(?,00000EB4,?,?), ref: 204F28BA

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 76d3306ee32872b23c5b0e02e0e04a43a408f17c9caa00f5105c2c4943c90adf
Instruction ID: 394e3852cb39fafaad3a992e261c37bc749047ec38d6e953c11bc4d8c93dca62
Opcode Fuzzy Hash: 76d3306ee32872b23c5b0e02e0e04a43a408f17c9caa00f5105c2c4943c90adf
Instruction Fuzzy Hash: DC0171B1900200AFD350DF16DC46B26FBB8EB85A20F14815AED089B641D775F915CBE5

Uniqueness

Uniqueness Score: 0.07%

Function 1DB1AA8A, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,?,?), ref: 1DB1AADA

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f222a3cc9b3a7691fb58d1a6c67bb67733f62c21c595f254473a2d22bb70b4aa
Instruction ID: 242b839c9d376d043e74c1358e9fbbb51caeda735a75c2086cb923d9369db4c4
Opcode Fuzzy Hash: f222a3cc9b3a7691fb58d1a6c67bb67733f62c21c595f254473a2d22bb70b4aa
Instruction Fuzzy Hash: D601A271900200ABD310DF16CC42B26FBB8FB89A20F14815AED084B741D371F925CAE5

Uniqueness

Uniqueness Score: 0.02%

Function 204F05EE, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000EB4,?,?), ref: 204F063E

Memory Dump Source

Source File: 0000000D.00000002.24326413585.00000000204F0000.00000040.00000001.sdmp, Offset: 204F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204f0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 8c6db00ba2797d3492a0f9e85f2495ef9468f8e9f96edbe90d2016aef35706eb
Instruction ID: ed917a8fa83208366455064f70b628791f23fb91e7c004883cfa0d2751860305
Opcode Fuzzy Hash: 8c6db00ba2797d3492a0f9e85f2495ef9468f8e9f96edbe90d2016aef35706eb
Instruction Fuzzy Hash: 98016275900200ABD350DF16DC46B26FBB8FB89A20F14815AED085B741D775F925CBE5

Uniqueness

Uniqueness Score: 0.60%

Function 00F081CF, Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,B769339E,?,00F00A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00F004BD,00000000), ref: 00F0822B

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3b7338d16ccbe36a966adfdfb8fe2abe7cb7d236e4ce9f9e9eefb0cd39a519a0
Instruction ID: 80d8cc419a257307ca12b37514baaec3d38d1a3dfd0f952b0c9d5a42ecca25ab
Opcode Fuzzy Hash: 3b7338d16ccbe36a966adfdfb8fe2abe7cb7d236e4ce9f9e9eefb0cd39a519a0
Instruction Fuzzy Hash: D7F0E2D0C4060B34EF203A241E26BBF2A229F517F4F60412CFDC18508A8F29C4473011

Uniqueness

Uniqueness Score: 0.01%

Function 1DB1A2D6, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,36F215F7,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1DB1A308

Memory Dump Source

Source File: 0000000D.00000002.24320324071.000000001DB1A000.00000040.00000001.sdmp, Offset: 1DB1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db1a000_RegAsm.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0843463a9009029311d33d4125d96fbb523ffedeff30c6cebe34a03d41bdbae2
Instruction ID: ea8f69edf67115ec1343ab6464fcb5db310f30b6ad2392763114b25e353da595
Opcode Fuzzy Hash: 0843463a9009029311d33d4125d96fbb523ffedeff30c6cebe34a03d41bdbae2
Instruction Fuzzy Hash: ACF0DC345042809FD711DF05E889B62FBE0EF00620F08C09ACD4A4F206C279A909CE62

Uniqueness

Uniqueness Score: 0.01%

Function 00F0A824, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,000000C0,?,?,00000000,?,00F004BD,00000000), ref: 00F0A7D8

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 79751bbd70b7e6565d9dd082c8a01e4ceabf00169ce343474bf4350be8c7e97c
Instruction ID: 980681b9e3e496996140de5c60e8fc4e3326a1c859d119ab861cddf220ce94b5
Opcode Fuzzy Hash: 79751bbd70b7e6565d9dd082c8a01e4ceabf00169ce343474bf4350be8c7e97c
Instruction Fuzzy Hash: DBD01235B043024EEB1DEE34C1D61693777AEC5364798C008CA0106454F2276C89F762

Uniqueness

Uniqueness Score: 0.01%

Function 00F01820, Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,00F068C2,00000000,00000001,?,?,?,?,?,?,00F01137,?,?,00000000,00000000,000000FF), ref: 00F01831

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1beea27a6b604f50d0e8ce8ec9e9f961666e1f60683b56bffe492cc2d8f0247d
Instruction ID: 9428a53115b5da7353f12e8d7339dafa9696524181653009d336d13ff4d8f942
Opcode Fuzzy Hash: 1beea27a6b604f50d0e8ce8ec9e9f961666e1f60683b56bffe492cc2d8f0247d
Instruction Fuzzy Hash: D6C012706407067AF61005544C2AFD36A579F117B0F900305BE75500E4975348508524

Uniqueness

Uniqueness Score: 0.15%

Function 00F07C33, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,00F004A2,00000200,00F018B8,?,?,?,?,00F06953,00F06918,?,?,00F011DE,00000000,000000FF,00000007), ref: 00F07C4D

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: ac5aae0dad25ab8551f9d779720122a49b54a3f9a577bd216295e5e63ae69157
Instruction ID: ef09fb0b1322a84ad82ab9713ca7fd962ccacd7908c5b2b7525d7fe1cb2f05ec
Opcode Fuzzy Hash: ac5aae0dad25ab8551f9d779720122a49b54a3f9a577bd216295e5e63ae69157
Instruction Fuzzy Hash: 4DC012743043006BE710891089C4B5F625DAB90751F10C608F9A6851C1CB3088409621

Uniqueness

Uniqueness Score: 0.11%

Function 00F04C80, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00F04C54,00F04CC4,00F00A9B,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F04C94

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction ID: 90778f157ef074656d7de284b4bab831f576b04e2021a8a1eff49e75729f027a
Opcode Fuzzy Hash: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction Fuzzy Hash: A4C092717E0300B6FA348A208D57F8A62159B90F00F30840877093C0C085F1B610C62C

Uniqueness

Uniqueness Score: 0.01%

Function 1FEE1CD8, Relevance: 1.3, Strings: 1, Instructions: 61UNIQUE

Download Yara Rule

Strings

U_V^, xrefs: 1FEE1D4D

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID: U_V^
API String ID: 0-4067383671
Opcode ID: 85777a71513600e3e29c6e652154f3f0b1e97fc89a8adcff28aedca148f1fead
Instruction ID: 76fda7769927cec924db61c821c414677c7e48281358352e10fd327a534030f0
Opcode Fuzzy Hash: 85777a71513600e3e29c6e652154f3f0b1e97fc89a8adcff28aedca148f1fead
Instruction Fuzzy Hash: D6119171F006049FD740EBB888417AEBBE6AFC4310F114679D10AEB391EF75A9458BD2

Uniqueness

Uniqueness Score: 100.00%

Function 1FEE1CCF, Relevance: 1.3, Strings: 1, Instructions: 59UNIQUE

Download Yara Rule

Strings

U_V^, xrefs: 1FEE1D4D

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID: U_V^
API String ID: 0-4067383671
Opcode ID: 4dc2aa0c142fd944929b44c27bd9c63f721c301d7e716b2129c89b57275931cd
Instruction ID: 0ab76cdf493ff2680405ae8f663f1db4e562c2a4cec808f65236f6fafe22b2e9
Opcode Fuzzy Hash: 4dc2aa0c142fd944929b44c27bd9c63f721c301d7e716b2129c89b57275931cd
Instruction Fuzzy Hash: 7911A371A006059FD750DF7CC4417AEBBE6AFC4310F504279D14AEB391EB75A9418BD2

Uniqueness

Uniqueness Score: 100.00%

Function 1FEE39B0, Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff98466c4a00ecd9709ac752a2581de62874e2e6f65aa5077147500a066a7356
Instruction ID: 70dc69fdb0f4b97fbce15d5e77ed716e237e8064fceceff23a70b247fe7965ae
Opcode Fuzzy Hash: ff98466c4a00ecd9709ac752a2581de62874e2e6f65aa5077147500a066a7356
Instruction Fuzzy Hash: 5391B270B503049BE744AB789896B6EBAE6ABD8700F24453CD606BF3D4CDB1EC418766

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE3128, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f928ffab120b89e90710096cca7bed558ad59750be05dbe6f63b1ac09e9b057
Instruction ID: 798e9fcc83ec51a96a24dfba9f3076509e3e603eee50750c8288927ffd25f537
Opcode Fuzzy Hash: 2f928ffab120b89e90710096cca7bed558ad59750be05dbe6f63b1ac09e9b057
Instruction Fuzzy Hash: 4A81B470B503059BE70497789892BBE6AD7ABD8700F24453CD606BF3C5CEB1EC458BA6

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE0150, Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ba68248cdb5ce8b305b2004b1c3f71efcce4c18a21cb71bc7c77372c374665
Instruction ID: 35ccb6cd11d532af3338312d2d2418a5ed5200cf0edc0bf477599c7aaf846463
Opcode Fuzzy Hash: 20ba68248cdb5ce8b305b2004b1c3f71efcce4c18a21cb71bc7c77372c374665
Instruction Fuzzy Hash: 9B817E34A00215CFD704DFA8EAD4A9D7BF2FF89345F1181A9E107AB2A6DB31AD05CB50

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE4928, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b543d4d91c5d5bc73564d16dac755df7b6335dc302aa35a543b69f6aed446c6
Instruction ID: 3479bbc1bfe8ac0ebb7cda58a64438b3274120aaf67479c63b57bcd1ae704f24
Opcode Fuzzy Hash: 0b543d4d91c5d5bc73564d16dac755df7b6335dc302aa35a543b69f6aed446c6
Instruction Fuzzy Hash: 6C51D339A00519CFDB14CF68D884A9DB7B2FB84320F528559D81AAB392D771BE45CB81

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE2C40, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85fb67b60034c0b3a61f5b5829fabef3f181537dd9ea872f1bcc548db8b569e
Instruction ID: 60913f196ae5ee15722c0222a55931ba56c45f993ccaa07ddb3f3cac421bd480
Opcode Fuzzy Hash: c85fb67b60034c0b3a61f5b5829fabef3f181537dd9ea872f1bcc548db8b569e
Instruction Fuzzy Hash: D251D530E40216CFEB25DF74DD517AEBAB2AF84714F24402CD602AB291EF759C02CB91

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE3500, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896ded5dcf422ffd5756edff6727977c6a1c38685024e4956b62d60a3bf72f5d
Instruction ID: b5dd141490a65ea488d4fd244c264af66ad0cac25083f7e2acbbd5d11b2fdd6c
Opcode Fuzzy Hash: 896ded5dcf422ffd5756edff6727977c6a1c38685024e4956b62d60a3bf72f5d
Instruction Fuzzy Hash: 8B517C35B002108FD718DB38D9E4B5ABBF7AB88B15F118569EA179B392DB31EC05CB50

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE2F00, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3859b60b8c6e3b14f75766931f17df2f8c263747fafef2636391f22cdd1ba873
Instruction ID: 4198ae1df5ea46bb9e9e832f5d6ed94013339790ee1d53b3c2024128a1542bb4
Opcode Fuzzy Hash: 3859b60b8c6e3b14f75766931f17df2f8c263747fafef2636391f22cdd1ba873
Instruction Fuzzy Hash: 99511A35A00218DFDB14DFA8D990A9DBBB2FF89311F208569E412AB395DB31AC42CF50

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE34FB, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e40d90fcbdaed0a56aade54f3d86425feaf239f5dfa68a3a77b08cdde441d5
Instruction ID: 0a1d139d2406f49c12c4e4065c0a014235ec2022a1bae9b51ada04ce1cb43b95
Opcode Fuzzy Hash: 46e40d90fcbdaed0a56aade54f3d86425feaf239f5dfa68a3a77b08cdde441d5
Instruction Fuzzy Hash: 20416936B002158FD718DB38D994B5ABBF7AB88B05F518569E6079B381DB32EC05CB50

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE0120, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90251c28fd053f85b31b3087dfc981299f450edbc69126c8d2b7f29e96beeec7
Instruction ID: 36652fa23188cc1d2d6073c410d35588fe433256b3f1b17f0586f67f3f72348f
Opcode Fuzzy Hash: 90251c28fd053f85b31b3087dfc981299f450edbc69126c8d2b7f29e96beeec7
Instruction Fuzzy Hash: 72516034A00219CFD704DFB8E9D4A9DBBF2FF89744F1085A9E107AB266DB31A905CB51

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE0DF3, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53db7ffaee173444fc526bd31c486b5237af03c2171a0a91c744069df25dde01
Instruction ID: 5602c2dbe000d267abbdf2280af2044f043df1afaf4059e239ed644213b0e7be
Opcode Fuzzy Hash: 53db7ffaee173444fc526bd31c486b5237af03c2171a0a91c744069df25dde01
Instruction Fuzzy Hash: B341D636708221DBDB188A34DD90B857BB2EB84B10F154674E76BAB3D1D731EC51CB44

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE014B, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b07da76fe93403cf428f90f0830075c5d140313b3cd1a7eee614b857fe77e2
Instruction ID: 299d50b4743672337190bc05f9981ee143feec833a9cbb1ed8f92a46a42fd29f
Opcode Fuzzy Hash: 35b07da76fe93403cf428f90f0830075c5d140313b3cd1a7eee614b857fe77e2
Instruction Fuzzy Hash: B5517030A00219DFD704DFB8EAD4A9DBBF2FF89345F1085A9E107AB256DB31A905CB50

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE34BB, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb1288721d82d4d517a4e39f39737cd0ea8a4bef3d07eac2f44893243c87dd6
Instruction ID: 0c946f567332570e2ddd0d1e814338b2ff3f225ae324851cbf6369c8ea4af95b
Opcode Fuzzy Hash: adb1288721d82d4d517a4e39f39737cd0ea8a4bef3d07eac2f44893243c87dd6
Instruction Fuzzy Hash: 61416832B002118FD718DB38D9D0B5ABBF3AB88B05F518569E6079B392DB32EC05CB50

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE1648, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2629e740983ee4e0ecae55c36e313e04350d0c04cccb5da68e035771572ca34
Instruction ID: 2db78d413a1bac5e7dd6b96caa77f8417b7f7de3f916442f74938f642ca2c522
Opcode Fuzzy Hash: a2629e740983ee4e0ecae55c36e313e04350d0c04cccb5da68e035771572ca34
Instruction Fuzzy Hash: 1A418F34B402548FDB48EB78D9507AD76E3AFC9700F6044A9C506AB392EB39AD42CB51

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE0860, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab802903367ef10f0fdb09c4e486a936fcb2a896ebaf32065924f42ac0c2db10
Instruction ID: 84eb8ffd581c8c87f946b48885814f80e6ad9324d79a7ffc48937dc705e21593
Opcode Fuzzy Hash: ab802903367ef10f0fdb09c4e486a936fcb2a896ebaf32065924f42ac0c2db10
Instruction Fuzzy Hash: 7E319F31B001248BCB08EB78D9E4A6EBBF7ABD8740B554568C907D7395DE34AD01C7A5

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE10F0, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef740890bd12b1731f82c372cd9437a127c12ea966734e634b1f4e19521299f
Instruction ID: eb774f63125ee6c90a684c6f163ff8dad97a173320346abfd7eba6b02b3492ea
Opcode Fuzzy Hash: 6ef740890bd12b1731f82c372cd9437a127c12ea966734e634b1f4e19521299f
Instruction Fuzzy Hash: AF416A35A102248FCB04EF65CEE0A9D7BF6FBC9B6076040A9D803A3399DB316D45CB94

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE0670, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ccce6ef353103840dd765fe9c54435e788a612ecb6d738b014f30cc2931edde
Instruction ID: 626d9804baf45fc55262724ed198a57e1529d97001545be604f5950559b7fd76
Opcode Fuzzy Hash: 0ccce6ef353103840dd765fe9c54435e788a612ecb6d738b014f30cc2931edde
Instruction Fuzzy Hash: 9A318034B002149FDB14EF78D894BAEBBF6AB8C710F114579E606EB391DE729C058B91

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE12D0, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5690efca51e08921ddf0fa6909e6dfe21a16fa677f2e436793f1caa419b48520
Instruction ID: b1afa69b1fe3a37da08469e78bd6c5f363105f28cd2c1f6100401de6c148cfc1
Opcode Fuzzy Hash: 5690efca51e08921ddf0fa6909e6dfe21a16fa677f2e436793f1caa419b48520
Instruction Fuzzy Hash: 7D31F330A00114CBDB04DB79DDE0BDE7BF9FB95704F1089A9C01297256DB39A849CB66

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE3DA3, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a34af8b742b8c4ce53b55e46affdb7880e0816bc5c3b65048b2528013a691f2
Instruction ID: b10b3ce721619947e24786f7888520ca70360080caaad686aac8d90df28506c6
Opcode Fuzzy Hash: 6a34af8b742b8c4ce53b55e46affdb7880e0816bc5c3b65048b2528013a691f2
Instruction Fuzzy Hash: A0317070B003149BCB58DB7A8C91BAFBAF6AFD8300F204569D516E7388DE71E84187A5

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE3EF3, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0cbd827ce849b07073e82fd1f02da118a54af04d79620787b1be692f4c667d
Instruction ID: 184596bb0d59b4f3ef91f72110016f5194581efe70c620c7c4c805e1be587a03
Opcode Fuzzy Hash: 1d0cbd827ce849b07073e82fd1f02da118a54af04d79620787b1be692f4c667d
Instruction Fuzzy Hash: 9D31D575F000198BDF08EAB8D8516DDBAF7AFCC210F158578D606FB254EE31AD0587A2

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE3DA8, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ab8ee5323ed431adb4026fde774fbf68c6d8db15e246818c8f820e84644042
Instruction ID: 19d3c6365bdbd9e73aba923e79a9fa9d00783f1824ef14c3a678c0b51216c133
Opcode Fuzzy Hash: 90ab8ee5323ed431adb4026fde774fbf68c6d8db15e246818c8f820e84644042
Instruction Fuzzy Hash: 3C318270B003148BCB58DB7A8C907AFBAF6AFD8300F204569D516E7388DA71E84187A5

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE111F, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef90251b5ac0e69e45296e8d92801624eace15ba3301686d3dd72ab31b82dfcd
Instruction ID: 0d5014cd4c36f41fc3b449f63ddfcfd72d8024b1f780dbe06d51f3f4853572e9
Opcode Fuzzy Hash: ef90251b5ac0e69e45296e8d92801624eace15ba3301686d3dd72ab31b82dfcd
Instruction Fuzzy Hash: EE415B35A102248FCB04EF65CEE09DD7BF6FBC975076444A9D803A3259DB316E46CB54

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE12E0, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b87533243dd30443a119b3f5475178a083bf055dc8af161a790ab396d4b695
Instruction ID: 317c79f046151f4063bcfa343761f7f3f339b7d1c5a87349637eb065ef4410ba
Opcode Fuzzy Hash: c1b87533243dd30443a119b3f5475178a083bf055dc8af161a790ab396d4b695
Instruction Fuzzy Hash: DA31E230A00218CFEB04DB79DDE4BDD7BFAFB95704F1088A9C0129B256DB399849CB65

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE4640, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0503ac57ca9bfdab5d1f7fad3fb6070dfc6720dc1fc20e1ce45faff7d7d539e
Instruction ID: a6117cb609489cad9b0df0428ca6db2bdb777aa6aa2ba0f0d43b202ce1980fa0
Opcode Fuzzy Hash: b0503ac57ca9bfdab5d1f7fad3fb6070dfc6720dc1fc20e1ce45faff7d7d539e
Instruction Fuzzy Hash: B9313274A01214CBEB04DF68ED8878D7BB2FB85704F508469E002AB385DB76AC08CB55

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE4043, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c81ae8ec394e802e166719d6fcf003e519220216f0cda78ed258040bf4138c
Instruction ID: d7abb1dabb7d3363f989d3dcdde8277d508cf1ffb69eec93874e848f1d44acad
Opcode Fuzzy Hash: 65c81ae8ec394e802e166719d6fcf003e519220216f0cda78ed258040bf4138c
Instruction Fuzzy Hash: 2F319A74E05208EFEF04DFE8E8947DDBBB2AF89314F20446AE505A7391CB31A845CB51

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE50D3, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decd428e92bff6d22a4c808475b89405130867e961dcf3ff1a9e621d164d90e7
Instruction ID: c3ab6eb51836c3ea010fb6840ddb482c7d943a4f628a636d74f5133b5d00fd00
Opcode Fuzzy Hash: decd428e92bff6d22a4c808475b89405130867e961dcf3ff1a9e621d164d90e7
Instruction Fuzzy Hash: BF21F736F002189BCB44DAB8DC51B9EB7E2AFC8650F55856AD106FB389EE30AC008761

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE084F, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dab59698e3bba26bf051132424b4f5f83dfd1a1d9fd4f584e33a061a9214cdb
Instruction ID: 4beff4969e64cc9d900596ab8857bc4ddb4077069f01f7d8a4603b63d6f70b43
Opcode Fuzzy Hash: 6dab59698e3bba26bf051132424b4f5f83dfd1a1d9fd4f584e33a061a9214cdb
Instruction Fuzzy Hash: F9217131B041249BC708DB78D9E0A6E7BF7ABD8740B414569D907D7396DF30AD05CBA2

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE3750, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4eda5342faebc5e993bc15b88797910d5d33d4c6211f4b9ab26e34394d8a359
Instruction ID: a68afa2c882cc49fa002548ffc6693669d675d510cfe79f6d65123609c0f04cd
Opcode Fuzzy Hash: d4eda5342faebc5e993bc15b88797910d5d33d4c6211f4b9ab26e34394d8a359
Instruction Fuzzy Hash: C7215031B002159FDB04DFB4D99069EBBF6AB88710F518155DA05A7381EB35AD41CBA4

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE5203, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c1f796ba28a91143981ea775f8a93eebe1aaef8f60793b3cb54822d6db6ed3
Instruction ID: 7f2decfa9a97aeea61737379c490c99736abca5b13e006c9c2bdcdf411b10bf9
Opcode Fuzzy Hash: 39c1f796ba28a91143981ea775f8a93eebe1aaef8f60793b3cb54822d6db6ed3
Instruction Fuzzy Hash: 4E219332A002189BCB24DFB9D9809DEB7F6EB88710B518969D516F7391DB31AC44CBA0

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE3743, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d1d6563cfbcc713a10258790dc2d0b4f478a6bdf1d2d839e64d6b0b121dd55
Instruction ID: dba43954169eea8571c43294d1be602d98206b52b5dbb26d2612706e97a4891d
Opcode Fuzzy Hash: a4d1d6563cfbcc713a10258790dc2d0b4f478a6bdf1d2d839e64d6b0b121dd55
Instruction Fuzzy Hash: B421A531A052159FCB04CF74C990B9EBFF6AB48B50F518255EA05E73C1EB35AD41CBA4

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE384B, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa61b218f72aa88603385340a2005a1c2b59b28b2939164e14341c2147620e7
Instruction ID: e1bf576bb1687a17d27e01c3e27954152b4c8725d7391a4a7340cf7a8694e4a8
Opcode Fuzzy Hash: 0fa61b218f72aa88603385340a2005a1c2b59b28b2939164e14341c2147620e7
Instruction Fuzzy Hash: E6119331B002159FCB04DF79C9956AE7BF7AB99B00B5041A9E506E7341EB36AC01CB95

Uniqueness

Uniqueness Score: 0.00%

Function 204E1BCC, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24326364848.00000000204E0000.00000040.00000001.sdmp, Offset: 204E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab34507cf4bfd61a3c77a687b3011d35a0e4e0a7be1ac331074704aaf6f1867b
Instruction ID: f4b602c433371fb45cd85dcb2081015c78a21dd03c4c54ed31048becc679fc3f
Opcode Fuzzy Hash: ab34507cf4bfd61a3c77a687b3011d35a0e4e0a7be1ac331074704aaf6f1867b
Instruction Fuzzy Hash: C011B8B5608301AFD340CF19D881A5BFBE4FB89664F14896EF998D7311D235EA148FA2

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE3850, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c16729644bf39143fb4e8e78af7e9c2e8ed16a7ac74dd994aa298c32d684d8
Instruction ID: ce13e2694dce1f96455cdda4c5437574bfb4a41a631be3df866fd4629935d8f4
Opcode Fuzzy Hash: 75c16729644bf39143fb4e8e78af7e9c2e8ed16a7ac74dd994aa298c32d684d8
Instruction Fuzzy Hash: 7D119031B002158FCB04DF79C9956AE7BF7AB99B00B1040A9E606E7381EB36AC01CB94

Uniqueness

Uniqueness Score: 0.00%

Function 1DB40DD3, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24320683231.000000001DB40000.00000040.00000040.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9e192139ca59bd3f7ecb522cfbaa4141cbb778059379f0ad14cc90b19fbffe
Instruction ID: dabf83677e063b325a15ccc4026de53c28e5167b596146a1b122f071960f39b9
Opcode Fuzzy Hash: 6a9e192139ca59bd3f7ecb522cfbaa4141cbb778059379f0ad14cc90b19fbffe
Instruction Fuzzy Hash: 6121423054D3C19FD707CB24C950B56BF72AB47214F29C6DAD48A8B6A3C33A981BDB52

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE22BD, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782315734a1940dafe383bf79706df5bc1a5873fa500feb71badae34b8ac407a
Instruction ID: 0550860d43a48db052a1e9ae0b0cec19c8986bec753f3a2eb7d3ccfe77089abb
Opcode Fuzzy Hash: 782315734a1940dafe383bf79706df5bc1a5873fa500feb71badae34b8ac407a
Instruction Fuzzy Hash: 2A2179B0A04219DFEB10CFA4E894BCDBBB2BB84314F208259E415AB3D1D771A945CF20

Uniqueness

Uniqueness Score: 0.00%

Function 1DB40E0C, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24320683231.000000001DB40000.00000040.00000040.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637e0bfbf00375eb77bf48bd14a91544e016369b6e9a37a4ddc190ef50bb90ac
Instruction ID: 76ca6d6683c9b4a514abede52017164cb971e35ff3dd6deebee54ef8c2f679d9
Opcode Fuzzy Hash: 637e0bfbf00375eb77bf48bd14a91544e016369b6e9a37a4ddc190ef50bb90ac
Instruction Fuzzy Hash: C411B431648280DFD702CB10D940F27B795EB84708F34C5ADD84E5B653C73B8823DA42

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE28DB, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9640d9e16e121aef2cb117d2a731e6e9b3f4b4382015aed3752baaf061e9152
Instruction ID: 937f785c4b33c231ba1c0d9d57d271c77627902ea9ed471078512a7eee79ae61
Opcode Fuzzy Hash: c9640d9e16e121aef2cb117d2a731e6e9b3f4b4382015aed3752baaf061e9152
Instruction Fuzzy Hash: EB113D71E142489FDB05CFA8E8C4E8DBBE1AB58318F159595E445EB362D731E8408B51

Uniqueness

Uniqueness Score: 0.00%

Function 204E1A70, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24326364848.00000000204E0000.00000040.00000001.sdmp, Offset: 204E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0396fccfed642d2cc9165fac28e75f5ed9c4568702e38476cd50a8953cafe3
Instruction ID: feca40562d93bae4211044e852626ea7f65b513e1de00a534aa5b124da8e2322
Opcode Fuzzy Hash: 7d0396fccfed642d2cc9165fac28e75f5ed9c4568702e38476cd50a8953cafe3
Instruction Fuzzy Hash: 3D11FAB5608301AFD350CF09DC81A5BFBE8EB88660F14896EF99997311D331E914CFA2

Uniqueness

Uniqueness Score: 0.00%

Function 1DB2AD44, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24320432090.000000001DB22000.00000040.00000001.sdmp, Offset: 1DB22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db22000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd325640d247a5227abc014b934fe29243df38d189328ac83b8f299a4d406cd
Instruction ID: 401ab1e9b9b1b26ba74a827d9479d8f01c0bba498c6053ea2a2654b236575a70
Opcode Fuzzy Hash: 1fd325640d247a5227abc014b934fe29243df38d189328ac83b8f299a4d406cd
Instruction Fuzzy Hash: 2B11FEB5608301AFD350CF09DC81A5BFBE4EB88660F14895EF99997311D331E914CFA2

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE42AB, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c220c6c5a51cbbb8422dcac9dfc4ce335468456c9bf57dcee3d1befc5a241b1f
Instruction ID: 0044c0fe7bc9cdd6af87ee8a5986e8e2b3706e477f8583f14eb8aa7c91c177ca
Opcode Fuzzy Hash: c220c6c5a51cbbb8422dcac9dfc4ce335468456c9bf57dcee3d1befc5a241b1f
Instruction Fuzzy Hash: B2112134A01214CFCB69DF38D990A9E7BB2FBC5B54B5044B9D40A97385EB329D43CB81

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE42B8, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc4a644a92d2781f7d91521d93914cc4f19afcb947b18cd85d3efd55c4e62f1
Instruction ID: 7824853572a081ba9ee18021c8002e1884519f38aa9a5a9c0d34557348e6f7b7
Opcode Fuzzy Hash: dcc4a644a92d2781f7d91521d93914cc4f19afcb947b18cd85d3efd55c4e62f1
Instruction Fuzzy Hash: 32111234A00214CFC768DF38D99095E7BB6FBC5B50B5044B9D50A97395EB369D43CB80

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE0D01, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc584b0ca770e9e00a2c2c68ef947ccc8f7e2f73737ab27515f85e4e4469be81
Instruction ID: 8cdac781a96c8357a97cba6d709267db46e737f3e8af630dac9d9005b2417139
Opcode Fuzzy Hash: bc584b0ca770e9e00a2c2c68ef947ccc8f7e2f73737ab27515f85e4e4469be81
Instruction Fuzzy Hash: 95112B75605251CFCB04EF38C5D961D77E1FBC4605B9189ACE447CB254EB30A9098B47

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE2EFB, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c580e999d06e272feda811fc537c42b2836adeeb4fc62c24edfa6dc885be6ae7
Instruction ID: 36c5c3cb195edbdd477509aabc9339948a40291076c7054237c3892ddfea17bf
Opcode Fuzzy Hash: c580e999d06e272feda811fc537c42b2836adeeb4fc62c24edfa6dc885be6ae7
Instruction Fuzzy Hash: 7F110670A01108DFCB04CF65CA9499EFBF2FB88350B618564E406B7245DB31BD41CB90

Uniqueness

Uniqueness Score: 0.00%

Function 1DB405DF, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24320683231.000000001DB40000.00000040.00000040.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b71ceb8e4910610b5006c3021eff5a5b1bd125b35dab500c304b060b04836a
Instruction ID: 4b3bb391e77d6f9b5911ca8217c2cdfda379b0ab9f087ba05ca3021439761e8c
Opcode Fuzzy Hash: 50b71ceb8e4910610b5006c3021eff5a5b1bd125b35dab500c304b060b04836a
Instruction Fuzzy Hash: 8501D6B55097806FD7128F16AC40863FFB8DB86130749C5DFEC49CB652C229A909CBB2

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE1523, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0b30c9660c832c707429b980c4af6f3d4699339825a2cf78f597bd12ef02ec
Instruction ID: cd8bcec0055156f25b77f4c0c135bc0bc8b18a99d0a11fc18890a855fbe715eb
Opcode Fuzzy Hash: 6d0b30c9660c832c707429b980c4af6f3d4699339825a2cf78f597bd12ef02ec
Instruction Fuzzy Hash: 5F016971E001098FCB44EBB9D9405EEBBF5FF98350F604569C50AF3241EA35AE018BA5

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE1528, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 340d493e767157f70706169feb338be775aff4509be3b5a4b1e20a26ce4fb3fb
Instruction ID: 2fea0000c7b82d587660744019a08122ac4a301a8eda73ecfa2217382b5a5aef
Opcode Fuzzy Hash: 340d493e767157f70706169feb338be775aff4509be3b5a4b1e20a26ce4fb3fb
Instruction Fuzzy Hash: 7FF03C71E001198FCB44EBB9D9405EEBBF5FF8C350F604569C50AF7241EA359E018BA5

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE1726, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948a12bb1ce182b63a65d88af028298cceaed6ac9559fbdefea4ce235d0bd660
Instruction ID: a505ebc9b1e21d1a62faba338a62e8a6c6e3bb85435f4caa7894c96dcb5d2542
Opcode Fuzzy Hash: 948a12bb1ce182b63a65d88af028298cceaed6ac9559fbdefea4ce235d0bd660
Instruction Fuzzy Hash: 95F08C35B402508BEF08E7B8D4502EC62A7AFC9219B2008B8C1066B3D1DF3A9E02CB61

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE07C0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd407648182cab3c009ce4ba6a6b101a437cc5c65eb6fccbda08867362384626
Instruction ID: bca1c45bed5b7c0b108db00a28f9c41facc4bcfc5e7ef56c83080ba260e1a3a0
Opcode Fuzzy Hash: fd407648182cab3c009ce4ba6a6b101a437cc5c65eb6fccbda08867362384626
Instruction Fuzzy Hash: 4A01AD30900218CFCB20EFB8C9C0AAE7FB6FB85B00F40456AC50A97242D7315544CB91

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE392B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ad9391c69632aa3fd5331bf64eb1ca77c3e31a2c30088a611058dd85cabaf5
Instruction ID: ff2503cf1f0a5a70090bdbf2db7fda4b93a88655340458d0bc815a67152f7eff
Opcode Fuzzy Hash: 80ad9391c69632aa3fd5331bf64eb1ca77c3e31a2c30088a611058dd85cabaf5
Instruction Fuzzy Hash: B7F01D75E001199FCB40DFBCD8456DEBFF5EB98250F6001BAD509E7301E6359A018BE6

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE0A68, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad6c4a5d3ea2017d72147fdac2d37b9a8db54a9e5b597e6ec9e5ea85684d752
Instruction ID: e5c421eca5e07f409f8030a41472aa7255f3376d7333b688c7a17d9547ce42ea
Opcode Fuzzy Hash: 8ad6c4a5d3ea2017d72147fdac2d37b9a8db54a9e5b597e6ec9e5ea85684d752
Instruction Fuzzy Hash: 08F03A72E002299FCB40DFB99C402AEBBF5EB88690B124579D60AE3200E63059018BE0

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE2C33, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414470c13e5bd3fe24203320d8a64426ed8765cc8491faf72f00a71e2493bb29
Instruction ID: 8bb6b33559c2c433e98bb1ecdd9f44f799989e23cebd716672a51953ef270c38
Opcode Fuzzy Hash: 414470c13e5bd3fe24203320d8a64426ed8765cc8491faf72f00a71e2493bb29
Instruction Fuzzy Hash: 73F02030E0425A5ACF04DEBEAC149DFBFF9DFE8222F4449B5D948E3141E931A81183E2

Uniqueness

Uniqueness Score: 0.00%

Function 1DB40EC4, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24320683231.000000001DB40000.00000040.00000040.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0820154c3f26c0d41788179339f31418b5969b19dd37f7ea61e9393507a2475
Instruction ID: 3d292b34bcbb0ba491f2ca269463cd07a7224b6c8f4ed43f5521b3736811b127
Opcode Fuzzy Hash: b0820154c3f26c0d41788179339f31418b5969b19dd37f7ea61e9393507a2475
Instruction Fuzzy Hash: 9EF0EC35548685DFC306CB40D544F16FBA2FB89718F24C6ADE9490B762C7379823DA82

Uniqueness

Uniqueness Score: 0.00%

Function 1DB40606, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24320683231.000000001DB40000.00000040.00000040.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef9a42db8349f55a1aaf35add6623047cf65077ea77e063208ef9e32d989618
Instruction ID: 9ec19f38f91cf876f00f5ab16dd8433a34c233cf33eb286d7666e5fc4007c3e3
Opcode Fuzzy Hash: 2ef9a42db8349f55a1aaf35add6623047cf65077ea77e063208ef9e32d989618
Instruction Fuzzy Hash: 65E092B66006048BD650DF0AEC81462FBD4EB84630B08C47FDC0D8B701D639F504CEA5

Uniqueness

Uniqueness Score: 0.00%

Function 204E1C37, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24326364848.00000000204E0000.00000040.00000001.sdmp, Offset: 204E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a313993b49b7cfa5a7b12ea8719a04bd1e811f5a05bb628b2a181c214ce49bc
Instruction ID: a3380f42ef716014e4a67cd4aded362591df780a1b1ef45c5fd1d05a5c9aee37
Opcode Fuzzy Hash: 8a313993b49b7cfa5a7b12ea8719a04bd1e811f5a05bb628b2a181c214ce49bc
Instruction Fuzzy Hash: 0DE0D8B65403006BD210DF069C86B23FB98DB90930F04C46BED085B342D575B514C9F5

Uniqueness

Uniqueness Score: 0.00%

Function 204E14E3, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24326364848.00000000204E0000.00000040.00000001.sdmp, Offset: 204E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fcc65fca6bf5bc08fce65d7229c4634446aca2c622d5f31540427e3ef61cfc0
Instruction ID: 767e2a0469f02299736618e7ae63b56f2867455ec183355bbf416f3ca980bf53
Opcode Fuzzy Hash: 7fcc65fca6bf5bc08fce65d7229c4634446aca2c622d5f31540427e3ef61cfc0
Instruction Fuzzy Hash: 79E0D8B65002006BD210DF069C86B23FB98DB80930F04C45BED095B302D576B614CDE5

Uniqueness

Uniqueness Score: 0.00%

Function 204E1ABF, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24326364848.00000000204E0000.00000040.00000001.sdmp, Offset: 204E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_204e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0728d03457e3c94523a9064dddb2b85a901eb1f3d52ea7f1588ddcdfab42a0
Instruction ID: c6a80e7c7158efe401e235a383ff054fbffdec685f37af4095b1ff0ee0f04854
Opcode Fuzzy Hash: 3a0728d03457e3c94523a9064dddb2b85a901eb1f3d52ea7f1588ddcdfab42a0
Instruction Fuzzy Hash: 56E0D8B65003046BD250DF069C86B23FB98DB40930F08C45BED095B302D576B514C9F5

Uniqueness

Uniqueness Score: 0.00%

Function 1DB2AD93, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24320432090.000000001DB22000.00000040.00000001.sdmp, Offset: 1DB22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db22000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d552fb3dc9fe129d876fd2a6dc1e1f40bb8a42c35a24f736aca98a70900b5ca
Instruction ID: 2dca046eb1cb13f76a76fe72f2c487e578205ecccafba4e6ab91efb7d5e51df1
Opcode Fuzzy Hash: 1d552fb3dc9fe129d876fd2a6dc1e1f40bb8a42c35a24f736aca98a70900b5ca
Instruction Fuzzy Hash: 6AE0D8B65402046BD210DF069C86B33FB58DB40930F04C557ED095B302D575B514CDF5

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE0480, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73372ddf18d5fa3b5218e3800255283148c254b6b6a706df76e43ac937989450
Instruction ID: 67597b798a50429080a72e7c2220b7cbfdf31bdf8f40ca01c70cb88b9c5f57ed
Opcode Fuzzy Hash: 73372ddf18d5fa3b5218e3800255283148c254b6b6a706df76e43ac937989450
Instruction Fuzzy Hash: A0D0A732250110CFC2045FB4C584F453BF9EB99A20B50859CE00FC3613CE78B4588701

Uniqueness

Uniqueness Score: 0.00%

Function 1DB123F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24320272155.000000001DB12000.00000040.00000001.sdmp, Offset: 1DB12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db12000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688fdb15554ab4f98e0e7c262685f98f7b5fced2cfc6778bee7892e6ca9f6a38
Instruction ID: b4c22d6fbd1c8cc55283eb143cc074c21154ac2161a50cb69bde4aac7fed9807
Opcode Fuzzy Hash: 688fdb15554ab4f98e0e7c262685f98f7b5fced2cfc6778bee7892e6ca9f6a38
Instruction Fuzzy Hash: 37D05EB96046918FD3029E18D1E2BA53BD4AB92B14F4644FAA8018F763C768E581D201

Uniqueness

Uniqueness Score: 0.00%

Function 1DB123BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24320272155.000000001DB12000.00000040.00000001.sdmp, Offset: 1DB12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db12000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c06fa0147e6fa775c20270cc48eaece7b410ab7d35ab14cf6fb796f3b6dcfd4a
Instruction ID: 75f03b1032138adc8e528f4998b8b3bfc286d9e9281671bbb0ffec6687ec9b43
Opcode Fuzzy Hash: c06fa0147e6fa775c20270cc48eaece7b410ab7d35ab14cf6fb796f3b6dcfd4a
Instruction Fuzzy Hash: 52D05E756002814FDB01DE08E2D1F6937D8AB80B04F0244F8BC028F362C7B4D9C0D600

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE1581, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309b721594f5aeb93eeebfeb58abfbe9fc45ef6dd39bfa957b3b79d5845acaba
Instruction ID: 6a2546652d9e546f1a3ce9a16e86a078800b9a95bddfbbf26585eb4eb4a9f148
Opcode Fuzzy Hash: 309b721594f5aeb93eeebfeb58abfbe9fc45ef6dd39bfa957b3b79d5845acaba
Instruction Fuzzy Hash: 5EC01236F40004C7DF04F7F0F8851DCB374EA842257200C61D117A3041DF311A148711

Uniqueness

Uniqueness Score: 0.00%

Function 1FEE461B, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24323558317.000000001FEE0000.00000040.00000001.sdmp, Offset: 1FEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1fee0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6809a6600e4ad008811920de9b67d3e606602a4e873f39f8e54ac121db8cdcf0
Instruction ID: ed44dccd74fdf5137b63766e97b9beac33a5c9f9cfcb0aaf1942a959e15f9286
Opcode Fuzzy Hash: 6809a6600e4ad008811920de9b67d3e606602a4e873f39f8e54ac121db8cdcf0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: 0.00%

Non-executed Functions

Function 00F01E6C, Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aae17fba98d4bf99c1c74551a9e39b707c6f486f06c259c83d60bcf6ad55c139
Instruction ID: f879074a26d75de709c4038cb0b0d994f85ddf4f8e99a136bb9af4a01dee6f28
Opcode Fuzzy Hash: aae17fba98d4bf99c1c74551a9e39b707c6f486f06c259c83d60bcf6ad55c139
Instruction Fuzzy Hash: 25B1BE71700612EFD754DF28CC95BD6B3A4FF197A4F184329EC99932C1DB38A851ABA0

Uniqueness

Uniqueness Score: 0.00%

Function 00F08F5A, Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c04facf7fb2d7d8b1b38c1efeb0a0a7bc062ea3075f2b863e4a23f95b2be87
Instruction ID: 846d0599b74dac56eeecebc330f81b9c5c1ea91ceb700d4ca30ffde8960a3157
Opcode Fuzzy Hash: c6c04facf7fb2d7d8b1b38c1efeb0a0a7bc062ea3075f2b863e4a23f95b2be87
Instruction Fuzzy Hash: F1A168B174030A6FFB215E24CD86BEA376BEF56350F544228FE44A71C1C7B99888B740

Uniqueness

Uniqueness Score: 0.00%

Function 00F0949D, Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 5c26341aa8f10338cf57669b83da95fb2960708d1176b5b9c74d93ace4facdde
Instruction ID: 392371d2e290a5de4da744febd869d614db97fb6741a5274895877777245a725
Opcode Fuzzy Hash: 5c26341aa8f10338cf57669b83da95fb2960708d1176b5b9c74d93ace4facdde
Instruction Fuzzy Hash: 7581A470F083429EDF25DE2888D4755BAD19F62370F4882ADCD968B2D7E3758442E722

Uniqueness

Uniqueness Score: 0.00%

Function 00F08799, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0ad40354aa7490124a58e7620738842b7f8dd1229dc5e7a5102532bc5f98c4
Instruction ID: 63ef1cd3f2dbd4ea04451e465c30ce43b3c805be8753609f8638e4e862f5a60f
Opcode Fuzzy Hash: 6b0ad40354aa7490124a58e7620738842b7f8dd1229dc5e7a5102532bc5f98c4
Instruction Fuzzy Hash: 00E06D3E3102008FC314CA28C9C4F55B3A1AB593A0F254555E9818B2E9CA34EC41F610

Uniqueness

Uniqueness Score: 0.00%

Function 00F04109, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe73df34f80c548d7f38e4da902f382a4500c5c07af9d1c34425ce2ab83f480e
Instruction ID: 69ca0ad0998cba72f24453d1fa79299cab4a71c97103bf1c9cf6a5a198bfed4e
Opcode Fuzzy Hash: fe73df34f80c548d7f38e4da902f382a4500c5c07af9d1c34425ce2ab83f480e
Instruction Fuzzy Hash: 32C04CB6240481CFEF55DA08C891B947361B769744BD944D0E046CBA95C318ED41DA00

Uniqueness

Uniqueness Score: 0.00%

Function 00F081B7, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8975aa85ffa681981e648174b86ff935b29160b824c6080d71e9c0c58d4292
Instruction ID: b933d7a8f0b1c7a96fb1429829bcf9fa5e697247fe5bddf5ae2b1ed24a185623
Opcode Fuzzy Hash: 7a8975aa85ffa681981e648174b86ff935b29160b824c6080d71e9c0c58d4292
Instruction Fuzzy Hash: 03B092313106408FCA51CE19C1D0F80B3E0BF00A40B8244A4E00187A51C364E804C900

Uniqueness

Uniqueness Score: 0.00%

Function 00F09E56, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.24300444936.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_f00000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1985188533ae361fcbfaf6301ae5d8934191e8d79537ea20f659d31287449d5
Instruction ID: b36b371992250da8c45f1cd1506764a1d816c012ef71655a4cc1844282d2f311
Opcode Fuzzy Hash: d1985188533ae361fcbfaf6301ae5d8934191e8d79537ea20f659d31287449d5
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: 0.00%

Analysis Process: anibtcent.exe.exe PID: 4188 Parent PID: 1440 anibtcent.exe.exeCOMMON

Execution Graph

Execution Coverage:	26.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	29
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 050F01B7, Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.24074442346.00000000050F0000.00000040.00000001.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_50f0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82abebe9a4b3d6a5e35ee93902062a59404021cc8cbe326cc96360b5dd55f62
Instruction ID: 6eda280f46b44ebd9b3992b5144409a7d52d54a97928b41ffc097586e83482ea
Opcode Fuzzy Hash: b82abebe9a4b3d6a5e35ee93902062a59404021cc8cbe326cc96360b5dd55f62
Instruction Fuzzy Hash: 2332C234704209DFDB18EF24E5A8A6EB7F3FF88300F148569D6469B656DB71E841CB90

Uniqueness

Uniqueness Score: 0.00%

Function 0113A4AA, Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,260ADA47,00000000,00000000,00000000,00000000), ref: 0113A53D

Memory Dump Source

Source File: 00000010.00000002.24070163946.000000000113A000.00000040.00000001.sdmp, Offset: 0113A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_113a000_anibtcent.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 7a7f23b56fc261d4f61782e4dc0d2d488081a48e2205fdb7ee5c0754e1332c44
Instruction ID: a62bccc3e848b95e08a373406e242c59552dbc2e32928b2ad75e1987ffcd971a
Opcode Fuzzy Hash: 7a7f23b56fc261d4f61782e4dc0d2d488081a48e2205fdb7ee5c0754e1332c44
Instruction Fuzzy Hash: 3E2160715093806FD7228B659C84B96BFB8EF46210F08859BE9849B1A3D365A509CB71

Uniqueness

Uniqueness Score: 0.01%

Function 0113A35A, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0113A3C0

Memory Dump Source

Source File: 00000010.00000002.24070163946.000000000113A000.00000040.00000001.sdmp, Offset: 0113A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_113a000_anibtcent.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3abde9e919563c395dfa5d6a329b574c3e1dd5af08c8d49e6a24f24a81e31fd2
Instruction ID: 87714cabf8a589e0a3bd9096cb68c441f14ed147e8a1cf166d9b5b170afe1c76
Opcode Fuzzy Hash: 3abde9e919563c395dfa5d6a329b574c3e1dd5af08c8d49e6a24f24a81e31fd2
Instruction Fuzzy Hash: 6C21AF715093C09FD7128B25DC85792BFB4EF42220F0984EBED85CF263C278A948CB61

Uniqueness

Uniqueness Score: 0.13%

Function 0113A4DE, Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,260ADA47,00000000,00000000,00000000,00000000), ref: 0113A53D

Memory Dump Source

Source File: 00000010.00000002.24070163946.000000000113A000.00000040.00000001.sdmp, Offset: 0113A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_113a000_anibtcent.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fe62f967c8858bb1c227c34ca0b7fc11b0b407452c316ec232bb7cec836fcc38
Instruction ID: 024b62690642d8c7c9ae614eaf85088113cda0e0b8584cdb7f2473722fd05b81
Opcode Fuzzy Hash: fe62f967c8858bb1c227c34ca0b7fc11b0b407452c316ec232bb7cec836fcc38
Instruction Fuzzy Hash: FF110472500340AFEB21DF55EC84BA6FBA8EF84320F04845AED85DB296C375A504CBB1

Uniqueness

Uniqueness Score: 0.01%

Function 0113A23C, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 0113A28D

Memory Dump Source

Source File: 00000010.00000002.24070163946.000000000113A000.00000040.00000001.sdmp, Offset: 0113A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_113a000_anibtcent.jbxd

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 68e671d9fbed6bef47b3f2c6b789e1174bc38f8fdb197dd15df7c600c43209da
Instruction ID: 7935d82d8b08bd0e3ed31e273c3d5bca71f34c09e3bae6e2da761a0ed723b020
Opcode Fuzzy Hash: 68e671d9fbed6bef47b3f2c6b789e1174bc38f8fdb197dd15df7c600c43209da
Instruction Fuzzy Hash: 720180755097C49FC7128B55DC84B52FFA4EF46220F0980DAED858F263D279A948CBA2

Uniqueness

Uniqueness Score: 2.84%

Function 0113A38E, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0113A3C0

Memory Dump Source

Source File: 00000010.00000002.24070163946.000000000113A000.00000040.00000001.sdmp, Offset: 0113A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_113a000_anibtcent.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b1e500ce6273db27bc4dad71a07d932dcd62cb6ef073223e98408b356583ede6
Instruction ID: 8f773958c564545825fc1e3d4011cdbd2a6cc1d0c080148c5e8c98b567f23524
Opcode Fuzzy Hash: b1e500ce6273db27bc4dad71a07d932dcd62cb6ef073223e98408b356583ede6
Instruction Fuzzy Hash: 750184716042809FDB15CF59E889766FBA4DF84321F08C0ABDD49CB246D7B5A544CA62

Uniqueness

Uniqueness Score: 0.13%

Function 0113A25E, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 0113A28D

Memory Dump Source

Source File: 00000010.00000002.24070163946.000000000113A000.00000040.00000001.sdmp, Offset: 0113A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_113a000_anibtcent.jbxd

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 22ed77aa28a0569e2aea4da7dae4b5e1c1d73b2fc4e1d48d4a2ee728a4510369
Instruction ID: fffcc47284dcdd7e8e19388592abe298bc5690387521b416c3822c0dd559dbfe
Opcode Fuzzy Hash: 22ed77aa28a0569e2aea4da7dae4b5e1c1d73b2fc4e1d48d4a2ee728a4510369
Instruction Fuzzy Hash: DEF0C2315047849FDB10CF45E888761FBA4DF85621F08C09ADD498F74AD77AA544CAA2

Uniqueness

Uniqueness Score: 2.84%

Function 050F0710, Relevance: .4, Instructions: 446
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.24074442346.00000000050F0000.00000040.00000001.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_50f0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 061ceef60f6fdc251eb6d622335097e582d77972d28656a5c7e6d1185f16ac30
Instruction ID: eff4db0d22138909e8479be24e22894fc07b60b80ac22a742720689a1d35fe6d
Opcode Fuzzy Hash: 061ceef60f6fdc251eb6d622335097e582d77972d28656a5c7e6d1185f16ac30
Instruction Fuzzy Hash: 3F02A034B002159FCB18EB68D9A4A6EB7F2FFC8304F148569D51A9B356DB71EC41CBA0

Uniqueness

Uniqueness Score: 0.00%

Function 050F00B9, Relevance: .1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.24074442346.00000000050F0000.00000040.00000001.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_50f0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260b649790fa25de54f7279851ec8a7a7251e2e2dbce899050b6d3e8e9f26f27
Instruction ID: a240ec30e7ee37e4675be1de272b4cf62be477ea6d64e74dc9e03ae93d9519ca
Opcode Fuzzy Hash: 260b649790fa25de54f7279851ec8a7a7251e2e2dbce899050b6d3e8e9f26f27
Instruction Fuzzy Hash: DF213B347042009FCB59AB78D068A6D3BF6AFEA314B2445B9D016CF7A6DE36CC45CB91

Uniqueness

Uniqueness Score: 0.00%

Function 050F0DA0, Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.24074442346.00000000050F0000.00000040.00000001.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_50f0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44de45788e7632063d160c8574f1baa077aa25bbfdad559145ca81bd6258e503
Instruction ID: 349d0df34fdbab325ed8c3fa73012d5c3f31a36e2085ea1cd1256a4090e8ce3a
Opcode Fuzzy Hash: 44de45788e7632063d160c8574f1baa077aa25bbfdad559145ca81bd6258e503
Instruction Fuzzy Hash: DF014530B102189BC308BBB8E82479D7BA9BFC6620F1480AAD4199B291CE749E05CB95

Uniqueness

Uniqueness Score: 0.00%

Function 029C0648, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.24070737096.00000000029C0000.00000040.00000040.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29c0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc868b93385fc884ba98a1821e80f42acbeb22af54ad6b88a79e8fcc00270adc
Instruction ID: ceff1bd1737ccdc85dd03a7a790cb37ad0d69f48126fceff50e441a98ce28ebf
Opcode Fuzzy Hash: bc868b93385fc884ba98a1821e80f42acbeb22af54ad6b88a79e8fcc00270adc
Instruction Fuzzy Hash: B401F7724097809FC312CF16EC41852BFB8DF86630B1484AFD849CB652D635A808CBA2

Uniqueness

Uniqueness Score: 0.00%

Function 029C05DF, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.24070737096.00000000029C0000.00000040.00000040.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29c0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd37379c7bc78e6a7e14ff055c4d78c2e9b4571a2f7da3dceb36a889f09d44e6
Instruction ID: 44150c6f2c82b12d19725b29e9d14705d65ceb23137fe8cf83269e9e24a2e58e
Opcode Fuzzy Hash: fd37379c7bc78e6a7e14ff055c4d78c2e9b4571a2f7da3dceb36a889f09d44e6
Instruction Fuzzy Hash: 5101D6B550D3C46FD7128F16DC40862FFB8DE86530708C4DFEC898B652C125A909CB72

Uniqueness

Uniqueness Score: 0.00%

Function 050F0047, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.24074442346.00000000050F0000.00000040.00000001.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_50f0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249bbfde6cfb7e5c4ff5fb6221629cfb27952de86bf32bd738db89bdcd3d4091
Instruction ID: f0cd986636a6e7eded91613463ea41b2137fb28542f3e00827b9b5f49798281d
Opcode Fuzzy Hash: 249bbfde6cfb7e5c4ff5fb6221629cfb27952de86bf32bd738db89bdcd3d4091
Instruction Fuzzy Hash: CBF0EC7AA243489FCB15CF61E8945CDBFF9FE45120B0481A7E545C3602FA355641C760

Uniqueness

Uniqueness Score: 0.00%

Function 050F0D19, Relevance: .0, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.24074442346.00000000050F0000.00000040.00000001.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_50f0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631f4087f62b42510177545c17fe083cc072c89e9c0dc359326d75b87c0367e6
Instruction ID: 3aec2bfc35c8d28453c8d892ec51d79d3fbeefede477c5c29676020f9786c12d
Opcode Fuzzy Hash: 631f4087f62b42510177545c17fe083cc072c89e9c0dc359326d75b87c0367e6
Instruction Fuzzy Hash: 67F0FA367042242BE70C6779A8146AE6AFAEBD9228F24003AE019CB394DE364C0183A0

Uniqueness

Uniqueness Score: 0.00%

Function 050F0070, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.24074442346.00000000050F0000.00000040.00000001.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_50f0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b42d6b9db6138afb0a757910d0d84150208d3b79bc430854d661ba20e703ac
Instruction ID: afdfe6271e2aea61a233ffbfcf3a3ca7bef4f32fadfb7821d7337333b1572773
Opcode Fuzzy Hash: 34b42d6b9db6138afb0a757910d0d84150208d3b79bc430854d661ba20e703ac
Instruction Fuzzy Hash: 4BE0653A714219EF8B18DFA5F4484DEBBE9FA44561B108176E519C3104EA3155808754

Uniqueness

Uniqueness Score: 0.00%

Function 029C0606, Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.24070737096.00000000029C0000.00000040.00000040.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_29c0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa29b7b8513ad87b73379592fc27a5e4910fae2be694fc6ca7b3db1c7fab75a
Instruction ID: f447113be7cbac9e3043215f0e60f6119051efe19fdd75ce17759e2f5e3e9c8b
Opcode Fuzzy Hash: 1fa29b7b8513ad87b73379592fc27a5e4910fae2be694fc6ca7b3db1c7fab75a
Instruction Fuzzy Hash: FFE092B66046048BD650DF0AEC81462FBE8EBC4630B18C47FDC0D8B704D575B504CAA1

Uniqueness

Uniqueness Score: 0.00%

Function 050F0CC8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.24074442346.00000000050F0000.00000040.00000001.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_50f0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443dcaf4278bbb9a89c11722a322bde44a1416117a281ecfa0e5d5dec85a9d1f
Instruction ID: 0a2e6fb3e86d3430bc8fad3107d2e0848b3fd533c86caab74f82cfe0868108cd
Opcode Fuzzy Hash: 443dcaf4278bbb9a89c11722a322bde44a1416117a281ecfa0e5d5dec85a9d1f
Instruction Fuzzy Hash: E6E02B39250198DFD710DB74F018FA13BE9BB05620F1040ABD5298322BCB709884C7C0

Uniqueness

Uniqueness Score: 0.00%

Function 050F0D90, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.24074442346.00000000050F0000.00000040.00000001.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_50f0000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812081e65b55e6565c98d49b4076d7e5e7c0563b90c6c5a64eaad000329c9268
Instruction ID: 72e5579e0b8a9f9b3c032f7c2d1c265f25edfb7afb175fbc47109e68b53a7cf4
Opcode Fuzzy Hash: 812081e65b55e6565c98d49b4076d7e5e7c0563b90c6c5a64eaad000329c9268
Instruction Fuzzy Hash: FED0A77960527493CB2497F6B8043DCBF78BB41920F54026ED959C7142FB125A2C83E2

Uniqueness

Uniqueness Score: 0.00%

Function 011323F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.24070116792.0000000001132000.00000040.00000001.sdmp, Offset: 01132000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1132000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e427aa1f989c471d884c9f11e852bb017f689268d1dda3d72e503bbc58b3fb
Instruction ID: d322876316abadef6189c20d57460131dc295c7e14c2d77f44464b2d55263f81
Opcode Fuzzy Hash: e6e427aa1f989c471d884c9f11e852bb017f689268d1dda3d72e503bbc58b3fb
Instruction Fuzzy Hash: B2D05E793056818FE31AAE1CC1A9B953FA4AB91B04F5644FAE8008B667C368E681D200

Uniqueness

Uniqueness Score: 0.00%

Function 011323BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.24070116792.0000000001132000.00000040.00000001.sdmp, Offset: 01132000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1132000_anibtcent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275546e01e273bfe2c7d880ee90289591a517e7e25b6ae11e1235ba6fcc1084a
Instruction ID: 5bd3de1cb91b91396c8134f2f949e7113e737f42ecf90505f36818ec4fc8db1f
Opcode Fuzzy Hash: 275546e01e273bfe2c7d880ee90289591a517e7e25b6ae11e1235ba6fcc1084a
Instruction Fuzzy Hash: DED05E352442814BEB19EE0CC1D8F597BD4AB85B04F0644E8BC008B266C3B4D980C600

Uniqueness

Uniqueness Score: 0.00%

Non-executed Functions

Analysis Process: demisphereklediskene.exe PID: 1812 Parent PID: 4560 demisphereklediskene.exeCOMMON

Executed Functions

Non-executed Functions

Function 021C0AA2, Relevance: 1.3, Strings: 1, Instructions: 46UNIQUE

Download Yara Rule

Strings

p2#S, xrefs: 021C0AA4

Memory Dump Source

Source File: 00000012.00000002.24230481090.00000000021C0000.00000040.00000001.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_21c0000_demisphereklediskene.jbxd

Similarity

API ID:
String ID: p2#S
API String ID: 0-559888721
Opcode ID: b19cc858955087cea543e3bf5139ade1abf38dd807ac0e4cea38e9fcd72fd3b9
Instruction ID: ee09320729a991d068d46784f6fc47eb26baac0590f5af40159d4671a67d94ef
Opcode Fuzzy Hash: b19cc858955087cea543e3bf5139ade1abf38dd807ac0e4cea38e9fcd72fd3b9
Instruction Fuzzy Hash: 140144BA5983A38FD736AB38CD49AD43B20EB01690B604658D5504F2A3E361985BCFE0

Uniqueness

Uniqueness Score: 100.00%

Function 021C0A3F, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.24230481090.00000000021C0000.00000040.00000001.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_21c0000_demisphereklediskene.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57de28597d839a7ba814a9063e1b1ddec0595cef12b05119d96ced5d1b9c9648
Instruction ID: 6a9ba9ef6124f194d465a45a0cfe2e5a9feb6a7d987247f0a30ff88222f947c2
Opcode Fuzzy Hash: 57de28597d839a7ba814a9063e1b1ddec0595cef12b05119d96ced5d1b9c9648
Instruction Fuzzy Hash: BD2168BA9587969FE732CB38CC85BC4BB60EB45340B69468DC0804F283E726944BCA80

Uniqueness

Uniqueness Score: 0.00%

Analysis Process: RegAsm.exe PID: 4328 Parent PID: 1812 RegAsm.exeUNIQUE

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	3.3%
Signature Coverage:	68.4%
Total number of Nodes:	583
Total number of Limit Nodes:	4

Executed Functions

Function 00C305E5, Relevance: 11.5, APIs: 2, Strings: 4, Instructions: 958
nativethreadUNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(00C30613,?,00000000,00C3643A,00C35F92,?,00C331E6,?,?,?,?,?,00000000,00000004,00000000,00000000), ref: 00C305F4
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00C30AC8

Strings

249E, xrefs: 00C35A6E
249E, xrefs: 00C35A84
1.!T, xrefs: 00C30AA4
shell32, xrefs: 00C35F1D

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T$249E$249E$shell32
API String ID: 1954852945-4191954164
Opcode ID: ef336fe1ccbfa999da492ee3b533c1c2b5a0f666d657459043e314add5ecdc56
Instruction ID: d92168b9f47fe779e9444ab1e3c852425cbfa68fc0c748bba569c72db4d081ac
Opcode Fuzzy Hash: ef336fe1ccbfa999da492ee3b533c1c2b5a0f666d657459043e314add5ecdc56
Instruction Fuzzy Hash: 4652E293E2E9143B96A05D29FCE23AB96E55751310FB8E2099E119F74FE76CF80243C1

Uniqueness

Uniqueness Score: 100.00%

Function 00C316BE, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 558
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.!T, xrefs: 00C30AA4

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 1.!T
API String ID: 0-3147410236
Opcode ID: f37ffea9538b30e627322f44a590c35cec46f9b9056e11cc572dd1554f423dad
Instruction ID: ad2ead207169fba45a7910bc273afb8bb939989a79980ad655ccb01ee9f8f9c8
Opcode Fuzzy Hash: f37ffea9538b30e627322f44a590c35cec46f9b9056e11cc572dd1554f423dad
Instruction Fuzzy Hash: 71024670B60349AFEF305E64CC92BDA3762EF46750F644129FE449B2C1CBB99989DB01

Uniqueness

Uniqueness Score: 100.00%

Function 00C30631, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 486
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C381CF: LoadLibraryA.KERNEL32(?,B769339E,?,00C30A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00C304BD,00000000), ref: 00C3822B

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00C30AC8

Strings

1.!T, xrefs: 00C30AA4

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: 075b58a0557ade9534a3dec0b9382b3f104376bb3c31c7d4d482421de13dbc5e
Instruction ID: af40867200b41dcca47869dce27590a3529cd58d69e7a1e98ca2d87bda4683b4
Opcode Fuzzy Hash: 075b58a0557ade9534a3dec0b9382b3f104376bb3c31c7d4d482421de13dbc5e
Instruction Fuzzy Hash: E2E1CE93E2E6147FA6A05D29E8E279FA2D24750300FB8D1099E119F78DE7ACFC4643C1

Uniqueness

Uniqueness Score: 1.91%

Function 00C311F0, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 295
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00C30AC8

Strings

1.!T, xrefs: 00C30AA4

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: be423587d4f69cb26d68848b99c0aff552a16ecf015ed77986f47de5f307b8fb
Instruction ID: 8725311e67224f41c09769ce1c7c7548cefe4f3dc66020448b966db7601fd2c4
Opcode Fuzzy Hash: be423587d4f69cb26d68848b99c0aff552a16ecf015ed77986f47de5f307b8fb
Instruction Fuzzy Hash: F2918C70B60305AFEF346EA48CE2BDE3752AF42750F680116FD559B1C1CF75C98A9A12

Uniqueness

Uniqueness Score: 1.91%

Function 00C31719, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 290
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00C30AC8

Strings

1.!T, xrefs: 00C30AA4

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: ae82644baae1b2402e6816c366610ef02a75366e36d6af6e31ebde68cc31dee5
Instruction ID: 9d6896cad66a5ddd1f342968c2ff863b879b01875dcb12f6df0cc32e24cee477
Opcode Fuzzy Hash: ae82644baae1b2402e6816c366610ef02a75366e36d6af6e31ebde68cc31dee5
Instruction Fuzzy Hash: 1C919B30B60305AFFF306E649C96BDE3652AF82750F68012AFD44AB1C1CFB5DD8A9611

Uniqueness

Uniqueness Score: 1.91%

Function 00C30629, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 234
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C381CF: LoadLibraryA.KERNEL32(?,B769339E,?,00C30A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00C304BD,00000000), ref: 00C3822B

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00C30AC8

Strings

1.!T, xrefs: 00C30AA4

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: 26056ae46e39905a1e3d51aefb313d98131d031c7a56edcbf01291416ea960fa
Instruction ID: 60f95ca0ca26b6c9d97d37373684535416c1673de6e1592d637491a9739d5120
Opcode Fuzzy Hash: 26056ae46e39905a1e3d51aefb313d98131d031c7a56edcbf01291416ea960fa
Instruction Fuzzy Hash: C661CE70B60305AFFF346E649CE2BDE2652AF42750F68012AFC45971C1CFB4C98E9612

Uniqueness

Uniqueness Score: 1.91%

Function 00C30A7A, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 219
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00C30AC8

Part of subcall function 00C381CF: LoadLibraryA.KERNEL32(?,B769339E,?,00C30A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00C304BD,00000000), ref: 00C3822B

Strings

1.!T, xrefs: 00C30AA4

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: 4d18b91f56fdd8792a63588e8d1d224e2a450ae394e87829301782603fa06be9
Instruction ID: 80d84bc7e909577d50205b818e3f5e829037a9c2ad6fa7ac0efbcba7f2ed47ab
Opcode Fuzzy Hash: 4d18b91f56fdd8792a63588e8d1d224e2a450ae394e87829301782603fa06be9
Instruction Fuzzy Hash: 4551BA30B60305AFFF3429649CE6BDE2712AF42750F68012AFD549B1C1CFB4D98E9612

Uniqueness

Uniqueness Score: 1.91%

Function 00C39EF3, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.!T, xrefs: 00C30AA4

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 1.!T
API String ID: 0-3147410236
Opcode ID: 3354b6e6c4ee9e5599cef383cbfd7b4a2cffadf4d1ffec653b6aa3ce2308c8d6
Instruction ID: 9089e07874a17f2e4cb0ada4272eb7746d856d2d8deca8d740abf0b2a6092e37
Opcode Fuzzy Hash: 3354b6e6c4ee9e5599cef383cbfd7b4a2cffadf4d1ffec653b6aa3ce2308c8d6
Instruction Fuzzy Hash: 83216B75B60305AFEF30BEA48D62BDD35D29F88760F704126FE416B2C4DA78D8825B05

Uniqueness

Uniqueness Score: 100.00%

Function 00C32A91, Relevance: 3.1, APIs: 2, Instructions: 106
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000800,?,00000000,00000011,00000000,00000000,?,00000000,00000000,Function_0000A810,00000000,00000000,00000000), ref: 00C32B2E

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cb8104912665ef0133ece89a500bfd49e73c1bea20618522217c05156157e0d2
Instruction ID: 023fc180cb9d414c7f497662cf52a9f59def010dbef91e55b097315632a76d31
Opcode Fuzzy Hash: cb8104912665ef0133ece89a500bfd49e73c1bea20618522217c05156157e0d2
Instruction Fuzzy Hash: 8F310070614701AFFB28AE68CD59BE8B3A2AF057A4F544258FD519B1D2D7B1D880CA11

Uniqueness

Uniqueness Score: 0.00%

Function 00C39F12, Relevance: 1.8, APIs: 1, Instructions: 335
nativethreadUNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00C30AC8
NtQueryInformationProcess.NTDLL(?,?,?,?,000000C0,?,?,00000000,?,00C304BD,00000000), ref: 00C3A7D8

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: Information$ProcessQueryThread
String ID:
API String ID: 142225228-0
Opcode ID: 00133cc32faff595a26c4de06b7b911790b2ec6a7b4a7baf7a59f1db3d213b15
Instruction ID: fd95da02b5d06ab83e162b6509c9c5f69399b2f027fe3ca99920311dce34e86c
Opcode Fuzzy Hash: 00133cc32faff595a26c4de06b7b911790b2ec6a7b4a7baf7a59f1db3d213b15
Instruction Fuzzy Hash: A0B10993E2E5146F66A08D2DE4D13AEA2E257A5310BF8D1188E619F78DF36CFD4243C1

Uniqueness

Uniqueness Score: 100.00%

Function 00C3A30D, Relevance: 1.8, APIs: 1, Instructions: 329
nativethreadUNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,000000C0), ref: 00C30AC8
NtQueryInformationProcess.NTDLL(?,?,?,?,000000C0,?,?,00000000,?,00C304BD,00000000), ref: 00C3A7D8

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: Information$ProcessQueryThread
String ID:
API String ID: 142225228-0
Opcode ID: be58969baf69663eeee644a64fb9ef284b25a6643e8ecf1cff3a39de77eeaf43
Instruction ID: 6573cc18fa21c6a683cdb32346d6c2a35e8309c1736688324ee92b409c612590
Opcode Fuzzy Hash: be58969baf69663eeee644a64fb9ef284b25a6643e8ecf1cff3a39de77eeaf43
Instruction Fuzzy Hash: 50B1FA93E1E5146F66A48D2DE4D13AEA2E257A13107F8D1188E619F78DF36CFD4243C1

Uniqueness

Uniqueness Score: 100.00%

Function 00C3A824, Relevance: 1.5, APIs: 1, Instructions: 15nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,000000C0,?,?,00000000,?,00C304BD,00000000), ref: 00C3A7D8

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 79751bbd70b7e6565d9dd082c8a01e4ceabf00169ce343474bf4350be8c7e97c
Instruction ID: ee2e6f07f7eda139197c809ad2e5c008748412c27df5220ee56f31581a8be4fc
Opcode Fuzzy Hash: 79751bbd70b7e6565d9dd082c8a01e4ceabf00169ce343474bf4350be8c7e97c
Instruction Fuzzy Hash: D9D012352143024E6B1DEE24C1D65693776AED6354B588008CA5106418F2236EAAC762

Uniqueness

Uniqueness Score: 0.01%

Function 00C39B4C, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,00C39515,00000040,00C30A94,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00C39B65

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032

Uniqueness

Uniqueness Score: 0.03%

Function 00C352B9, Relevance: 3.1, APIs: 2, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00C35AC4,00000000,00000000,00000000,00000000,00C3124E,00000000,00000000,00000000,00000000,0000006D,0000020C,?,00C35A48,00000000,000000FF), ref: 00C352C9
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004,?,00000004,00000000,?,00000000), ref: 00C3532E

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: bc5163e42e9add266c6683ac9f16a41edb28294c7a844079115d7c557696cb88
Instruction ID: 9a00d104b1d98ae9b1dd0a681319cc467719d854ea630400ffd9a73297a2936b
Opcode Fuzzy Hash: bc5163e42e9add266c6683ac9f16a41edb28294c7a844079115d7c557696cb88
Instruction Fuzzy Hash: DB31933065438AEFEF35CE64CD55FEE3666EF04740F508429FD4A9A190D7729A84EB10

Uniqueness

Uniqueness Score: 4.01%

Function 00C317CE, Relevance: 1.9, APIs: 1, Instructions: 369
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNEL32(80000001,00C368D8,00000000,00000000,00000000,000F003F,00000000,?,?,00C31137,?,?,00000000,00000000,000000FF,00000007), ref: 00C317FE

Part of subcall function 00C31820: RegSetValueExA.KERNELBASE(?,00C368C2,00000000,00000001,?,?,?,?,?,?,00C31137,?,?,00000000,00000000,000000FF), ref: 00C31831

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateValue
String ID:
API String ID: 2259555733-0
Opcode ID: 502ffc77333b3ead3e48a26d063047435d608c0ded7f583f21f06490bcde5c1c
Instruction ID: c3e627e9c410bcc4084109a7ccb9e0cce948da5780c9e5133b0c036d691500b6
Opcode Fuzzy Hash: 502ffc77333b3ead3e48a26d063047435d608c0ded7f583f21f06490bcde5c1c
Instruction Fuzzy Hash: 67C16CD3D2E5543FA2918D29E8A63AEE6E117613007B8D2498E515F79EF36CFD0243C1

Uniqueness

Uniqueness Score: 0.14%

Function 00C32B50, Relevance: 1.8, APIs: 1, Instructions: 275
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32(000000FE,00000000), ref: 00C32F78

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 6670c59fd34363fb74b30b30c27a4bf1a5391331b13fca0eaddc9fd4ae2d1e1f
Instruction ID: 588ba526f6859e4ed735627b89a88120e583cf20e1c4f6089979a1b07c4b1a50
Opcode Fuzzy Hash: 6670c59fd34363fb74b30b30c27a4bf1a5391331b13fca0eaddc9fd4ae2d1e1f
Instruction Fuzzy Hash: 32913393E5E5183F66A04C2DF8A67AEA2E243907007F4D2049F126F78DF3ACBC4206C0

Uniqueness

Uniqueness Score: 1.31%

Function 1D89B9BA, Relevance: 1.6, APIs: 1, Instructions: 99
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSecurityW.KERNELBASE(?,?,0A1AC197,00000000), ref: 1D89BA63

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: FileSecurity
String ID:
API String ID: 200422441-0
Opcode ID: c3acb4a7f354ee0913d4f5ead1e638dd457baf0b9e38a5c5d6c9eb8a0e4f69e1
Instruction ID: 67c85427a4533333c214f7b5b865c419ad403c0a9db2b18fee58ffeff83d7365
Opcode Fuzzy Hash: c3acb4a7f354ee0913d4f5ead1e638dd457baf0b9e38a5c5d6c9eb8a0e4f69e1
Instruction Fuzzy Hash: 7D31506150E3C05FD7038B749CA5652BFB49F57214B0E84DBD8C4CF1A3D229A849C772

Uniqueness

Uniqueness Score: 100.00%

Function 1D89A686, Relevance: 1.6, APIs: 1, Instructions: 97registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EB4), ref: 1D89A731

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 071a1eada05b80ffb9704ece2c92b82c5db646fed447b7d43f40c1be61f34b0e
Instruction ID: be895e503007d706e839ca12ced3191e14ab0128cf90d7164d45974f4b3e65d0
Opcode Fuzzy Hash: 071a1eada05b80ffb9704ece2c92b82c5db646fed447b7d43f40c1be61f34b0e
Instruction Fuzzy Hash: 1731C1B11093806FE7128B648C85FA7FFBCEF46210F08849BF985DB193D224A909C772

Uniqueness

Uniqueness Score: 0.01%

Function 00C393ED, Relevance: 1.6, APIs: 1, Instructions: 94libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,B769339E,?,00C30A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00C304BD,00000000), ref: 00C3822B

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 75225bba369b5256672b6e8c27de006746047b5c26f70e36a30c11dd7c9d6c16
Instruction ID: 5281e66024f92f62c96b394af057b714089515eb0eb46c3312374725c9423987
Opcode Fuzzy Hash: 75225bba369b5256672b6e8c27de006746047b5c26f70e36a30c11dd7c9d6c16
Instruction Fuzzy Hash: F9213BB47143179ADB24AE68C4E07FB27A2EF56750FA4412CFC9687106DB75CC4B8641

Uniqueness

Uniqueness Score: 0.01%

Function 1D89A779, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,0A1AC197,00000000,00000000,00000000,00000000), ref: 1D89A834

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c6d1e2b3ea1fbc7c4d3faa696deaea708056cbd98923ff2b83d089a4e89c3520
Instruction ID: 3099faa79538f4cfd127a62d259e4eec24abf1a4cf9550a3ffaa3c334c6d479f
Opcode Fuzzy Hash: c6d1e2b3ea1fbc7c4d3faa696deaea708056cbd98923ff2b83d089a4e89c3520
Instruction Fuzzy Hash: 6D31A1755053846FE722CF21CC84FA3FFA8EF46610F08849AE985DB153D264E549CB61

Uniqueness

Uniqueness Score: 0.02%

Function 1D89BAB8, Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 1D89BB51

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: b6e17f06fa179f3d38a7408c5f56e06b98ac442780c2806bd503504f8fb99076
Instruction ID: be144f5fbb854a74b0c1d83ad40b5a1d1f4a841bccf3d8fff6efce6f4203da4a
Opcode Fuzzy Hash: b6e17f06fa179f3d38a7408c5f56e06b98ac442780c2806bd503504f8fb99076
Instruction Fuzzy Hash: A63180B5505384AFE712CB25CC85F66FBE8EF45610F05849AE984CB292D365E908CB71

Uniqueness

Uniqueness Score: 0.03%

Function 1D89A88A, Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,?,?), ref: 1D89A926

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4196d41a5541e2fa42bd61294e580b5a4e4dc3513a76e6cf2a50f8379eacf318
Instruction ID: 1d2388fe6706f6490216890c424f15c47bca7bca4e999bb26d2e7356c282d4fa
Opcode Fuzzy Hash: 4196d41a5541e2fa42bd61294e580b5a4e4dc3513a76e6cf2a50f8379eacf318
Instruction Fuzzy Hash: A321C8755093C06FD3138B258C51B62BFB8EF87A10F0981CFE9848B693D265A919C7B2

Uniqueness

Uniqueness Score: 0.02%

Function 00C32B4A, Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(000000FE,00000000), ref: 00C32F78

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 7793c82ec79c2428207682b383148305938dfb2e6feb53ae70cce6dc9d2de6ad
Instruction ID: 7a450f0de8de004e057a76931e51ba8bbbedb2714abcd1ed67f3fe06b3565cb5
Opcode Fuzzy Hash: 7793c82ec79c2428207682b383148305938dfb2e6feb53ae70cce6dc9d2de6ad
Instruction Fuzzy Hash: 221134B0750301AFEB205E688D8AFED3365EF05360FE00262FD129B1D2D760DCC28A26

Uniqueness

Uniqueness Score: 1.31%

Function 1D89A6B2, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EB4), ref: 1D89A731

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e30145906b97d9321a09fca028b0bc85016f3db82bda875bd45f80ed62434b10
Instruction ID: 36229ea16bbfc98e69579a5f9afe793b58915a5c2e7c09d9c5927cf4fe0d29ca
Opcode Fuzzy Hash: e30145906b97d9321a09fca028b0bc85016f3db82bda875bd45f80ed62434b10
Instruction Fuzzy Hash: EB21CFB2500704BFEB21DF55DC85FABF7ECEF84610F04845AF985DB251D624E6088AB2

Uniqueness

Uniqueness Score: 0.01%

Function 1D89B2F7, Relevance: 1.6, APIs: 1, Instructions: 74libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EB4), ref: 1D89B397

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ad90aea2e24f00dae85f055ca1a79b7b44f94d5f58aade24af76c28d89a4cd12
Instruction ID: ff5f32502c714b9173267842314f4f05949fe44f68441cc7eaf18fec23c2a3b1
Opcode Fuzzy Hash: ad90aea2e24f00dae85f055ca1a79b7b44f94d5f58aade24af76c28d89a4cd12
Instruction Fuzzy Hash: 9F21D7755493C46FE712CB11CC85BA2FFA8DF42720F0880DAE9849F193D268A949C7B2

Uniqueness

Uniqueness Score: 0.01%

Function 1D89BADE, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 1D89BB51

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 3d0253444f2febc85da9e2dbe4a6fc593a46fa802122d0b41ff8614687e5d32e
Instruction ID: b7a7d282a3df28fa8360faef4d99480de95147feeae214c109444f2b78aa2704
Opcode Fuzzy Hash: 3d0253444f2febc85da9e2dbe4a6fc593a46fa802122d0b41ff8614687e5d32e
Instruction Fuzzy Hash: D421CFB1600244AFE711DF25CC85B66FBE8EF44620F05846AED88CB285D371F904CB72

Uniqueness

Uniqueness Score: 0.03%

Function 1D89A7BA, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,0A1AC197,00000000,00000000,00000000,00000000), ref: 1D89A834

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8ef8596e1fd591ecc9d2e54991add54899be2776da775874bdd2368db75353f4
Instruction ID: 2a5e988c4e90b66f524f109efda8ecf410a6085b616a0d1557eb935fed166675
Opcode Fuzzy Hash: 8ef8596e1fd591ecc9d2e54991add54899be2776da775874bdd2368db75353f4
Instruction Fuzzy Hash: 4A218E75600244AFEB20CF56CC84FA7F7ECEF84610F04845AE989DB252D760E549CAB2

Uniqueness

Uniqueness Score: 0.02%

Function 1D89B32E, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EB4), ref: 1D89B397

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7fc326ea7c004fb3960906221553e8443fd7015c0571ca0a2458255df1b51a52
Instruction ID: 40de7d47f2d5a645223774c8c75515e1c0bbfa34ef168ddb347b79944592d644
Opcode Fuzzy Hash: 7fc326ea7c004fb3960906221553e8443fd7015c0571ca0a2458255df1b51a52
Instruction Fuzzy Hash: F811E575600244AFF721DB15DCC5BA6FB98DF84B20F14C059ED889B281D6B5BA48CAA2

Uniqueness

Uniqueness Score: 0.01%

Function 1D89BA1E, Relevance: 1.6, APIs: 1, Instructions: 52UNIQUE

Download Yara Rule

APIs

GetFileSecurityW.KERNELBASE(?,?,0A1AC197,00000000), ref: 1D89BA63

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: FileSecurity
String ID:
API String ID: 200422441-0
Opcode ID: 7fccff05780e4d0235fdc41725f35f657c7316918af786c595ca0bd1f005a720
Instruction ID: 10554a08d36f28fdb05a27ed357d45171423fbdee6816e5ee199f75773a0d48d
Opcode Fuzzy Hash: 7fccff05780e4d0235fdc41725f35f657c7316918af786c595ca0bd1f005a720
Instruction Fuzzy Hash: F91161716012859FDB14CF19DCC5756FBD8EF44620F08C4AAEC48CB242E675E904CB62

Uniqueness

Uniqueness Score: 100.00%

Function 1D89A2B4, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0A1AC197,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1D89A308

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c7bf5a076db82aae94eb3a089e3b691e9db5b7ef5607a1f7947bc749250b942c
Instruction ID: 6341dcb615835425254423e48a11e5a0d534d9f0be7f987ab609c8a5d7f27e64
Opcode Fuzzy Hash: c7bf5a076db82aae94eb3a089e3b691e9db5b7ef5607a1f7947bc749250b942c
Instruction Fuzzy Hash: F601C4755093C49FC7118F15DC84B52FFB4DF46620F0980DAED898F263D275A908CB62

Uniqueness

Uniqueness Score: 0.01%

Function 1D89A8D6, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB4,?,?), ref: 1D89A926

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: db6b2513dd80209eb9f0455248215f2aca38814ee4dc6150c63aba0f26684cc9
Instruction ID: 9b3825c6f27771b0084d30a901e98d476a54ae8b1d53b22afb012c246d8393a8
Opcode Fuzzy Hash: db6b2513dd80209eb9f0455248215f2aca38814ee4dc6150c63aba0f26684cc9
Instruction Fuzzy Hash: 61016275A40204ABD350DF16DC46B26FBF8FB89B20F14815AED085B781D371F925CAE5

Uniqueness

Uniqueness Score: 0.02%

Function 00C381CF, Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,B769339E,?,00C30A3C,?,?,?,?,?,000000C0,?,?,00000000,?,00C304BD,00000000), ref: 00C3822B

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3b7338d16ccbe36a966adfdfb8fe2abe7cb7d236e4ce9f9e9eefb0cd39a519a0
Instruction ID: 1b425a9abebd9a4cf9964972c25f5a4cd39e17db1a67d0660db4e4710803085b
Opcode Fuzzy Hash: 3b7338d16ccbe36a966adfdfb8fe2abe7cb7d236e4ce9f9e9eefb0cd39a519a0
Instruction Fuzzy Hash: 01F055E0860B0A34FF243B252E26BFF01239F427E4F604228FD5285006CF2AC84F0461

Uniqueness

Uniqueness Score: 0.01%

Function 1D89A2D6, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0A1AC197,00000000,?,?,?,?,?,?,?,?,74123C38), ref: 1D89A308

Memory Dump Source

Source File: 00000013.00000002.24281047274.000000001D89A000.00000040.00000001.sdmp, Offset: 1D89A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d89a000_RegAsm.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: dee67d49048ab42dc18c2c5aeff634dcb49119dbb6e21df359aff02c6b9c57aa
Instruction ID: ee1264542e000dc1f1e38f200ec6b76a44454c9fe046241b71b119e74a46381e
Opcode Fuzzy Hash: dee67d49048ab42dc18c2c5aeff634dcb49119dbb6e21df359aff02c6b9c57aa
Instruction Fuzzy Hash: CEF0AF35604784DFDB10CF46D889762FBA4EF84B21F08C09ADD894B352D275A948DAA2

Uniqueness

Uniqueness Score: 0.01%

Function 00C31820, Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(?,00C368C2,00000000,00000001,?,?,?,?,?,?,00C31137,?,?,00000000,00000000,000000FF), ref: 00C31831

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1beea27a6b604f50d0e8ce8ec9e9f961666e1f60683b56bffe492cc2d8f0247d
Instruction ID: 9428a53115b5da7353f12e8d7339dafa9696524181653009d336d13ff4d8f942
Opcode Fuzzy Hash: 1beea27a6b604f50d0e8ce8ec9e9f961666e1f60683b56bffe492cc2d8f0247d
Instruction Fuzzy Hash: D6C012706407067AF61005544C2AFD36A579F117B0F900305BE75500E4975348508524

Uniqueness

Uniqueness Score: 0.15%

Function 00C37C33, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,00C304A2,00000200,00C318B8,?,?,?,?,00C36953,00C36918,?,?,00C311DE,00000000,000000FF,00000007), ref: 00C37C4D

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: ac5aae0dad25ab8551f9d779720122a49b54a3f9a577bd216295e5e63ae69157
Instruction ID: ef09fb0b1322a84ad82ab9713ca7fd962ccacd7908c5b2b7525d7fe1cb2f05ec
Opcode Fuzzy Hash: ac5aae0dad25ab8551f9d779720122a49b54a3f9a577bd216295e5e63ae69157
Instruction Fuzzy Hash: 4DC012743043006BE710891089C4B5F625DAB90751F10C608F9A6851C1CB3088409621

Uniqueness

Uniqueness Score: 0.11%

Function 00C34C80, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00C34C54,00C34CC4,00C30A9B,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00C34C94

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction ID: 90778f157ef074656d7de284b4bab831f576b04e2021a8a1eff49e75729f027a
Opcode Fuzzy Hash: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction Fuzzy Hash: A4C092717E0300B6FA348A208D57F8A62159B90F00F30840877093C0C085F1B610C62C

Uniqueness

Uniqueness Score: 0.01%

Function 1FC517C8, Relevance: 1.0, Instructions: 1011COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f850e40ddf5bd12217da6d757f737eb11cc38cef69cd5604b7b648674018ec8
Instruction ID: 0e3a39c994b61e6adf9c7a28992dfdabb58577e4472f9b48245133a1cd20b41b
Opcode Fuzzy Hash: 3f850e40ddf5bd12217da6d757f737eb11cc38cef69cd5604b7b648674018ec8
Instruction Fuzzy Hash: 4021BD31F0011ACBCF14ABB9C5A46BEBBB2EFD4300F624865D141AF295DF349D2187A6

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50150, Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6fa1c53744029f150944dfb3b4652af66fdca6e27b6df5abcc62023c9a0597e
Instruction ID: 64783ce98f6518a52912aa7e5b44e9c756e37f4754f6d2472d3a72b4186693e2
Opcode Fuzzy Hash: a6fa1c53744029f150944dfb3b4652af66fdca6e27b6df5abcc62023c9a0597e
Instruction Fuzzy Hash: 28812A34A0021ACFD704DFA8D9D4A9DBBF2FF84305F11856AE006AF2A5DB31AD46DB50

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50D60, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f04c84c50d1d276fceeea9ac9b82785c74c0b21f4dfa9979501fc47b5284acd
Instruction ID: baf2b625ad38b81893d5e0cc104907721336382735c2758206513cb99d4ec81a
Opcode Fuzzy Hash: 6f04c84c50d1d276fceeea9ac9b82785c74c0b21f4dfa9979501fc47b5284acd
Instruction Fuzzy Hash: C551C135784222CBDB049A38CC8074973B2FB84710F514668EA5AEF3A1EB71EC06DB59

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50120, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639cd2afcdefb9ec90e2fed9e44dd37cd9c745e49924431010202548a6c47cb2
Instruction ID: 82b3601272c952815cd6cbdf745b9f6fce9f41325a539603a662e470ee572951
Opcode Fuzzy Hash: 639cd2afcdefb9ec90e2fed9e44dd37cd9c745e49924431010202548a6c47cb2
Instruction Fuzzy Hash: A1516D34A0425ACFD704DBB8D9D4ADDBBF1FF89304F10866AD005EB2A6DB31A846CB50

Uniqueness

Uniqueness Score: 0.00%

Function 1FC515D8, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4950ca3d1080ecf60cdebba6926bf8aed10dc1e138745df27f360c4ec5aec80
Instruction ID: e72220dae0300b693b902f49e4ab40e120834cef23ef3ff4ca9acd0b29dcb099
Opcode Fuzzy Hash: b4950ca3d1080ecf60cdebba6926bf8aed10dc1e138745df27f360c4ec5aec80
Instruction Fuzzy Hash: B841AC38B402118FDB44EBBCC85469D77F2EBD9340F604569C505AB3A2EF36AD02CB95

Uniqueness

Uniqueness Score: 0.00%

Function 1FC51070, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d29d856467fb73a2d9bbe1082df7f6a43990752358ca3d5867a7d4ddc85803
Instruction ID: df2c042848dc297bc5b0d135ab8304cf7cd0f423d6289947a70bc0489d56a966
Opcode Fuzzy Hash: 01d29d856467fb73a2d9bbe1082df7f6a43990752358ca3d5867a7d4ddc85803
Instruction Fuzzy Hash: 51412938B002248FCB04EB68DCD569D77F2FB9835075484A6D805BB29ADB317E46CB64

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50860, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53179f3950ef6032062f9f383dcd37ca253e66325dec8dd36fa6e0f47ce414a7
Instruction ID: 32aee4600bdf5814d9c2e3c7d39139f0e34507d74e3e1985aff00736218225da
Opcode Fuzzy Hash: 53179f3950ef6032062f9f383dcd37ca253e66325dec8dd36fa6e0f47ce414a7
Instruction Fuzzy Hash: 6D319C30B401248BCB44EB7CD8E466EB7F6ABD8340B558529C906EB399DF35AC06C7A5

Uniqueness

Uniqueness Score: 0.00%

Function 1FC51080, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f65d5318e24e87b56b2c1c2c86b7da6b6c4b0e90420f485fa3b542b9c4b8890
Instruction ID: 8a911209f0bacee952fe5bd49fce5f95c1aa92698e99e289e1a01bdd48469092
Opcode Fuzzy Hash: 0f65d5318e24e87b56b2c1c2c86b7da6b6c4b0e90420f485fa3b542b9c4b8890
Instruction Fuzzy Hash: EE411938B002248FCB04EB29CCD599D7BF6FB9835075484A6E805BB25ADF317D46CB64

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50661, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0800b69c39c4cef2314c19f8c519bfda4d4f031be7cecb69c53bd3da525e8f3
Instruction ID: 08dd277c6f0651fe108003533c33272c1bba3af1dcb8fc4d5edde2e756ae87b9
Opcode Fuzzy Hash: d0800b69c39c4cef2314c19f8c519bfda4d4f031be7cecb69c53bd3da525e8f3
Instruction Fuzzy Hash: 44318D35B002149FDB04DB78C895BEEBBF2AB8C310F118479E606EB391DE729C058B95

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50670, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec62c63189b66dd4b2532c628e49f362735e06201e627a1d57454066f45c357
Instruction ID: c0707a3d5230241052b16b621421bca4d802f63f9e64b6dc54ba500e971fe19e
Opcode Fuzzy Hash: 4ec62c63189b66dd4b2532c628e49f362735e06201e627a1d57454066f45c357
Instruction Fuzzy Hash: D3314B34B002149FDB14DB78C894BAEBBF6AB8C710F118579E606EB391DE729C058B95

Uniqueness

Uniqueness Score: 0.00%

Function 1FC51260, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db8f768783a5a6838385ee2ac70f007aeca5de853119d3bfa0bcbc2ae0cb9db
Instruction ID: e176a948d5650b9c2283075174a7562d38cac68b47046099ab21e860539ef9de
Opcode Fuzzy Hash: 5db8f768783a5a6838385ee2ac70f007aeca5de853119d3bfa0bcbc2ae0cb9db
Instruction Fuzzy Hash: 24418B34B042548BEB04DB7DD8987DD7BF5FB94304F118869C111AB266DF356C06CB69

Uniqueness

Uniqueness Score: 0.00%

Function 1FC510AF, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d81237780977460cc0859f34f061aa61c5b8e053cc377627bb8cd9469dd9c42
Instruction ID: c8affbd5925a4af57b008efa112cdfb7e6d03ac765ad0107f6440674ccb34fdf
Opcode Fuzzy Hash: 8d81237780977460cc0859f34f061aa61c5b8e053cc377627bb8cd9469dd9c42
Instruction Fuzzy Hash: 5441F638B002248FCB04EB28DCD559D77F2FB9835035585A6E805BB26ADF317E46CBA4

Uniqueness

Uniqueness Score: 0.00%

Function 1FC51270, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87acf8766713f976a786e68545ba09fe2cd3e575fed5ca6741d8b1656c733b1
Instruction ID: 5a022c35bade5b2978645180602d92e995dd6eeab35c7f33991a8af30c31599d
Opcode Fuzzy Hash: e87acf8766713f976a786e68545ba09fe2cd3e575fed5ca6741d8b1656c733b1
Instruction Fuzzy Hash: 49318834B002188BDB00EB7DD8D879D7BF9FB94304F118869C115AB266DF356C0ACBA9

Uniqueness

Uniqueness Score: 0.00%

Function 1FC517B9, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6f91934b79d9644c66cf203718e7b95a05b43241070ce53698d42aab1a25b5
Instruction ID: 6b7588d87e2565a70ad992fd57bffefbb51321861e849f8725957c0cf9ea8e69
Opcode Fuzzy Hash: 3d6f91934b79d9644c66cf203718e7b95a05b43241070ce53698d42aab1a25b5
Instruction Fuzzy Hash: C321C131F04216CBCF15ABB8D5A46BEBBB2EF90300F624865C041BF295DF349D2187A6

Uniqueness

Uniqueness Score: 0.00%

Function 1FC5084F, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb0f053c9c11693a0b653c7f2757653d845263853126670046c7a6b20bafcdb
Instruction ID: 567f95192db9075026855bf3cbbb6251fbf6feb5654c83a2f930b0025e471abb
Opcode Fuzzy Hash: cfb0f053c9c11693a0b653c7f2757653d845263853126670046c7a6b20bafcdb
Instruction Fuzzy Hash: 4121D335B441258FCB04DB7CD8D069E7BF2AB98341B458625C805DB39ADF30AC06CBA5

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50D7F, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0026a6d0d9a6f5f75aa3d4b93e6bafa7b5a389570a29f60efd753803e44cae4a
Instruction ID: bae92403bb38c65cad3146119f8f3a4df32e3eb0361fb10ebb6acd6ce82f8d5a
Opcode Fuzzy Hash: 0026a6d0d9a6f5f75aa3d4b93e6bafa7b5a389570a29f60efd753803e44cae4a
Instruction Fuzzy Hash: EF117832B04232CFDB048A38CC412C977B2EB89310F110979D505EB390DB75ED12CB84

Uniqueness

Uniqueness Score: 0.00%

Function 20261BCC, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24285068879.0000000020260000.00000040.00000001.sdmp, Offset: 20260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_20260000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0499d14bbf97476602862eb38fd114e543fdfcdaad1a9f5a3fc1f739c73426
Instruction ID: cb9bccd3aae435177639d28b89be96a4e292da7d3d286dc113abe4a947bafa83
Opcode Fuzzy Hash: bb0499d14bbf97476602862eb38fd114e543fdfcdaad1a9f5a3fc1f739c73426
Instruction Fuzzy Hash: A011BAB5648301AFD340CF19D881A5BFBE4FB98664F14896EF998D7311D331EA148FA2

Uniqueness

Uniqueness Score: 0.00%

Function 1D8AAD44, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24281186224.000000001D8AA000.00000040.00000001.sdmp, Offset: 1D8AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d8aa000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c20387da4cd4ab943c418d362905fb7d7f3398faa2fbd466b02370191188e17
Instruction ID: 844340c555ecdecad656f709b6ecc5683d94ec2573e4200b8bb8a889409151e7
Opcode Fuzzy Hash: 3c20387da4cd4ab943c418d362905fb7d7f3398faa2fbd466b02370191188e17
Instruction Fuzzy Hash: 5D11ECB5648301AFD350CF09DC81A57FBE4EB88660F14891EF99997311D271E9148FA2

Uniqueness

Uniqueness Score: 0.00%

Function 20261A70, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24285068879.0000000020260000.00000040.00000001.sdmp, Offset: 20260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_20260000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e823e7f0d38e531c27dcc55e037c62ec6611f9943a78a47db441bd23e1edfc
Instruction ID: 2f15f2e4ab4cb59bea5925f38d1bca09dd27ca863acf7cf639f0aac6339eb63e
Opcode Fuzzy Hash: 06e823e7f0d38e531c27dcc55e037c62ec6611f9943a78a47db441bd23e1edfc
Instruction Fuzzy Hash: EB11FAB5608301AFD350CF09DC81A57FBE8EB88660F14892EF999D7311D371E9148FA2

Uniqueness

Uniqueness Score: 0.00%

Function 1FC514A8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f71e8f84a1239301087084ee66c64bd9696403221557529921c2129c4dcb45b
Instruction ID: aace729b85ac5f7b87289de89bb2d3e72b05b3bed48d0cf35b537ddaf7fd9bfb
Opcode Fuzzy Hash: 5f71e8f84a1239301087084ee66c64bd9696403221557529921c2129c4dcb45b
Instruction Fuzzy Hash: A2016D71F401098BCB54DBB9D9451DEBBF5FF99350B6402A5C11AE3241EB315E02CBA9

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50C90, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f2fd7f2bd6a511ad110d40d67084b081c56e84518fe1dd61750191183d5c94
Instruction ID: ec642684891940a63c1aede20dedfe892cf2b3f3e37016eafc1a319717c116c5
Opcode Fuzzy Hash: c8f2fd7f2bd6a511ad110d40d67084b081c56e84518fe1dd61750191183d5c94
Instruction Fuzzy Hash: 3B113A797082458FCB04EB38C8D421D77F1FBC8605F918859E896CB395EB34A909DB43

Uniqueness

Uniqueness Score: 0.00%

Function 1D8605DF, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24280923432.000000001D860000.00000040.00000040.sdmp, Offset: 1D860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf4dcaeba6900a265a0c3f1dcc340a04f9777e6444fdc7faf391759a3c3ba14
Instruction ID: b278d98f53e6661ccc27cbfeee51bfe01a7df53d145fbacead73bb210c4e9302
Opcode Fuzzy Hash: 7bf4dcaeba6900a265a0c3f1dcc340a04f9777e6444fdc7faf391759a3c3ba14
Instruction Fuzzy Hash: E401DBB55097805FD7118F15DC41862FFE8DF86630708C49FEC49CB652C2296909C771

Uniqueness

Uniqueness Score: 0.00%

Function 1FC514B8, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b05515a8f63fdfb25d71061938399d645ead571ffbbefa476f5627f544fcce7
Instruction ID: dc946cc5cf31f31aaa8d629ab4da97bf221ee20eea2a810c46f9e696f5637053
Opcode Fuzzy Hash: 2b05515a8f63fdfb25d71061938399d645ead571ffbbefa476f5627f544fcce7
Instruction Fuzzy Hash: 0CF01971F001198FCB54EBB9D9445DEBBF9FFC8350FA00169C50AE7250EA355E018BA9

Uniqueness

Uniqueness Score: 0.00%

Function 1FC507C0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92ee89d5fbed2446daa676405f82351f5526cf4e9eab24c97b7ffdada749249
Instruction ID: 272d55b6cd7b253583db6f3cce75dc63e805bbc2243f6114600ec3ed2a1d8d22
Opcode Fuzzy Hash: a92ee89d5fbed2446daa676405f82351f5526cf4e9eab24c97b7ffdada749249
Instruction Fuzzy Hash: 5B016975A00219CFCB60EFB8D881AAE7BB6FB59311F50462AC108AB246D7316946CB90

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50A58, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45bc3c6ef7ba623742a96214ff3e2d85f2f829e07f04e9a5bfeb1e0d8844f131
Instruction ID: fd8070464a06fde73a7751ca488529014a97ae07aeab52c757acd7b0803f4dbe
Opcode Fuzzy Hash: 45bc3c6ef7ba623742a96214ff3e2d85f2f829e07f04e9a5bfeb1e0d8844f131
Instruction Fuzzy Hash: 64F04F72E102168FCB40DFBC98412ADBBF0FB582617214636D119E7290E7305916CB90

Uniqueness

Uniqueness Score: 0.00%

Function 1D860606, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24280923432.000000001D860000.00000040.00000040.sdmp, Offset: 1D860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810d3667b8c962ac9465ef24873b9ee49101dd6408d1e2270bf8cf8c5e047415
Instruction ID: 62b14228030559f2d008f6740706ed343f6b90ce95342c28fe9aa71e55a0c7bb
Opcode Fuzzy Hash: 810d3667b8c962ac9465ef24873b9ee49101dd6408d1e2270bf8cf8c5e047415
Instruction Fuzzy Hash: 6FE092B66007048BD650CF0AEC81462FBD4EB84630B08C47FDC0D8B701D275B904CAE1

Uniqueness

Uniqueness Score: 0.00%

Function 1D8AAD93, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24281186224.000000001D8AA000.00000040.00000001.sdmp, Offset: 1D8AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d8aa000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8cccb8d6f28e0f3f0cd7c7c81fb30db7b9da23a6bbaae455e7d378d54191bc
Instruction ID: a33eefe48fe9b9f13de3301b25094059ff745c113d9016d6365ecd104f4702cf
Opcode Fuzzy Hash: 0d8cccb8d6f28e0f3f0cd7c7c81fb30db7b9da23a6bbaae455e7d378d54191bc
Instruction Fuzzy Hash: 48E0D8B6640304A7D2108F069C82B73FB98DB50A30F04C557ED085B342D171B51489F1

Uniqueness

Uniqueness Score: 0.00%

Function 20261C37, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24285068879.0000000020260000.00000040.00000001.sdmp, Offset: 20260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_20260000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42eb7e8fb13425d645ed7862fbcf64e1c8f8997b5245e1b9f8d262cb77b232e
Instruction ID: 012957ef466bcf0cc9cc5a4c4e4a94cb86728d75fcefd1b3c7d55d42405cb57a
Opcode Fuzzy Hash: b42eb7e8fb13425d645ed7862fbcf64e1c8f8997b5245e1b9f8d262cb77b232e
Instruction Fuzzy Hash: CEE0D8B664030067D2108F069C82B63FB98DB90A30F04C46BED085B342D171B51489F1

Uniqueness

Uniqueness Score: 0.00%

Function 20261ABF, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24285068879.0000000020260000.00000040.00000001.sdmp, Offset: 20260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_20260000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a63952b436ebff2c84b6d82d3222250b41e433d515f8080fd48bab914ad1bed
Instruction ID: 4b0121d09d08ae0dc2361c1b34e05d8800f55d363e15671f90d759dbdc2fb69f
Opcode Fuzzy Hash: 9a63952b436ebff2c84b6d82d3222250b41e433d515f8080fd48bab914ad1bed
Instruction Fuzzy Hash: 7EE0D8B664030467D2509F069C82B63FB98DB40A30F08C45BED0C5B342D172B51489F1

Uniqueness

Uniqueness Score: 0.00%

Function 202614E3, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24285068879.0000000020260000.00000040.00000001.sdmp, Offset: 20260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_20260000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224781268ce0ac69a42e78d92187a687177a5d7ef93da09b71087a17af09de8a
Instruction ID: 6121906df5a593de0f055d66a74962db305ce09e39cb69cb5cd15db7398c4eed
Opcode Fuzzy Hash: 224781268ce0ac69a42e78d92187a687177a5d7ef93da09b71087a17af09de8a
Instruction Fuzzy Hash: 50E0D8B664030067D210DF069C82B63FB98DB80A30F04C45BED085B342D172B514C9E1

Uniqueness

Uniqueness Score: 0.00%

Function 1FC50480, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa5041a7053a1361659c44f11a7945f897799de4ee0bc0301fb0c8392aeb613
Instruction ID: 5dc19ee4f5bf69d44c23ce622274b70b97b38ba21a7d36a4ed187e056e52d0be
Opcode Fuzzy Hash: bfa5041a7053a1361659c44f11a7945f897799de4ee0bc0301fb0c8392aeb613
Instruction Fuzzy Hash: BCD05E351582904FCB4287A8E8E14D43FF1D70B13430585C2E088CB663C629486EDB01

Uniqueness

Uniqueness Score: 0.00%

Function 1D8923F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24281007578.000000001D892000.00000040.00000001.sdmp, Offset: 1D892000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d892000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eeeae1eafcf6a213b944843a6d419c36e2714780b5c6b0d922b586f990bb2fd
Instruction ID: b09f1cd50f7468c534ed209018a85162d929e545a3a0f90f68fd7e1745398484
Opcode Fuzzy Hash: 5eeeae1eafcf6a213b944843a6d419c36e2714780b5c6b0d922b586f990bb2fd
Instruction Fuzzy Hash: 10D05E797046818FD306DE18C1E1FA53B94BBA2B14F8644FAA8408B763C768D581D201

Uniqueness

Uniqueness Score: 0.00%

Function 1D8923BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24281007578.000000001D892000.00000040.00000001.sdmp, Offset: 1D892000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1d892000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a619bc74b573e07939a20703b5affa3cf2bfe0c5ce2154754b216f6a3071df9
Instruction ID: 21a7371b169ae65a5f5771aaf573f92cba8efbf1d18a66a7c413b1731a6ae8aa
Opcode Fuzzy Hash: 4a619bc74b573e07939a20703b5affa3cf2bfe0c5ce2154754b216f6a3071df9
Instruction Fuzzy Hash: 0BD05E356002814BDB05DE08C2D0F6937D8AB80B04F4244E8BC418F772C7B4D9C0D600

Uniqueness

Uniqueness Score: 0.00%

Function 1FC51511, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24282655579.000000001FC50000.00000040.00000001.sdmp, Offset: 1FC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1fc50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b0935b2cd809d2355d823f910c416ab23e8a565fc341e3121ce4913e234c94
Instruction ID: b9572b71a987fc13251fcc2864e4b46cdaad1ec785ec42eb9c1296f402a867cc
Opcode Fuzzy Hash: b7b0935b2cd809d2355d823f910c416ab23e8a565fc341e3121ce4913e234c94
Instruction Fuzzy Hash: ADC01236B44458C7DF04FBF8F4940DCB374EAC422575108A1D525A3050DF311E548761

Uniqueness

Uniqueness Score: 0.00%

Non-executed Functions

Function 00C31E6C, Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aae17fba98d4bf99c1c74551a9e39b707c6f486f06c259c83d60bcf6ad55c139
Instruction ID: 1195abe207876bffed4e289598c4e5b6d1567c369a5d1ac1904c74ff3ed85aa0
Opcode Fuzzy Hash: aae17fba98d4bf99c1c74551a9e39b707c6f486f06c259c83d60bcf6ad55c139
Instruction Fuzzy Hash: 19B1DE71700712EFDB18EF28CC91BD6B3A4FF19764F594329ECA997281CB34A8558B90

Uniqueness

Uniqueness Score: 0.00%

Function 00C38F5A, Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c04facf7fb2d7d8b1b38c1efeb0a0a7bc062ea3075f2b863e4a23f95b2be87
Instruction ID: 89bf63b71386a0c13ee9f097c18854f359dca22ee47d775ce8180aa88b367736
Opcode Fuzzy Hash: c6c04facf7fb2d7d8b1b38c1efeb0a0a7bc062ea3075f2b863e4a23f95b2be87
Instruction Fuzzy Hash: B8A189B176034A6FFB215E24CD86BDA3767FF16350F604228FE44AB1D1C7B999889740

Uniqueness

Uniqueness Score: 0.00%

Function 00C3949D, Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 5c26341aa8f10338cf57669b83da95fb2960708d1176b5b9c74d93ace4facdde
Instruction ID: befdae7e1404a489b24c2dccc33b04b1ed18cc20f05700e452267ebb861cf1d6
Opcode Fuzzy Hash: 5c26341aa8f10338cf57669b83da95fb2960708d1176b5b9c74d93ace4facdde
Instruction Fuzzy Hash: 1C81B570A143429EDF25DF2888D4755BAD1EF22320F4883ADCDA68B2D6C3718986D722

Uniqueness

Uniqueness Score: 0.00%

Function 00C38799, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0ad40354aa7490124a58e7620738842b7f8dd1229dc5e7a5102532bc5f98c4
Instruction ID: 3e72e0befc3fa6c035dc677bd5b4008645e4fbe1d3e57c9f9ab9bece2274e205
Opcode Fuzzy Hash: 6b0ad40354aa7490124a58e7620738842b7f8dd1229dc5e7a5102532bc5f98c4
Instruction Fuzzy Hash: FDE0ED7D3317008FC714DA28C5D4E5573A6AB5A750F254551F9118B661DA34EC44D620

Uniqueness

Uniqueness Score: 0.00%

Function 00C34109, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe73df34f80c548d7f38e4da902f382a4500c5c07af9d1c34425ce2ab83f480e
Instruction ID: d684541be87bc655fadfcc34e009f7789161328f5676fde78bb395d58ecedf95
Opcode Fuzzy Hash: fe73df34f80c548d7f38e4da902f382a4500c5c07af9d1c34425ce2ab83f480e
Instruction Fuzzy Hash: 63C04CB6650481CFEF59DA09C491B947361B765744BD944D0E046CBA55C318ED41C600

Uniqueness

Uniqueness Score: 0.00%

Function 00C381B7, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8975aa85ffa681981e648174b86ff935b29160b824c6080d71e9c0c58d4292
Instruction ID: b933d7a8f0b1c7a96fb1429829bcf9fa5e697247fe5bddf5ae2b1ed24a185623
Opcode Fuzzy Hash: 7a8975aa85ffa681981e648174b86ff935b29160b824c6080d71e9c0c58d4292
Instruction Fuzzy Hash: 03B092313106408FCA51CE19C1D0F80B3E0BF00A40B8244A4E00187A51C364E804C900

Uniqueness

Uniqueness Score: 0.00%

Function 00C39E56, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.24264401230.0000000000C30000.00000040.00000001.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c30000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1985188533ae361fcbfaf6301ae5d8934191e8d79537ea20f659d31287449d5
Instruction ID: b36b371992250da8c45f1cd1506764a1d816c012ef71655a4cc1844282d2f311
Opcode Fuzzy Hash: d1985188533ae361fcbfaf6301ae5d8934191e8d79537ea20f659d31287449d5
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: 0.00%

Analysis Process: RegAsm.exe PID: 2652 Parent PID: 4560 RegAsm.exeCOMMON

Execution Graph

Execution Coverage:	27.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	29
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00C801B7, Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.24199712110.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192049ef41716891ee5ec6ef21dfbf92bc100e8bbdfbae5b5c3a6e5ccd56ef4d
Instruction ID: f2cfa82b540222d47de8c5319bdae6a00531ee0fef71a6315d646c06085e4ba8
Opcode Fuzzy Hash: 192049ef41716891ee5ec6ef21dfbf92bc100e8bbdfbae5b5c3a6e5ccd56ef4d
Instruction Fuzzy Hash: A532AC30604245CFDB54EF29C884A6AB7F2FF88308F208968D8569B265EB31DD49CF64

Uniqueness

Uniqueness Score: 0.00%

Function 008DA4AA, Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E90,B567927A,00000000,00000000,00000000,00000000), ref: 008DA53D

Memory Dump Source

Source File: 00000015.00000002.24198696071.00000000008DA000.00000040.00000001.sdmp, Offset: 008DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8da000_RegAsm.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 76401b1de76ac2389e8d047a23e3ecc27367a508254ec8f5d5227a9aff371911
Instruction ID: b03b03e27054210f25720645d3922d1e7a10c6f7beb36313182ea09b804c4723
Opcode Fuzzy Hash: 76401b1de76ac2389e8d047a23e3ecc27367a508254ec8f5d5227a9aff371911
Instruction Fuzzy Hash: CE2171714093806FDB228B619C84B96BFB8EF46310F1885DBE985DF163D265A509CB72

Uniqueness

Uniqueness Score: 0.01%

Function 008DA35A, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 008DA3C0

Memory Dump Source

Source File: 00000015.00000002.24198696071.00000000008DA000.00000040.00000001.sdmp, Offset: 008DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8da000_RegAsm.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 698a75f327fd903e98b75c438996f0037f31ea98c13e7d75477c60c6d9b97987
Instruction ID: 6ba2ac6043b71c1f9ec053252c0f8803814f368e72a9a38c0df4d5366d7b3b08
Opcode Fuzzy Hash: 698a75f327fd903e98b75c438996f0037f31ea98c13e7d75477c60c6d9b97987
Instruction Fuzzy Hash: 80216D715093C09FD7128B25DC95B52BFB4EF06220F0984EBED85CF263C269A949CB62

Uniqueness

Uniqueness Score: 0.13%

Function 008DA4DE, Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E90,B567927A,00000000,00000000,00000000,00000000), ref: 008DA53D

Memory Dump Source

Source File: 00000015.00000002.24198696071.00000000008DA000.00000040.00000001.sdmp, Offset: 008DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8da000_RegAsm.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f3f5e25429371fc571e3570dfff8fb4eaa57c29566559e97cdd2f715e627e1ee
Instruction ID: 0c3e9be645122e38dca27b522358776a243a60ca30bbd44c832dcfe64d845364
Opcode Fuzzy Hash: f3f5e25429371fc571e3570dfff8fb4eaa57c29566559e97cdd2f715e627e1ee
Instruction Fuzzy Hash: 19110172500204AFEB21DF91EC84BAAFBA8EF44320F14855AED49DB211C335A504CBB2

Uniqueness

Uniqueness Score: 0.01%

Function 008DA23C, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 008DA28D

Memory Dump Source

Source File: 00000015.00000002.24198696071.00000000008DA000.00000040.00000001.sdmp, Offset: 008DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8da000_RegAsm.jbxd

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 99b0253377c7314c77779a3004a4fa8f443f56a7638fc1c2d04b028adba33d0c
Instruction ID: bc774bc77cbff9e3cb1245120ef3638e7fea04a49760e267450696479ad4b548
Opcode Fuzzy Hash: 99b0253377c7314c77779a3004a4fa8f443f56a7638fc1c2d04b028adba33d0c
Instruction Fuzzy Hash: 4801D2314093C49FCB118F15DC84B52FFA4EF06320F0980DAED898F262C269A908CB62

Uniqueness

Uniqueness Score: 2.84%

Function 008DA38E, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 008DA3C0

Memory Dump Source

Source File: 00000015.00000002.24198696071.00000000008DA000.00000040.00000001.sdmp, Offset: 008DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8da000_RegAsm.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 89596cc91018a36ff54e4c5d7b32f6c647f98094f9c99c93412d40a63958f285
Instruction ID: 4ed4f051f969cfd5c54d87d0c75f60eee8e57dffdf541c5418676266b0d3b884
Opcode Fuzzy Hash: 89596cc91018a36ff54e4c5d7b32f6c647f98094f9c99c93412d40a63958f285
Instruction Fuzzy Hash: 3501F231A00384DFDB24CF29D889766FBA4EF40320F18C1ABDD09CB302D675E844CA62

Uniqueness

Uniqueness Score: 0.13%

Function 008DA25E, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 008DA28D

Memory Dump Source

Source File: 00000015.00000002.24198696071.00000000008DA000.00000040.00000001.sdmp, Offset: 008DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8da000_RegAsm.jbxd

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: c872e890cf8a214a88ecda21b570eec1148987085d7e00dd9d8fcc207563ddec
Instruction ID: 6471203db0ba62b4645fcbdea604fdd5416cde13bfb377ddc9790a376863d3b2
Opcode Fuzzy Hash: c872e890cf8a214a88ecda21b570eec1148987085d7e00dd9d8fcc207563ddec
Instruction Fuzzy Hash: 23F0CD315047849FDB10CF46D888762FBA0EF44725F28C19ADE099F716D37AA948CAA2

Uniqueness

Uniqueness Score: 2.84%

Function 00C80710, Relevance: .4, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.24199712110.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83620f19c00e376328ce17beaa47ed64918267152cbe62631a14d1b549fa4398
Instruction ID: 0285b4c4add076a1497b6e076b8262ef0354a8becf812bd3146e28f8cf47df7f
Opcode Fuzzy Hash: 83620f19c00e376328ce17beaa47ed64918267152cbe62631a14d1b549fa4398
Instruction Fuzzy Hash: 85028C30B002058FCB55EF68C894A6EB7F2FF88304F258569D45A9B395DB31ED06CBA5

Uniqueness

Uniqueness Score: 0.00%

Function 00C800B9, Relevance: .1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.24199712110.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80fdabb4181396de6820d03e8d413b5a137c37f911173fec7be21215c6fb3d6
Instruction ID: 5f9c220f802032d657044c014e71186ba03e5a905b4f7d31beafda469b1e9f84
Opcode Fuzzy Hash: f80fdabb4181396de6820d03e8d413b5a137c37f911173fec7be21215c6fb3d6
Instruction Fuzzy Hash: 1B211B347012108FCB59AB7CD068A6D3BF2AFD6315B2445B9D016CF7A1DE368D45CB91

Uniqueness

Uniqueness Score: 0.00%

Function 00C80006, Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.24199712110.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b745235df4f60f5ce0f33e0b9101a64a429b88569e334ac98e356cdb0614de0f
Instruction ID: 195a3f82ca238d7f648d6d7e60133cfed9c959d492a035fae3ec96096b524d27
Opcode Fuzzy Hash: b745235df4f60f5ce0f33e0b9101a64a429b88569e334ac98e356cdb0614de0f
Instruction Fuzzy Hash: D9112A6950E7C09FE7038B709C60585BFB4AE47211B1A84D7D1C4CF2B3E7694E09C762

Uniqueness

Uniqueness Score: 0.00%

Function 00C80DA0, Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.24199712110.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db390a2f0ed7241383f9480fc0878d51a9760d42d5e385ebd7c5d3dfc7afe42
Instruction ID: 13126c5e661edc8be58ae492799908bff23cc708e929411269869b17292aead2
Opcode Fuzzy Hash: 5db390a2f0ed7241383f9480fc0878d51a9760d42d5e385ebd7c5d3dfc7afe42
Instruction Fuzzy Hash: 1001D631B042849FC306ABB8D86459D7FB5EF86210F2444EAD449DB3A1CE749E06C766

Uniqueness

Uniqueness Score: 0.00%

Function 024105E4, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.24199984482.0000000002410000.00000040.00000040.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2410000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335590b877179abb3989c5ce450191493c582633bebc3daeaf19efaa18920086
Instruction ID: 00388ced17d09b0de436e06df69fbf1c5f223fa5e7f5a1889df5a08302dfa8fe
Opcode Fuzzy Hash: 335590b877179abb3989c5ce450191493c582633bebc3daeaf19efaa18920086
Instruction Fuzzy Hash: 92F0F4B25093846FD7118F16EC40862FFA8EA86630748C09FEC498B612D225B908CBB2

Uniqueness

Uniqueness Score: 0.00%

Function 00C80D19, Relevance: .0, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.24199712110.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c48e25a056c9d93c3c0f4d70424f1cf3905b9d87bfa4f60ceacd0bb367d830
Instruction ID: 9d2745fc3c211db241f1d61a21576d45ca4514653cf434bb774eee8abac27c0a
Opcode Fuzzy Hash: 71c48e25a056c9d93c3c0f4d70424f1cf3905b9d87bfa4f60ceacd0bb367d830
Instruction Fuzzy Hash: 89F0CD717082605FD70D637DA8645BB6BA6EFCA214B14417AE009CB3A2CCB64C0283A0

Uniqueness

Uniqueness Score: 0.00%

Function 00C80070, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.24199712110.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61152f8dca27da4e02ea12a822dfbfe4fe151054af029ab63c2ed131d448a8
Instruction ID: 7fa487f9f8a1b0a13427f0851ce9740a904bee78a75acc9fdd6bd19f212c6f04
Opcode Fuzzy Hash: 2e61152f8dca27da4e02ea12a822dfbfe4fe151054af029ab63c2ed131d448a8
Instruction Fuzzy Hash: 43E06D36604649EF8B04EFA5E8884DEBBA9FA84221B108066E509C7110EB315A408B84

Uniqueness

Uniqueness Score: 0.00%

Function 02410606, Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.24199984482.0000000002410000.00000040.00000040.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2410000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a03a9f0ea9dadb6e2822fe1b9e01dcf3d50f41dbf9427f94c756260e6003f3
Instruction ID: 601c37808707a615b27ec1adbc5c5d155153c434355b0a750099350113c955e7
Opcode Fuzzy Hash: 68a03a9f0ea9dadb6e2822fe1b9e01dcf3d50f41dbf9427f94c756260e6003f3
Instruction Fuzzy Hash: 47E092B66006048BD650DF0AEC81452FBD4EB84630B48C47FDD0E9BB00D136B504CAA1

Uniqueness

Uniqueness Score: 0.00%

Function 00C80CC8, Relevance: .0, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.24199712110.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc226c3708c4d4724ceefb3c52b617caa73507f252b9c83b9ccf106d44aaf0ac
Instruction ID: a0a21768dd6f10fec28adef09e1e047a8a3119ad210f64f51f661758dc744cc6
Opcode Fuzzy Hash: dc226c3708c4d4724ceefb3c52b617caa73507f252b9c83b9ccf106d44aaf0ac
Instruction Fuzzy Hash: 0CF0EC316091C08FD351EB78E458B917FE55F86224F1540DBD445CB117C7245D48CB41

Uniqueness

Uniqueness Score: 0.00%

Function 00C80D90, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.24199712110.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34cab1c1c4660a707e91a6b413b9d1a1762683b960f38f859912678bd53e8f8
Instruction ID: 2f54e1b59e5c66fcd9036940f684ae1eb08b82247cb90d0312562e773daa53cf
Opcode Fuzzy Hash: a34cab1c1c4660a707e91a6b413b9d1a1762683b960f38f859912678bd53e8f8
Instruction Fuzzy Hash: B0D05E316081A08FC7125BB868680F97FB49E0B21175801D2D888CB1A1D6104F2A83A1

Uniqueness

Uniqueness Score: 0.00%

Function 008D23F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.24198657951.00000000008D2000.00000040.00000001.sdmp, Offset: 008D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8d2000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6302ebcb74ebaf2f245cd0fb011fe57d95a5c75be85f0d81e073116a710b8080
Instruction ID: 5e03961e0f819f20927bed8d6a94d91dd81c333960ab61858df5f4507801e282
Opcode Fuzzy Hash: 6302ebcb74ebaf2f245cd0fb011fe57d95a5c75be85f0d81e073116a710b8080
Instruction Fuzzy Hash: B7D05E792056818FE317DE1CC1A5F953BD4BBA1B04F4645FAAC00CB7A3C368D981D204

Uniqueness

Uniqueness Score: 0.00%

Function 008D23BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.24198657951.00000000008D2000.00000040.00000001.sdmp, Offset: 008D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8d2000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a0e360dc1e6174727958d67389e3cb501e1549d2af498fcf40ffaccf09f5a9
Instruction ID: d16f892a44fb5cf4a018d1517acfe0c7f55d8918533880dd70bb0282dc7c06d6
Opcode Fuzzy Hash: 86a0e360dc1e6174727958d67389e3cb501e1549d2af498fcf40ffaccf09f5a9
Instruction Fuzzy Hash: 5BD05E342001814BDB19DE0CC2D4F5937D4BB90B04F0645E9BC00CB372C3B8DD81C600

Uniqueness

Uniqueness Score: 0.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report New Inquiry 903838737777721102029393003938.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Bitcoin Miner:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Signature Similarity

Similar Samples

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Function 004105E4, Relevance: 19.6, APIs: 13, Instructions: 123
UNIQUE

Function 00401198, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16
COMMON

Function 004107AE, Relevance: 6.0, APIs: 4, Instructions: 49
UNIQUE

Function 00F005E5, Relevance: 11.5, APIs: 2, Strings: 4, Instructions: 958
nativethreadUNIQUE

Function 00F016BE, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 558
UNIQUE

Function 00F00631, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 486
nativethreadCOMMON