Play interactive tour

Edit tour

Windows Analysis Report Mes_Drivers_3.0.4.exe

Overview

General Information

Sample Name:	Mes_Drivers_3.0.4.exe
Analysis ID:	445340
MD5:	50a5e891da27e63d54e68511e48aa026
SHA1:	87073d85a7ba420b15c8bb9a9e4adc64db2bcfef
SHA256:	0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6
Infos:
Most interesting Screenshot:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Obfuscated command line found

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

AV process strings found (often used to terminate AV products)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read device registry values (via SetupAPI)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

PE file contains strange resources

Queries device information via Setup API

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected AESCRYPT Tool

Yara signature match

Classification

Process Tree

System is w10x64

Mes_Drivers_3.0.4.exe (PID: 400 cmdline: 'C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe' MD5: 50A5E891DA27E63D54E68511E48AA026)

cmd.exe (PID: 1500 cmdline: 'C:\Windows\system32\cmd.exe' /C START '' 'C:\Users\user\AppData\Local\Temp\interface.lnk' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5064 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\interface.cmd' ' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mode.com (PID: 5624 cmdline: MODE CON: COLS=76 LINES=15 MD5: D781CD6A6484C276A4D0750D9206A382)

cmd.exe (PID: 2588 cmdline: C:\Windows\system32\cmd.exe /S /D /c' VER ' MD5: F3BDBE3BB6F734E357235F4D5898582D)

findstr.exe (PID: 6040 cmdline: FINDSTR /I /R /C:'version 5\.[0-1]\.' MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

waitfor.exe (PID: 2172 cmdline: WAITFOR unlock MD5: 83E921720CA3BD03CF6BF5686E802C3D)

detection.exe (PID: 5556 cmdline: 'C:\Users\user\AppData\Local\Temp\detection.exe' MD5: 02BA1C44B6392F013A7AA0B91314F45A)

conhost.exe (PID: 5976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

curl_x64.exe (PID: 5968 cmdline: 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request GET 'https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4' MD5: E80C8CB9887A7C9426D4E843DDDB8A44)

waitfor.exe (PID: 1012 cmdline: WAITFOR /S DESKTOP-716T771 /SI unlock MD5: 83E921720CA3BD03CF6BF5686E802C3D)

sc.exe (PID: 5852 cmdline: SC query Winmgmt MD5: 24A3E2603E63BCB9695A2935D3B24695)

waitfor.exe (PID: 2904 cmdline: WAITFOR /S DESKTOP-716T771 /SI unlock MD5: 83E921720CA3BD03CF6BF5686E802C3D)

detect_x64.exe (PID: 360 cmdline: 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' driverfiles 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\* MD5: 6A7EC375AF8BA2E87FF7F23497E9944E)

detect_x64.exe (PID: 5504 cmdline: 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' drivernodes 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\* MD5: 6A7EC375AF8BA2E87FF7F23497E9944E)

detect_x64.exe (PID: 1012 cmdline: 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' hwids 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\* MD5: 6A7EC375AF8BA2E87FF7F23497E9944E)

detect_x64.exe (PID: 1692 cmdline: 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' stack 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\* MD5: 6A7EC375AF8BA2E87FF7F23497E9944E)

detect_x64.exe (PID: 1704 cmdline: 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' status 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\* MD5: 6A7EC375AF8BA2E87FF7F23497E9944E)

waitfor.exe (PID: 6812 cmdline: WAITFOR /S DESKTOP-716T771 /SI unlock MD5: 83E921720CA3BD03CF6BF5686E802C3D)

aes_x64.exe (PID: 7004 cmdline: 'C:\Users\user\AppData\Local\Temp\aes_x64.exe' -e -p anT^UpFuzpuC@lOvsoPVe2kiNTidaBo<zI]BeaRnU0ResFwAy@dEnuCkUd)hAzOh -o 'C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' - MD5: E5125D4651C008EBA61D9FD3ABD5AB31)

curl_x64.exe (PID: 7020 cmdline: 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request POST --form 'v_configuration=<C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' 'https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4' MD5: E80C8CB9887A7C9426D4E843DDDB8A44)

cmd.exe (PID: 7064 cmdline: 'C:\Windows\system32\cmd.exe' /C START '' 'http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM' MD5: F3BDBE3BB6F734E357235F4D5898582D)

iexplore.exe (PID: 7120 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 3000 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7120 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

waitfor.exe (PID: 7072 cmdline: WAITFOR /S DESKTOP-716T771 /SI unlock MD5: 83E921720CA3BD03CF6BF5686E802C3D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
Mes_Drivers_3.0.4.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\aes_x64.exe	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
C:\Users\user\AppData\Local\Temp\aes_x86.exe	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000000.218185318.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000004.00000003.399944667.00000000009B3000.00000004.00000001.sdmp	webshell_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x3cce:$asp_gen_obf1: "+" 0x3da4:$asp_gen_obf1: "+" 0x3f20:$asp_gen_obf1: "+" 0x148e2:$tagasp_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8 0xa040:$asp_input1: request 0xf2be:$asp_input1: request 0x9ccc:$asp_xml_method1: GET 0xa050:$asp_xml_method1: GET 0xee06:$asp_xml_method2: POST 0xf2ce:$asp_xml_method2: POST 0x13d4:$asp_payload11: WScript.Shell 0x1340:$asp_multi_payload_one1: CreateObject 0x13b8:$asp_multi_payload_one1: CreateObject 0x1340:$asp_multi_payload_four1: CreateObject 0x13b8:$asp_multi_payload_four1: CreateObject 0xeb56:$asp_always_write1: .Write 0xaa80:$asp_write_way_one3: CreateTextFile 0x1340:$asp_cr_write1: CreateObject( 0x13b8:$asp_cr_write1: CreateObject( 0x148e2:$tagasp_capa_classid1: 72C24DD5-D70A-438B-8A42-98424B88AFB8
00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000024.00000000.386024517.00007FF697695000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000004.00000003.401509038.0000000002A78000.00000004.00000001.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000004.00000003.401894830.00000000024D1000.00000004.00000001.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: detection.exe PID: 5556	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aes_x64.exe PID: 7004	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
4.3.detection.exe.7fa95e2c.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
36.0.aes_x64.exe.7ff697680000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
4.3.detection.exe.2506990.6.raw.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
4.3.detection.exe.2506990.6.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
4.2.detection.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
36.2.aes_x64.exe.7ff697680000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
1.2.Mes_Drivers_3.0.4.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
1.0.Mes_Drivers_3.0.4.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
4.3.detection.exe.7fa95e2c.0.raw.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Click to see the 4 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://www.nationsbank.com/

Avira URL Cloud: Label: phishing

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\aes_x86.exe	Metadefender: Detection: 20%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\aes_x86.exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\detection.exe	ReversingLabs: Detection: 27%

Multi AV Scanner detection for submitted file

Show sources

Source: Mes_Drivers_3.0.4.exe	Virustotal: Detection: 11%	Perma Link
Source: Mes_Drivers_3.0.4.exe	Metadefender: Detection: 13%	Perma Link
Source: Mes_Drivers_3.0.4.exe	ReversingLabs: Detection: 16%

Source: 4.2.detection.exe.400000.0.unpack

Avira: Label: TR/Dropper.Gen

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00456370 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	11_2_00456370
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00431450 CryptHashData,	11_2_00431450
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00431460 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	11_2_00431460
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00431400 CryptAcquireContextA,CryptCreateHash,	11_2_00431400
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00456660 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	11_2_00456660
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0042FAF0 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	11_2_0042FAF0
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697683750 CryptAcquireContextW,GetLastError,GetLastError,CryptAcquireContextW,GetLastError,CryptGenRandom,CryptReleaseContext,sprintf,CryptGenRandom,CryptReleaseContext,_fread_nolock,_fread_nolock,fflush,	36_2_00007FF697683750

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: mov dword ptr [rsi+0000490Dh], 424D53FFh		11_2_00435030
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: mov dword ptr [rdi+0000490Dh], 424D53FFh		11_2_00435730

Source: Mes_Drivers_3.0.4.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI, RELOCS_STRIPPED

Source: Mes_Drivers_3.0.4.exe

Static PE information: certificate valid

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: unknown	HTTPS traffic detected: 46.105.202.207:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.105.202.207:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.39:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.39:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.226:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.226:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.209.167:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.209.167:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.214.194:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.214.194:443 -> 192.168.2.5:49756 version: TLS 1.2

Source:	Binary string: devcon.pdbGCTL source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, detect_x64.exe, 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp
Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\Win32\Release\aescrypt.pdb source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: waitfor.pdb source: Mes_Drivers_3.0.4.exe, 00000001.00000003.407054994.00000000023C7000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: devcon.pdbH source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: devcon.pdb8d:j source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\Win32\Release\aescrypt.pdb source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\x64\Release\aescrypt.pdb source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: waitfor.pdbP' source: Mes_Drivers_3.0.4.exe, 00000001.00000003.407054994.00000000023C7000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: devcon.pdb source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, detect_x64.exe, 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_0044C2B0 GetLongPathNameW,FindFirstFileW,FindClose,	1_2_0044C2B0
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004093DC FindFirstFileW,FindClose,	1_2_004093DC
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004197A4 FindFirstFileW,FindClose,	1_2_004197A4
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00408E18 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	1_2_00408E18
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_00409CCC FindFirstFileW,FindClose,	4_2_00409CCC
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_0040B11E FindFirstFileW,	4_2_0040B11E
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_00409708 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	4_2_00409708
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_004624F0 FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	11_2_004624F0
Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe	Code function: 17_2_00007FF7A7456560 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,	17_2_00007FF7A7456560
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF69768AA44 FindClose,FindFirstFileExW,FindNextFileW,FindClose,	36_2_00007FF69768AA44

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rax, qword ptr [r8-08h]	11_2_00425170
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx eax, byte ptr [rsp+rcx+20h]	11_2_00463850
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx eax, word ptr [rcx]	11_2_0045F000
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx eax, byte ptr [rcx]	11_2_00432080
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rax, qword ptr [00000000004C76A8h]	11_2_0040A100
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov r9, qword ptr [rdi]	11_2_00416370
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rax, qword ptr [r8-08h]	11_2_004254E8
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rax, qword ptr [r8-08h]	11_2_00425562
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rax, qword ptr [r8-08h]	11_2_00425504
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx eax, byte ptr [r11]	11_2_0045F510
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rax, qword ptr [r8-08h]	11_2_00425520
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rax, qword ptr [r8-08h]	11_2_0042553C
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rax, qword ptr [r8-08h]	11_2_004255D8
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov r8, qword ptr [rsi]	11_2_004055F0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movsxd rax, rcx	11_2_0046C5F0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rax, qword ptr [r8-08h]	11_2_004255A7
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov eax, ecx	11_2_004705B0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movsx eax, byte ptr [rbx]	11_2_0041364E
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx eax, byte ptr [rdx]	11_2_00453630
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then lea rbx, qword ptr [rsp+40h]	11_2_00466720
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx r9d, byte ptr [rbx]	11_2_0045285E
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx ecx, byte ptr [r11]	11_2_0045F820
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then cmp dword ptr [r12+28h], 01h	11_2_004628B0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov r9, qword ptr [rbx]	11_2_004479A0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx ebx, byte ptr [rsi+rbp]	11_2_00411CC0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx ecx, byte ptr [rdx]	11_2_00461CA0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then test eax, eax	11_2_00436DC0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then lea ecx, dword ptr [r15+10h]	11_2_00423DD0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx eax, byte ptr [r8+rdx]	11_2_0046DE60
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then lea ecx, dword ptr [r15+10h]	11_2_00423E6C
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movsx eax, byte ptr [rdi]	11_2_00413E00
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then lea rcx, qword ptr [00000000004B25F8h]	11_2_00446E10
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then cmp dword ptr [r15+rbp*4+000008A8h], 00000000h	11_2_0044CE20
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then lea ecx, dword ptr [r15+10h]	11_2_00423ED5
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then lea ecx, dword ptr [r15+10h]	11_2_00423EF8
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then lea ecx, dword ptr [r15+10h]	11_2_00423EB2
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then mov rdx, rax	11_2_0043CF40
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then lea ecx, dword ptr [r15+10h]	11_2_00423F7B
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then lea ecx, dword ptr [r15+10h]	11_2_00423F3C
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 4x nop then movzx r8d, al	11_2_00461FA0

Source: Joe Sandbox View

JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe

Code function: 11_2_00427A30 recv,

11_2_00427A30

Source: global traffic

HTTP traffic detected: GET /index.php?v_page=31&v_id=8KVKWmfznwDbzahM HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.touslesdrivers.comConnection: Keep-Alive

Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: --ftp-pret Send PRET before PASV (for drftpd) (F) -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) --ftp-account DATA Account data string (F) --form-string STRING Specify HTTP multipart POST data (H) -F, --form CONTENT Specify HTTP multipart POST data (H) --false-start Enable TLS False Start. -f, --fail Fail silently (no output at all) on HTTP errors (H) --expect100-timeout SECONDS How long to wait for 100-continue (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --egd-file FILE EGD socket path for random data (SSL) -D, --dump-header FILE Write the headers to FILE --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --dns-interface Interface to use for DNS requests --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --disable-epsv Inhibit using EPSV (F) --disable-eprt Inhibit using EPRT or LPRT (F) --digest Use HTTP Digest Authentication (H) --delegation STRING GSS-API delegation permission --data-urlencode DATA HTTP POST data url encoded (H) --data-binary DATA HTTP POST binary data (H) --data-ascii DATA HTTP POST ASCII data (H) --data-raw DATA HTTP POST data, '@' allowed (H) -d, --data DATA HTTP POST data (H) --crlfile FILE Get a CRL list in PEM format from the given file --crlf Convert LF to CRLF in upload --create-dirs Create necessary local directory hierarchy -c, --cookie-jar FILE Write cookies to FILE after operation (H) -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) -C, --continue-at OFFSET Resumed transfer OFFSET --connect-to HOST1:PORT1:HOST2:PORT2 Connect to host (network level) --connect-timeout SECONDS Maximum time allowed for connection -K, --config FILE Read config from FILE --compressed Request compressed response (using deflate or gzip) --ciphers LIST SSL ciphers to use (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --cert-status Verify the status of the server certificate (SSL) -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --capath DIR CA directory to verify peer against (SSL) --cacert FILE CA certificate to verify peer against (SSL) --basic Use HTTP Basic Authentication (H) -a, --append Append to target file when uploading (F/SFTP) --anyauth Pick "any" authentication method (H)Options: (H) means HTTP/HTTPS only, (F) means FTP onlyUsage: curl [options...] <url>Features: %s Protocols: curl 7.51.0 (x86_64-pc-win32) %s
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: --ftp-pret Send PRET before PASV (for drftpd) (F) -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) --ftp-account DATA Account data string (F) --form-string STRING Specify HTTP multipart POST data (H) -F, --form CONTENT Specify HTTP multipart POST data (H) --false-start Enable TLS False Start. -f, --fail Fail silently (no output at all) on HTTP errors (H) --expect100-timeout SECONDS How long to wait for 100-continue (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --egd-file FILE EGD socket path for random data (SSL) -D, --dump-header FILE Write the headers to FILE --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --dns-interface Interface to use for DNS requests --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --disable-epsv Inhibit using EPSV (F) --disable-eprt Inhibit using EPRT or LPRT (F) --digest Use HTTP Digest Authentication (H) --delegation STRING GSS-API delegation permission --data-urlencode DATA HTTP POST data url encoded (H) --data-binary DATA HTTP POST binary data (H) --data-ascii DATA HTTP POST ASCII data (H) --data-raw DATA HTTP POST data, '@' allowed (H) -d, --data DATA HTTP POST data (H) --crlfile FILE Get a CRL list in PEM format from the given file --crlf Convert LF to CRLF in upload --create-dirs Create necessary local directory hierarchy -c, --cookie-jar FILE Write cookies to FILE after operation (H) -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) -C, --continue-at OFFSET Resumed transfer OFFSET --connect-to HOST1:PORT1:HOST2:PORT2 Connect to host (network level) --connect-timeout SECONDS Maximum time allowed for connection -K, --config FILE Read config from FILE --compressed Request compressed response (using deflate or gzip) --ciphers LIST SSL ciphers to use (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --cert-status Verify the status of the server certificate (SSL) -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --capath DIR CA directory to verify peer against (SSL) --cacert FILE CA certificate to verify peer against (SSL) --basic Use HTTP Basic Authentication (H) -a, --append Append to target file when uploading (F/SFTP) --anyauth Pick "any" authentication method (H)Options: (H) means HTTP/HTTPS only, (F) means FTP onlyUsage: curl [options...] <url>Features: %s Protocols: curl 7.51.0 (i386-pc-win32) %s
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: --ftp-pret Send PRET before PASV (for drftpd) (F) -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) --ftp-account DATA Account data string (F) --form-string STRING Specify HTTP multipart POST data (H) -F, --form CONTENT Specify HTTP multipart POST data (H) --false-start Enable TLS False Start. -f, --fail Fail silently (no output at all) on HTTP errors (H) --expect100-timeout SECONDS How long to wait for 100-continue (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --egd-file FILE EGD socket path for random data (SSL) -D, --dump-header FILE Write the headers to FILE --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --dns-interface Interface to use for DNS requests --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --disable-epsv Inhibit using EPSV (F) --disable-eprt Inhibit using EPRT or LPRT (F) --digest Use HTTP Digest Authentication (H) --delegation STRING GSS-API delegation permission --data-urlencode DATA HTTP POST data url encoded (H) --data-binary DATA HTTP POST binary data (H) --data-ascii DATA HTTP POST ASCII data (H) --data-raw DATA HTTP POST data, '@' allowed (H) -d, --data DATA HTTP POST data (H) --crlfile FILE Get a CRL list in PEM format from the given file --crlf Convert LF to CRLF in upload --create-dirs Create necessary local directory hierarchy -c, --cookie-jar FILE Write cookies to FILE after operation (H) -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) -C, --continue-at OFFSET Resumed transfer OFFSET --connect-to HOST1:PORT1:HOST2:PORT2 Connect to host (network level) --connect-timeout SECONDS Maximum time allowed for connection -K, --config FILE Read config from FILE --compressed Request compressed response (using deflate or gzip) --ciphers LIST SSL ciphers to use (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --cert-status Verify the status of the server certificate (SSL) -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --capath DIR CA directory to verify peer against (SSL) --cacert FILE CA certificate to verify peer against (SSL) --basic Use HTTP Basic Authentication (H) -a, --append Append to target file when uploading (F/SFTP) --anyauth Pick "any" authentication method (H)Options: (H) means HTTP/HTTPS only, (F) means FTP onlyUsage: curl [options...] <url>Features: %s Protocols: curl 7.51.0 (x86_64-pc-win32) %s

Source: unknown

DNS traffic detected: queries for: www.touslesdrivers.com

Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: ftp://cool.haxx.se/
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: ftp://ftp.com/moo.exe
Source: curl_x64.exe	String found in binary or memory: ftp://ftp.funet.fi/README
Source: curl_x64.exe	String found in binary or memory: ftp://ftp.leachsite.com/README
Source: curl_x64.exe	String found in binary or memory: ftp://ftp.server.com/path/file
Source: curl_x64.exe	String found in binary or memory: ftp://ftp.sunet.se/pub/www/utilities/curl/
Source: curl_x64.exe	String found in binary or memory: ftp://ftp.sunet.se/pub/www/utilities/curl/SEE
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: http://curl.haxx.se/0
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://help.with.curl.com/curlhelp.html
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://machine.domain/full/path/to/file
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://remote.server.com/remote.html
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://that.secret.site.com
Source: curl_x64.exe	String found in binary or memory: http://that.secret.site.comEXTRA
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: http://trust.web.de/crl/ca03.crl0
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://url.com/file.txt
Source: detection.exe, 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp	String found in binary or memory: http://www.abyssmedia.com
Source: curl_x64.exe	String found in binary or memory: http://www.drh-consultancy.d
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.drh-consultancy.demon.co.uk/
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.formpost.com/getthis/
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.formpost.com/getthis/post.cgi
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.get.this/
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.nationsbank.com/
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.netscape.com/
Source: curl_x64.exe	String found in binary or memory: http://www.netscape.com/HTTPS
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.netscape.com/index.html
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.post.com/postit.cgi
Source: curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.server.com/
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.showme.com/
Source: detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.226335116.0000000002AB1000.00000004.00000001.sdmp	String found in binary or memory: http://www.touslesdrivers.com/index.php?v_page=31&v_id=
Source: detection.exe, 00000004.00000003.399270098.00000000009F9000.00000004.00000001.sdmp, detection.exe, 00000004.00000002.405879804.0000000002AE8000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.400133733.0000000002ABB000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.399944667.00000000009B3000.00000004.00000001.sdmp	String found in binary or memory: http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM
Source: detection.exe, 00000004.00000002.404454752.00000000009DC000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.398665475.00000000009DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahMAzOh
Source: detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.touslesdrivers.com/index.php?v_page=31&v_id=V
Source: Mes_Drivers_3.0.4.exe, 00000001.00000003.407054994.00000000023C7000.00000004.00000001.sdmp, Mes_Drivers_3.0.4.exe, 00000001.00000002.410166298.0000000002810000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp	String found in binary or memory: http://www.touslesdrivers.com/php/mes_drivers/code_source.php
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.upload.com/myfile
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.weirdserver.com:8000/
Source: curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: http://www.where.com/guest.cgi
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://curl.haxx.se
Source: curl_x64.exe	String found in binary or memory: https://curl.haxx.se/
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp	String found in binary or memory: https://curl.haxx.se/P
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://curl.haxx.se/docs/
Source: curl_x64.exe	String found in binary or memory: https://curl.haxx.se/docs/copyright.html
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp	String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: curl_x64.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://curl.haxx.se/docs/sslcerts.html
Source: curl_x64.exe	String found in binary or memory: https://curl.haxx.se/docs/sslcerts.htmlcurl
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://curl.haxx.se/libcurl/c/curl_easy_setopt.html
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://curl.haxx.se/mail/.
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://curl.haxx.se/rfc/rfc2255.txt
Source: curl_x64.exe	String found in binary or memory: https://curl.haxx.seFTP
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://ftp.mozilla.org
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://git.fedora-
Source: curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://secure.site.com/
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: https://trust.web.de/crl/ca03.crl0
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: https://trust.web.de0
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	String found in binary or memory: https://trust.web.de01
Source: curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://www.openssl.org/docs/apps/ciphers.html
Source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	String found in binary or memory: https://www.secure-site.com
Source: detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.226335116.0000000002AB1000.00000004.00000001.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=
Source: detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=.S
Source: detection.exe, 00000004.00000003.399270098.00000000009F9000.00000004.00000001.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_versio
Source: detection.exe, 00000004.00000003.399826501.0000000000A22000.00000004.00000001.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4
Source: detection.exe, 00000004.00000003.400740202.0000000000A3F000.00000004.00000001.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4work
Source: detection.exe, 00000004.00000002.404357113.000000000099B000.00000004.00000001.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4x
Source: detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.226335116.0000000002AB1000.00000004.00000001.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=
Source: curl_x64.exe, 0000000B.00000002.232370646.00000000009D0000.00000004.00000040.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4
Source: detection.exe, 00000004.00000003.399944667.00000000009B3000.00000004.00000001.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4ahM&v_version=indo
Source: detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp	String found in binary or memory: https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=Ad

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 46.105.202.207:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.105.202.207:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.39:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.39:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.226:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.226:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.209.167:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.209.167:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.214.194:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.214.194:443 -> 192.168.2.5:49756 version: TLS 1.2

Source: detection.exe, 00000004.00000002.404267982.000000000097A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe

Code function: 11_2_00456370 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

11_2_00456370

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00451718	1_2_00451718
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00412816	1_2_00412816
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00407E34	1_2_00407E34
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_0041313A	4_2_0041313A
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_00408724	4_2_00408724
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0042F130	11_2_0042F130
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0040D4E9	11_2_0040D4E9
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_004264A1	11_2_004264A1
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00448670	11_2_00448670
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00422960	11_2_00422960
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0044A090	11_2_0044A090
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00416370	11_2_00416370
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00456370	11_2_00456370
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0045D484	11_2_0045D484
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00453670	11_2_00453670
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0045D729	11_2_0045D729
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00467800	11_2_00467800
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0045F820	11_2_0045F820
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_004288F0	11_2_004288F0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00440900	11_2_00440900
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0045EAB0	11_2_0045EAB0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0044DB60	11_2_0044DB60
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00452C90	11_2_00452C90
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00472D70	11_2_00472D70
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00468DC0	11_2_00468DC0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00413E00	11_2_00413E00
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0044CE20	11_2_0044CE20
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0045CE2F	11_2_0045CE2F
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00451EA0	11_2_00451EA0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0043CF40	11_2_0043CF40
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0045CFD0	11_2_0045CFD0
Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe	Code function: 17_2_00007FF7A745286C	17_2_00007FF7A745286C
Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe	Code function: 17_2_00007FF7A7451970	17_2_00007FF7A7451970
Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe	Code function: 17_2_00007FF7A7455890	17_2_00007FF7A7455890
Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe	Code function: 17_2_00007FF7A7453EA0	17_2_00007FF7A7453EA0
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697683750	36_2_00007FF697683750
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697692810	36_2_00007FF697692810
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF69768CA14	36_2_00007FF69768CA14
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697684840	36_2_00007FF697684840
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697688900	36_2_00007FF697688900
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697681300	36_2_00007FF697681300
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF69768B4C0	36_2_00007FF69768B4C0
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF69768FD60	36_2_00007FF69768FD60
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697681760	36_2_00007FF697681760
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697682750	36_2_00007FF697682750
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF69768D54C	36_2_00007FF69768D54C
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697681000	36_2_00007FF697681000

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\aes_x86.exe B68FC901D758BA9EA3A5A616ABD34D1662197AA31B502F27CBF2579A947E53E9

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 00427190 appears 312 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 00427290 appears 328 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 0041C050 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 0045FEC0 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 00414800 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 0045FB50 appears 375 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 00402DA0 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 0040ACC0 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 00454EB0 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 0045AEF0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: String function: 00414970 appears 57 times

Source: aes_x64.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: aes_x86.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: curl_x64.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Mes_Drivers_3.0.4.exe, 00000001.00000002.410587105.0000000002E80000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs Mes_Drivers_3.0.4.exe
Source: Mes_Drivers_3.0.4.exe, 00000001.00000003.220926484.000000000282F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Mes_Drivers_3.0.4.exe
Source: Mes_Drivers_3.0.4.exe, 00000001.00000003.407054994.00000000023C7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamewaitfor.exej% vs Mes_Drivers_3.0.4.exe
Source: Mes_Drivers_3.0.4.exe, 00000001.00000003.407054994.00000000023C7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename8 vs Mes_Drivers_3.0.4.exe
Source: Mes_Drivers_3.0.4.exe, 00000001.00000002.411022700.0000000002F80000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs Mes_Drivers_3.0.4.exe
Source: Mes_Drivers_3.0.4.exe, 00000001.00000002.411022700.0000000002F80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs Mes_Drivers_3.0.4.exe

Source: Mes_Drivers_3.0.4.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI, RELOCS_STRIPPED

Source: 00000004.00000003.399944667.00000000009B3000.00000004.00000001.sdmp, type: MEMORY

Matched rule: webshell_asp_generic date = 2021/03/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = https://creativecommons.org/licenses/by-nc/4.0/, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75

Source: classification engine

Classification label: mal72.evad.winEXE@52/81@9/7

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe

Code function: 11_2_004183B4 GetLastError,FormatMessageA,GetLastError,SetLastError,

11_2_004183B4

Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe

Code function: 17_2_00007FF7A7451194 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,

17_2_00007FF7A7451194

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Code function: 1_2_00419CF4 GetDiskFreeSpaceW,

1_2_00419CF4

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Code function: 1_2_00448AA4 CoCreateInstance,

1_2_00448AA4

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Code function: 1_2_0043D5F0 FindResourceW,LoadResource,SizeofResource,LockResource,

1_2_0043D5F0

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CB2B1FBA-DF79-11EB-90E5-ECF4BB570DC9}.dat

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5976:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2904:120:WilError_01

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

File created: C:\Users\user\AppData\Local\Temp\detection.exe

Jump to behavior

Source: Yara match	File source: Mes_Drivers_3.0.4.exe, type: SAMPLE
Source: Yara match	File source: 4.2.detection.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Mes_Drivers_3.0.4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.Mes_Drivers_3.0.4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.218185318.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\detection.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, Manufacturer, MaxClockSpeed, Name, SocketDesignation FROM Win32_Processor

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\waitfor.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Mes_Drivers_3.0.4.exe	Virustotal: Detection: 11%
Source: Mes_Drivers_3.0.4.exe	Metadefender: Detection: 13%
Source: Mes_Drivers_3.0.4.exe	ReversingLabs: Detection: 16%

Source: curl_x64.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl_x64.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl_x64.exe	String found in binary or memory: document that is newer than the specified date/time. If this option is used several times, the last one will be used. -h, --help Usage help. This lists all current command line options with a s
Source: curl_x64.exe	String found in binary or memory: document that is newer than the specified date/time. If this option is used several times, the last one will be used. -h, --help Usage help. This lists all current command line options with a s
Source: curl_x64.exe	String found in binary or memory: This option requires that libcurl was built with a resolver backend that supports this operation. The c-ares backend is the only such one. (Added in 7.33.0) --dns-servers <ip-address,ip-address>
Source: curl_x64.exe	String found in binary or memory: This option requires that libcurl was built with a resolver backend that supports this operation. The c-ares backend is the only such one. (Added in 7.33.0) --dns-ipv6-addr <ip-address> Tel
Source: curl_x64.exe	String found in binary or memory: Only digit characters (0-9) are valid in the 'start' and 'stop' fields of the 'start-stop' range syntax. If a non-digit charac- ter is given in the range, the server's response will be unspec- ified, de
Source: curl_x64.exe	String found in binary or memory: This option requires that libcurl was built with a resolver backend that supports this operation. The c-ares backend is the only such one. (Added in 7.33.0) --dns-ipv4-addr <ip-address> Tell
Source: curl_x64.exe	String found in binary or memory: This option requires that libcurl was built with a resolver backend that supports this operation. The c-ares backend is the only such one. (Added in 7.33.0) --dns-servers <ip-address,ip-address>
Source: curl_x64.exe	String found in binary or memory: Only digit characters (0-9) are valid in the 'start' and 'stop' fields of the 'start-stop' range syntax. If a non-digit charac- ter is given in the range, the server's response will be unspec- ified, de
Source: curl_x64.exe	String found in binary or memory: document that is newer than the specified date/time. If this option is used several times, the last one will be used. -h, --help Usage help. This lists all current command line options with a s
Source: curl_x64.exe	String found in binary or memory: document that is newer than the specified date/time. If this option is used several times, the last one will be used. -h, --help Usage help. This lists all current command line options with a s
Source: curl_x64.exe	String found in binary or memory: This option requires that libcurl was built with a resolver backend that supports this operation. The c-ares backend is the only such one. (Added in 7.33.0) --dns-ipv4-addr <ip-address> Tell
Source: curl_x64.exe	String found in binary or memory: This option requires that libcurl was built with a resolver backend that supports this operation. The c-ares backend is the only such one. (Added in 7.33.0) --dns-ipv6-addr <ip-address> Tel
Source: curl_x64.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl_x64.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: detect_x64.exe	String found in binary or memory: positioned on the newly-added filter. ! Deletes the next occurrence of the specified filter. When the subcommand
Source: detect_x64.exe	String found in binary or memory: ng of the list. When the subcommand completes, the cursor is positioned on the newly-added filter. + Add after

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

File read: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe 'C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe'
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\system32\cmd.exe' /C START '' 'C:\Users\user\AppData\Local\Temp\interface.lnk'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process created: C:\Users\user\AppData\Local\Temp\detection.exe 'C:\Users\user\AppData\Local\Temp\detection.exe'
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\interface.cmd' '
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mode.com MODE CON: COLS=76 LINES=15
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c' VER '
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe FINDSTR /I /R /C:'version 5\.[0-1]\.'
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\curl_x64.exe 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request GET 'https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR unlock
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\sc.exe SC query Winmgmt
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' driverfiles 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' drivernodes 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' hwids 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' stack 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' status 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\aes_x64.exe 'C:\Users\user\AppData\Local\Temp\aes_x64.exe' -e -p anT^UpFuzpuC@lOvsoPVe2kiNTidaBo<zI]BeaRnU0ResFwAy@dEnuCkUd)hAzOh -o 'C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' -
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\curl_x64.exe 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request POST --form 'v_configuration=<C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' 'https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4'
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\system32\cmd.exe' /C START '' 'http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM'
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7120 CREDAT:17410 /prefetch:2
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\system32\cmd.exe' /C START '' 'C:\Users\user\AppData\Local\Temp\interface.lnk'	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process created: C:\Users\user\AppData\Local\Temp\detection.exe 'C:\Users\user\AppData\Local\Temp\detection.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\interface.cmd' '	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\curl_x64.exe 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request GET 'https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\sc.exe SC query Winmgmt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' driverfiles 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' drivernodes 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' stack 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' status 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\aes_x64.exe 'C:\Users\user\AppData\Local\Temp\aes_x64.exe' -e -p anT^UpFuzpuC@lOvsoPVe2kiNTidaBo<zI]BeaRnU0ResFwAy@dEnuCkUd)hAzOh -o 'C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' -	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\curl_x64.exe 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request POST --form 'v_configuration=<C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' 'https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\system32\cmd.exe' /C START '' 'http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mode.com MODE CON: COLS=76 LINES=15	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c' VER '	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe FINDSTR /I /R /C:'version 5\.[0-1]\.'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR unlock	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7120 CREDAT:17410 /prefetch:2

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Mes_Drivers_3.0.4.exe

Static PE information: certificate valid

Source: Mes_Drivers_3.0.4.exe

Static file information: File size 1624440 > 1048576

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: Mes_Drivers_3.0.4.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x130400

Source:	Binary string: devcon.pdbGCTL source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, detect_x64.exe, 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp
Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\Win32\Release\aescrypt.pdb source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: waitfor.pdb source: Mes_Drivers_3.0.4.exe, 00000001.00000003.407054994.00000000023C7000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: devcon.pdbH source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: devcon.pdb8d:j source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\Win32\Release\aescrypt.pdb source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\x64\Release\aescrypt.pdb source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: waitfor.pdbP' source: Mes_Drivers_3.0.4.exe, 00000001.00000003.407054994.00000000023C7000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp
Source:	Binary string: devcon.pdb source: detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, detect_x64.exe, 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\detection.exe

Unpacked PE file: 4.2.detection.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Obfuscated command line found

Show sources

Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\aes_x64.exe 'C:\Users\user\AppData\Local\Temp\aes_x64.exe' -e -p anT^UpFuzpuC@lOvsoPVe2kiNTidaBo<zI]BeaRnU0ResFwAy@dEnuCkUd)hAzOh -o 'C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' -
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\aes_x64.exe 'C:\Users\user\AppData\Local\Temp\aes_x64.exe' -e -p anT^UpFuzpuC@lOvsoPVe2kiNTidaBo<zI]BeaRnU0ResFwAy@dEnuCkUd)hAzOh -o 'C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' -			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe

Code function: 11_2_0042C2E0 GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,

11_2_0042C2E0

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: Mes_Drivers_3.0.4.exe	Static PE information: section name: .didata
Source: detection.exe.1.dr	Static PE information: section name: .MPRESS1
Source: detection.exe.1.dr	Static PE information: section name: .MPRESS2

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004562E0 push 0045636Ch; ret	1_2_00456364
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_0042C018 push 0042C084h; ret	1_2_0042C07C
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004413CC push ecx; mov dword ptr [esp], edx	1_2_004413CE
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_0043D3D4 push ecx; mov dword ptr [esp], edx	1_2_0043D3D6
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00456394 push 0045644Ah; ret	1_2_00456442
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00456454 push 004564DFh; ret	1_2_004564D7
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_0042B50C push ecx; mov dword ptr [esp], ecx	1_2_0042B50F
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004145EC push 00414A17h; ret	1_2_00414A0F
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_0045073C push 00450774h; ret	1_2_0045076C
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00449860 push 004498DDh; ret	1_2_004498D5
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004508D4 push ecx; mov dword ptr [esp], ecx	1_2_004508D7
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004218F4 push 00421A8Eh; ret	1_2_00421A86
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004149D4 push 00414A17h; ret	1_2_00414A0F
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00451AA8 push 00451AECh; ret	1_2_00451AE4
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00444B68 push 00444C35h; ret	1_2_00444C2D
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00438E70 push ecx; mov dword ptr [esp], edx	1_2_00438E75
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_0041FE94 push ecx; mov dword ptr [esp], edx	1_2_0041FE99
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_0042DEA8 push 0042DEF5h; ret	1_2_0042DEED
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00409FB0 push 0040A037h; ret	1_2_0040A02F
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_0040A8D4 push 0040A95Bh; ret	4_2_0040A953
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_00414F10 push 0041533Bh; ret	4_2_00415333

Source: C:\Users\user\AppData\Local\Temp\detection.exe	File created: C:\Users\user\AppData\Local\Temp\waitfor_x86_2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	File created: C:\Users\user\AppData\Local\Temp\detect_x64_2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	File created: C:\Users\user\AppData\Local\Temp\aes_x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	File created: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File created: C:\Users\user\AppData\Local\Temp\detection.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	File created: C:\Users\user\AppData\Local\Temp\curl_x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	File created: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File created: C:\Users\user\AppData\Local\Temp\waitfor_x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	File created: C:\Users\user\AppData\Local\Temp\detect_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	File created: C:\Users\user\AppData\Local\Temp\detect_x86.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\detection.exe

Process created: C:\Windows\SysWOW64\sc.exe SC query Winmgmt

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries memory information (via WMI often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\detection.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT BankLabel, Capacity, PartNumber FROM Win32_PhysicalMemory

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\detection.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Manufacturer, Product, Version FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\detection.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, SMBIOSBIOSVersion FROM Win32_BIOS

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\detection.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, InterfaceType, Size FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\detection.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT MACAddress, Manufacturer, Name FROM Win32_NetworkAdapter WHERE PNPDeviceID LIKE "PCI\\%" OR PNPDeviceID LIKE "PCMCIA\\%" OR PNPDeviceID LIKE "USB\\%"

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\detection.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT BankLabel, Capacity, PartNumber FROM Win32_PhysicalMemory

Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe

Code function: 17_2_00007FF7A745286C SetupDiGetDeviceInstallParamsW,SetupDiSetDeviceInstallParamsW,SetupDiBuildDriverInfoList,SetupDiEnumDriverInfoW,SetupDiOpenDevRegKey,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,SetupDiGetDeviceRegistryPropertyW,SetupDiSetDeviceInstallParamsW,SetupDiBuildDriverInfoList,SetupDiEnumDriverInfoW,SetupDiGetDriverInfoDetailW,GetLastError,SetupDiEnumDriverInfoW,SetupDiDestroyDriverInfoList,RegCloseKey,

17_2_00007FF7A745286C

Source: C:\Users\user\AppData\Local\Temp\detection.exe

Window / User API: threadDelayed 1139

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\detection.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\waitfor_x86_2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\detect_x64_2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\aes_x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\curl_x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\waitfor_x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\detect_x86.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe

API coverage: 9.8 %

Source: C:\Windows\SysWOW64\waitfor.exe TID: 980	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe TID: 2540	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe TID: 6984	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\waitfor.exe TID: 7128	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\detection.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Caption, Manufacturer, MaxClockSpeed, Name, SocketDesignation FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_0044C2B0 GetLongPathNameW,FindFirstFileW,FindClose,	1_2_0044C2B0
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004093DC FindFirstFileW,FindClose,	1_2_004093DC
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_004197A4 FindFirstFileW,FindClose,	1_2_004197A4
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_00408E18 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	1_2_00408E18
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_00409CCC FindFirstFileW,FindClose,	4_2_00409CCC
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_0040B11E FindFirstFileW,	4_2_0040B11E
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_00409708 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	4_2_00409708
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_004624F0 FindFirstFileA,GetDriveTypeA,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	11_2_004624F0
Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe	Code function: 17_2_00007FF7A7456560 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,	17_2_00007FF7A7456560
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF69768AA44 FindClose,FindFirstFileExW,FindNextFileW,FindClose,	36_2_00007FF69768AA44

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Code function: 1_2_00409F3C GetSystemInfo,

1_2_00409F3C

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: detect_x64.exe, 00000012.00000003.358084577.000002CC8AB32000.00000004.00000001.sdmp	Binary or memory string: vmnetextensionusAddReg
Source: detect_x64.exe, 00000012.00000003.277605945.000002CC8AA6F000.00000004.00000001.sdmp	Binary or memory string: vmnetextension
Source: waitfor.exe, 0000000D.00000002.245262917.00000000046B0000.00000002.00000001.sdmp, waitfor.exe, 0000000F.00000002.260394870.0000000004D20000.00000002.00000001.sdmp, detect_x64.exe, 00000011.00000002.325684353.000001C1DA470000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: detect_x64.exe, 00000012.00000003.307496512.000002CC8AAFF000.00000004.00000001.sdmp	Binary or memory string: vmnetextensionO@
Source: detect_x64.exe, 00000012.00000003.359448477.000002CC8AAF2000.00000004.00000001.sdmp	Binary or memory string: vmnetextensionu@
Source: detect_x64.exe, 00000012.00000003.313739760.000002CC8AAF5000.00000004.00000001.sdmp	Binary or memory string: vmnetextensionrs
Source: waitfor.exe, 0000000D.00000002.245262917.00000000046B0000.00000002.00000001.sdmp, waitfor.exe, 0000000F.00000002.260394870.0000000004D20000.00000002.00000001.sdmp, detect_x64.exe, 00000011.00000002.325684353.000001C1DA470000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: waitfor.exe, 0000000D.00000002.245262917.00000000046B0000.00000002.00000001.sdmp, waitfor.exe, 0000000F.00000002.260394870.0000000004D20000.00000002.00000001.sdmp, detect_x64.exe, 00000011.00000002.325684353.000001C1DA470000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: detect_x64.exe, 00000012.00000003.306013471.000002CC8AB2C000.00000004.00000001.sdmp	Binary or memory string: vmnetextensionOCIOI;GA;;;SY)(A;;0x1301bf;;;BA)(A;IOCIOI;GA;;;BA)(A;CIOI;GRGX;;;BU)(A;OICIIO;GA;;;CO)(A;CIOI;GRGWGXSD;;;PU)
Source: detect_x64.exe, 00000012.00000003.344834461.000002CC8AA72000.00000004.00000001.sdmp	Binary or memory string: vmnetextension@h(XM
Source: detect_x64.exe, 00000012.00000003.319540550.000002CC8AA8D000.00000004.00000001.sdmp	Binary or memory string: vmnetextensionsystem32\drivers\wfplwfs.sys,-6001g
Source: detect_x64.exe, 00000012.00000003.351611083.000002CC8AA86000.00000004.00000001.sdmp	Binary or memory string: vmnetextensionHh(XM
Source: detect_x64.exe, 00000012.00000003.355404187.000002CC8AB0A000.00000004.00000001.sdmp	Binary or memory string: HKR, Ndi\Interfaces,FilterMediaTypes,,"vmnetextension"
Source: curl_x64.exe, 0000000B.00000002.232324322.0000000000611000.00000004.00000020.sdmp, waitfor.exe, 0000000F.00000002.259868660.0000000002FA7000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: waitfor.exe, 0000000D.00000002.245262917.00000000046B0000.00000002.00000001.sdmp, waitfor.exe, 0000000F.00000002.260394870.0000000004D20000.00000002.00000001.sdmp, detect_x64.exe, 00000011.00000002.325684353.000001C1DA470000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\AppData\Local\Temp\detection.exe	API call chain: ExitProcess graph end node	graph_4-6521
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe

Code function: 36_2_00007FF697688EE0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

36_2_00007FF697688EE0

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe

Code function: 11_2_0042C2E0 GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,

11_2_0042C2E0

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe

Code function: 11_2_00464730 EntryPoint,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetCommandLineA,

11_2_00464730

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00418CD0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00418CD0
Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe	Code function: 17_2_00007FF7A7456CB0 SetUnhandledExceptionFilter,	17_2_00007FF7A7456CB0
Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe	Code function: 17_2_00007FF7A7456A94 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_00007FF7A7456A94
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF69768FD1C SetUnhandledExceptionFilter,	36_2_00007FF69768FD1C
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF697688EE0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	36_2_00007FF697688EE0
Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe	Code function: 36_2_00007FF69768BF74 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_00007FF69768BF74

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\system32\cmd.exe' /C START '' 'C:\Users\user\AppData\Local\Temp\interface.lnk'	Jump to behavior
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Process created: C:\Users\user\AppData\Local\Temp\detection.exe 'C:\Users\user\AppData\Local\Temp\detection.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\interface.cmd' '	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\curl_x64.exe 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request GET 'https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\sc.exe SC query Winmgmt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' driverfiles 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' drivernodes 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' stack 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\detect_x64.exe 'C:\Users\user\AppData\Local\Temp\detect_x64.exe' status 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\aes_x64.exe 'C:\Users\user\AppData\Local\Temp\aes_x64.exe' -e -p anT^UpFuzpuC@lOvsoPVe2kiNTidaBo<zI]BeaRnU0ResFwAy@dEnuCkUd)hAzOh -o 'C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' -	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\curl_x64.exe 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request POST --form 'v_configuration=<C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' 'https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\system32\cmd.exe' /C START '' 'http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR /S computer /SI unlock	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mode.com MODE CON: COLS=76 LINES=15	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c' VER '	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe FINDSTR /I /R /C:'version 5\.[0-1]\.'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\waitfor.exe WAITFOR unlock	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM

Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\curl_x64.exe 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request POST --form 'v_configuration=<C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' 'https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4'
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Process created: C:\Users\user\AppData\Local\Temp\curl_x64.exe 'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request POST --form 'v_configuration=<C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' 'https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4'			Jump to behavior

Source: waitfor.exe, 0000000C.00000002.489250483.00000000030E0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: waitfor.exe, 0000000C.00000002.489250483.00000000030E0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: waitfor.exe, 0000000C.00000002.489250483.00000000030E0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: waitfor.exe, 0000000C.00000002.489250483.00000000030E0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: waitfor.exe, 0000000C.00000002.489250483.00000000030E0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Code function: 1_2_00404CA8 cpuid

1_2_00404CA8

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	1_2_00409514
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: GetLocaleInfoW,	1_2_0042037C
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: EnumSystemLocalesW,	1_2_0042053C
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: GetLocaleInfoW,	1_2_0041D5D8
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: GetLocaleInfoW,	1_2_0041D624
Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_004089BC
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	4_2_00409E04
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: EnumSystemLocalesW,	4_2_0040B10E
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: GetLocaleInfoW,	4_2_0040B1C6
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: GetLocaleInfoW,	4_2_0040B1BE
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_004092AC
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetUserDefaultLCID,EnumSystemLocalesA,GetUserDefaultLangID,GetLocaleInfoA,GetLocaleInfoA,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,	11_2_0046D1D0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: EnumSystemLocalesA,	11_2_0046D060
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: EnumSystemLocalesA,	11_2_0046D130
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,MultiByteToWideChar,	11_2_004733A0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoA,MultiByteToWideChar,	11_2_004734C7
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoA,	11_2_004714A0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,GetLocaleInfoA,	11_2_004735B0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoW,WideCharToMultiByte,	11_2_004736D0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoA,	11_2_0046C860
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoA,	11_2_0046C9C0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoA,	11_2_0046CAD0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,	11_2_0046CBE0
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: GetLocaleInfoA,	11_2_0046CF30

Source: C:\Users\user\AppData\Local\Temp\detect_x64.exe

17_2_00007FF7A745286C

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\detection.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation ActiveTimeBias

Jump to behavior

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Code function: 1_2_0041BB80 GetLocalTime,

1_2_0041BB80

Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe

Code function: 11_2_00467160 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_00467160

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe

Code function: 1_2_0041F038 GetVersionExW,

1_2_0041F038

Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: detect_x64.exe, 00000012.00000003.262044414.000002CC8AAB6000.00000004.00000001.sdmp	Binary or memory string: PGSETUP.EXE
Source: detect_x64.exe, 00000012.00000003.262044414.000002CC8AAB6000.00000004.00000001.sdmp	Binary or memory string: 123.exe

Source: C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe	Code function: 1_2_0044F3E4 CreateBindCtx,MkParseDisplayNameEx,	1_2_0044F3E4
Source: C:\Users\user\AppData\Local\Temp\detection.exe	Code function: 4_2_0040B882 CreateBindCtx,	4_2_0040B882
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0042A600 htons,htons,htons,htons,bind,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	11_2_0042A600
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_00440900 getsockname,WSAGetLastError,WSAGetLastError,htons,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,	11_2_00440900
Source: C:\Users\user\AppData\Local\Temp\curl_x64.exe	Code function: 11_2_0043AFF0 bind,WSAGetLastError,	11_2_0043AFF0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation511	Windows Service1	Access Token Manipulation1	Deobfuscate/Decode Files or Information11	Input Capture1	System Time Discovery12	Exploitation of Remote Services1	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Native API3	Boot or Logon Initialization Scripts	Windows Service1	Obfuscated Files or Information3	LSASS Memory	File and Directory Discovery3	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter112	Logon Script (Windows)	Process Injection12	Software Packing11	Security Account Manager	System Information Discovery247	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution1	Logon Script (Mac)	Logon Script (Mac)	Masquerading1	NTDS	Query Registry2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion32	LSA Secrets	Security Software Discovery541	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Access Token Manipulation1	Cached Domain Credentials	Virtualization/Sandbox Evasion32	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection12	DCSync	Process Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
Mes_Drivers_3.0.4.exe	12%	Virustotal	Browse
Mes_Drivers_3.0.4.exe	14%	Metadefender	Browse
Mes_Drivers_3.0.4.exe	17%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\aes_x64.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\aes_x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\aes_x86.exe	21%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\aes_x86.exe	21%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Local\Temp\curl_x64.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\curl_x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\curl_x86.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\curl_x86.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\detect_x64.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\detect_x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\detect_x64_2.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\detect_x64_2.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\detect_x86.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\detect_x86.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\detection.exe	10%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\detection.exe	28%	ReversingLabs	Win32.Infostealer.Limitail

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.detection.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen		Download File
4.1.detection.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Link
46-105-202-207.any.cdn.anycast.me	0%	Virustotal	Browse
cdn.appconsent.io	1%	Virustotal	Browse
ads.sportslocalmedia.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.post.com/postit.cgi	0%	Avira URL Cloud	safe
http://help.with.curl.com/curlhelp.html	0%	Avira URL Cloud	safe
http://www.weirdserver.com:8000/	0%	Avira URL Cloud	safe
http://www.nationsbank.com/	100%	Avira URL Cloud	phishing
https://www.secure-site.com	0%	Avira URL Cloud	safe
https://trust.web.de0	0%	Avira URL Cloud	safe
http://machine.domain/full/path/to/file	0%	Avira URL Cloud	safe
http://www.formpost.com/getthis/post.cgi	0%	Avira URL Cloud	safe
https://git.fedora-	0%	Avira URL Cloud	safe
http://www.abyssmedia.com	0%	Avira URL Cloud	safe
http://that.secret.site.comEXTRA	0%	Avira URL Cloud	safe
http://www.where.com/guest.cgi	0%	Avira URL Cloud	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://curl.haxx.seFTP	0%	Avira URL Cloud	safe
https://trust.web.de01	0%	Avira URL Cloud	safe
http://www.drh-consultancy.d	0%	Avira URL Cloud	safe
ftp://ftp.leachsite.com/README	0%	Avira URL Cloud	safe
http://www.formpost.com/getthis/	0%	Avira URL Cloud	safe
ftp://ftp.com/moo.exe	0%	Avira URL Cloud	safe
http://www.drh-consultancy.demon.co.uk/	0%	Avira URL Cloud	safe
http://www.get.this/	0%	Avira URL Cloud	safe
http://www.upload.com/myfile	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
partnerad.l.doubleclick.net	142.250.180.226	true	false		high
googleads.g.doubleclick.net	216.58.214.194	true	false		high
srv1.touslesdrivers.com	85.31.204.81	true	false		high
46-105-202-207.any.cdn.anycast.me	46.105.202.207	true	false	0%, Virustotal, Browse	unknown
cdn.appconsent.io	35.227.209.167	true	false	1%, Virustotal, Browse	unknown
tags.smilewanted.com	104.26.7.39	true	false		high
securepubads.g.doubleclick.net	unknown	unknown	false		high
ads.sportslocalmedia.com	unknown	unknown	false	1%, Virustotal, Browse	unknown
www.touslesdrivers.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.post.com/postit.cgi	curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://trust.web.de/crl/ca03.crl0	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	false		high
http://help.with.curl.com/curlhelp.html	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
ftp://ftp.sunet.se/pub/www/utilities/curl/SEE	curl_x64.exe	false		high
https://secure.site.com/	curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
ftp://ftp.funet.fi/README	curl_x64.exe	false		high
https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4	detection.exe, 00000004.00000003.399826501.0000000000A22000.00000004.00000001.sdmp	false		high
http://that.secret.site.com	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://www.weirdserver.com:8000/	curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nationsbank.com/	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	true	Avira URL Cloud: phishing	unknown
https://curl.haxx.se/libcurl/c/curl_easy_setopt.html	curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
ftp://ftp.sunet.se/pub/www/utilities/curl/	curl_x64.exe	false		high
http://curl.haxx.se/0	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	false		high
http://trust.web.de/crl/ca03.crl0	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	false		high
https://www.secure-site.com	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahMAzOh	detection.exe, 00000004.00000002.404454752.00000000009DC000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.398665475.00000000009DA000.00000004.00000001.sdmp	false		high
https://curl.haxx.se/docs/http-cookies.html	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
https://curl.haxx.se/docs/http-cookies.html#	curl_x64.exe	false		high
https://trust.web.de0	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/P	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp	false		high
https://www.openssl.org/docs/apps/ciphers.html	curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	false		high
https://curl.haxx.se/docs/copyright.htmlD	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp	false		high
https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=.S	detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp	false		high
https://curl.haxx.se/docs/	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://machine.domain/full/path/to/file	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se	curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://www.formpost.com/getthis/post.cgi	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://ftp.mozilla.org	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
https://git.fedora-	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	low
http://www.abyssmedia.com	detection.exe, 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netscape.com/index.html	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://that.secret.site.comEXTRA	curl_x64.exe	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/rfc/rfc2255.txt	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4	curl_x64.exe, 0000000B.00000002.232370646.00000000009D0000.00000004.00000040.sdmp	false		high
https://curl.haxx.se/mail/.	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://www.where.com/guest.cgi	curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.touslesdrivers.com/php/mes_drivers/code_source.php	Mes_Drivers_3.0.4.exe, 00000001.00000003.407054994.00000000023C7000.00000004.00000001.sdmp, Mes_Drivers_3.0.4.exe, 00000001.00000002.410166298.0000000002810000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp	false		high
https://curl.haxx.seFTP	curl_x64.exe	false	Avira URL Cloud: safe	unknown
http://url.com/file.txt	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4ahM&v_version=indo	detection.exe, 00000004.00000003.399944667.00000000009B3000.00000004.00000001.sdmp	false		high
https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=	detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.226335116.0000000002AB1000.00000004.00000001.sdmp	false		high
ftp://cool.haxx.se/	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
https://trust.web.de01	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netscape.com/	curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://remote.server.com/remote.html	curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
https://curl.haxx.se/docs/sslcerts.htmlcurl	curl_x64.exe	false		high
ftp://ftp.server.com/path/file	curl_x64.exe	false		high
http://www.touslesdrivers.com/index.php?v_page=31&v_id=	detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.226335116.0000000002AB1000.00000004.00000001.sdmp	false		high
https://curl.haxx.se/docs/sslcerts.html	curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://www.drh-consultancy.d	curl_x64.exe	false	Avira URL Cloud: safe	unknown
http://www.showme.com/	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://www.netscape.com/HTTPS	curl_x64.exe	false		high
https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_versio	detection.exe, 00000004.00000003.399270098.00000000009F9000.00000004.00000001.sdmp	false		high
https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4work	detection.exe, 00000004.00000003.400740202.0000000000A3F000.00000004.00000001.sdmp	false		high
ftp://ftp.leachsite.com/README	curl_x64.exe	false	Avira URL Cloud: safe	unknown
http://www.server.com/	curl_x64.exe, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false		high
http://www.formpost.com/getthis/	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.touslesdrivers.com/index.php?v_page=31&v_id=V	detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp	false		high
https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=	detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp, detection.exe, 00000004.00000003.226335116.0000000002AB1000.00000004.00000001.sdmp	false		high
ftp://ftp.com/moo.exe	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4x	detection.exe, 00000004.00000002.404357113.000000000099B000.00000004.00000001.sdmp	false		high
http://www.drh-consultancy.demon.co.uk/	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=Ad	detection.exe, 00000004.00000003.228885857.0000000002AB8000.00000004.00000001.sdmp	false		high
http://www.get.this/	curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/copyright.html	curl_x64.exe	false		high
http://www.upload.com/myfile	detection.exe, 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, curl_x64.exe, 0000000B.00000000.230122223.0000000000475000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/	curl_x64.exe	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
85.31.204.81	srv1.touslesdrivers.com	Sweden	30781	JAGUAR-ASFR	false
46.105.202.207	46-105-202-207.any.cdn.anycast.me	France	16276	OVHFR	false
142.250.180.226	partnerad.l.doubleclick.net	United States	15169	GOOGLEUS	false
104.26.7.39	tags.smilewanted.com	United States	13335	CLOUDFLARENETUS	false
35.227.209.167	cdn.appconsent.io	United States	15169	GOOGLEUS	false
216.58.214.194	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	445340
Start date:	07.07.2021
Start time:	16:17:26
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Mes_Drivers_3.0.4.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.evad.winEXE@52/81@9/7
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 10.2% (good quality ratio 8.7%) Quality average: 63.5% Quality standard deviation: 34.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 104.42.151.234, 131.253.33.200, 13.107.22.200, 52.255.188.83, 151.139.128.14, 23.35.236.56, 20.82.210.154, 173.222.108.210, 173.222.108.226, 40.112.88.60, 80.67.82.211, 80.67.82.235, 23.203.80.193, 172.217.20.2, 142.250.180.238, 152.199.19.161 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, go.microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.google-analytics.com, www.bing.com, fs.microsoft.com, ocsp.usertrust.com, www-google-analytics.l.google.com, ie9comview.vo.msecnd.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, pagead2.googlesyndication.com, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, skypedataprdcolwus16.cloudapp.net, cs9.wpc.v0cdn.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:18:27	API Interceptor	4x Sleep call for process: waitfor.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
85.31.204.81	https://fichiers2.touslesdrivers.com/Mes_Drivers_3.0.4.exe	Get hash	malicious	Browse	www.touslesdrivers.com/index.php?v_page=31&v_id=qh9KWfRS01S5Sbvf

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
tags.smilewanted.com	https://fichiers2.touslesdrivers.com/Mes_Drivers_3.0.4.exe	Get hash	malicious	Browse	104.24.19.41
srv1.touslesdrivers.com	https://fichiers2.touslesdrivers.com/Mes_Drivers_3.0.4.exe	Get hash	malicious	Browse	85.31.204.81

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
JAGUAR-ASFR	ZCOE3V1Cvt.exe	Get hash	malicious	Browse	194.242.45.41
	SecuriteInfo.com.BehavesLike.Win32.Generic.cm.exe	Get hash	malicious	Browse	194.242.45.41
	SecuriteInfo.com.Trojan.PackedNET.540.9726.exe	Get hash	malicious	Browse	194.242.45.41
	SilaeClient.application	Get hash	malicious	Browse	31.7.255.66
	X1xGVS7K4qY.doc	Get hash	malicious	Browse	194.88.246.242
	X1xGVS7K4qY.doc	Get hash	malicious	Browse	194.88.246.242
	Outstanding Invoices.doc	Get hash	malicious	Browse	194.88.246.242
	Outstanding Invoices.doc	Get hash	malicious	Browse	194.88.246.242
	Media Shower.exe	Get hash	malicious	Browse	194.88.246.242
	67207.exe	Get hash	malicious	Browse	194.88.246.242
	2018.doc	Get hash	malicious	Browse	194.88.246.242
	2018.doc	Get hash	malicious	Browse	194.88.246.242
	AYkrhDP.doc	Get hash	malicious	Browse	194.88.246.242
	AYkrhDP.doc	Get hash	malicious	Browse	194.88.246.242
	Fwd_ ACH form.doc	Get hash	malicious	Browse	194.88.246.242
	Fwd_ ACH form.doc	Get hash	malicious	Browse	194.88.246.242
	emotet2.exe	Get hash	malicious	Browse	194.88.246.242
	LSteR4mqIIzH3.doc	Get hash	malicious	Browse	194.88.246.242
	LSteR4mqIIzH3.doc	Get hash	malicious	Browse	194.88.246.242
	Outstanding Invoices.doc	Get hash	malicious	Browse	194.88.246.242
OVHFR	NWMEaRqF7s.exe	Get hash	malicious	Browse	5.39.91.110
	OMJe815AqT.exe	Get hash	malicious	Browse	51.254.241.28
	His4jRklYe.exe	Get hash	malicious	Browse	51.79.119.231
	4z5jQqNiJl.exe	Get hash	malicious	Browse	51.75.77.27
	H9QnI1DbC1.exe	Get hash	malicious	Browse	142.44.243.6
	Wws1Rnd02H.exe	Get hash	malicious	Browse	176.31.117.84
	HTbemZcLWN.exe	Get hash	malicious	Browse	176.31.117.84
	nC4niiFqg0.exe	Get hash	malicious	Browse	176.31.117.84
	i	Get hash	malicious	Browse	192.99.3.72
	978B4AC05A227B23EF7E4FADFF92966339BA1413BAC5A.exe	Get hash	malicious	Browse	188.165.207.8
	62EAE1F670683A10909351D0DBA4C6CBDADD53C056FE5.exe	Get hash	malicious	Browse	51.68.125.34
	7xhLwiPIrR.exe	Get hash	malicious	Browse	142.44.243.6
	SoMuAF6xvf.dll	Get hash	malicious	Browse	54.39.106.25
	SoMuAF6xvf.dll	Get hash	malicious	Browse	54.39.106.25
	19495C90691E8B6EEF5D55D50B9D76AE6CEB5629D6C08.exe	Get hash	malicious	Browse	142.4.200.50
	u867uMlwux.dll	Get hash	malicious	Browse	54.39.106.25
	Payment Slip.xlsb	Get hash	malicious	Browse	178.33.222.243
	2020-TAX-EXTENSION.doc	Get hash	malicious	Browse	145.239.131.55
	Gift Card 0796907.xlsb	Get hash	malicious	Browse	217.182.175.206
	Gift Card 0796907.xlsb	Get hash	malicious	Browse	217.182.175.206
CLOUDFLARENETUS	PW1-WO-004 PDF.exe	Get hash	malicious	Browse	104.21.19.200
	4997169.exe	Get hash	malicious	Browse	104.21.80.171
	INVITATI.EXE	Get hash	malicious	Browse	104.21.19.200
	Machine Specification.exe	Get hash	malicious	Browse	172.67.188.154
	P.O.exe	Get hash	malicious	Browse	172.67.188.154
	3MIvJieGXT.exe	Get hash	malicious	Browse	104.21.51.99
	SaI1j8jXQY.exe	Get hash	malicious	Browse	162.159.135.233
	FEED DEBTORS AGEWISE JUNE-21.exe	Get hash	malicious	Browse	104.21.91.43
	runsys32.dll	Get hash	malicious	Browse	104.20.184.68
	6aSBBC4aJx.exe	Get hash	malicious	Browse	104.21.42.63
	RFQ# ETS Project-070721B3.doc	Get hash	malicious	Browse	162.159.130.233
	tMAfN344rmHC9Zi.exe	Get hash	malicious	Browse	104.21.19.200
	OMJe815AqT.exe	Get hash	malicious	Browse	162.159.129.233
	sud-life-mobcast.apk	Get hash	malicious	Browse	104.22.10.83
	7MPEfVAwHo.exe	Get hash	malicious	Browse	172.67.188.154
	sud-life-outwork.apk	Get hash	malicious	Browse	104.22.11.83
	SecuriteInfo.com.Trojan.Win32.Save.a.9623.exe	Get hash	malicious	Browse	104.21.19.200
	Payment Details.exe	Get hash	malicious	Browse	104.21.19.200
	Schedule072021R7218468.xlsm	Get hash	malicious	Browse	104.21.52.111
	Outfordelivery-787848.xlsm	Get hash	malicious	Browse	104.21.52.111

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9e10692f1b7f78228b2d4e424db3a98c	FAX.HTML	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	runsys32.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	Mclawslaw.ca_Fax-Message.html	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	E00E.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	Payslip070620219359636Z.html	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	attach.html	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	VM52MC9YQDUO0P.html	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	RFQ40110 (2).html	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	runsys32.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	2790000.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	2770174.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	q7p7x4f4gX.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	q7p7x4f4gX.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	PO # 2367.html	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	( 1 ) Voice note-Dassault-aviation.htm	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	mJSDCeNxFi.exe	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	3rc4z6ltNu.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	3rc4z6ltNu.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	iew852qEQI.exe	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194
	6us663UjcE.dll	Get hash	malicious	Browse	104.26.7.39 46.105.202.207 142.250.180.226 35.227.209.167 216.58.214.194

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\aes_x86.exe	53c0505a_by_Libranalysis.exe	Get hash	malicious	Browse
	hztxqReczN.exe	Get hash	malicious	Browse
	BleachGap.exe	Get hash	malicious	Browse
	SuperEnjoy.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\DURNCK2N\www.touslesdrivers[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1149
Entropy (8bit):	4.747828800985921
Encrypted:	false
SSDEEP:	24:WU5QKG4RpG4RfG4RVK9G4RO5G4RkG4MU5QKG4RpG4RfG4RVK9G4RO5G4RkG4ghnh:L5Qx4+4Y4W44884d4N5Qx4+4Y4W4488I
MD5:	38431A6165E6465C6653B93612467878
SHA1:	B5AB5255FD5F650380D890E8F98A68F68A7F3C85
SHA-256:	19EF1B12D477C4B14F0E0C2B9584CC46B85963BDCA9AD97AFC036AA84C3DCBC9
SHA-512:	735A2F226F2B8FE6E936BBC5AEB2B09EFF19F947B85A7210CDFC75D89B3DD98E47193C8B004B184A4D4594330984065A765BA580FE364A206011371BC5406C1F
Malicious:	false
Preview:	<root></root><root><item name="goog_pem_mod" value="219" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod34" value="233" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod53" value="546" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod36" value="593" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod37" value="538" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod44" value="66" ltime="2404659120" htime="30897030" /></root><root><item name="goog_pem_mod" value="219" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod34" value="233" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod53" value="546" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod36" value="593" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod37" value="538" ltime="2404659120" htime="30897030" /><item name="google_experiment_mod4

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CB2B1FBA-DF79-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	24152
Entropy (8bit):	1.7566510753587679
Encrypted:	false
SSDEEP:	96:rAZHZen2eGkWeGoZteGovfeGo587teGo5TItAKWeGoIaTxY6:rAZHZg2IWctSf/tRLWM
MD5:	F2094B58785E889300E51A297B323A13
SHA1:	3E0656A812951617423CD41E7343F8C9AB52D289
SHA-256:	A362C87F77828C195DC393A3A8246D454E1C8526F77091E4A741F0BD09D95BF8
SHA-512:	C14BB522BE7DA852EEF14756B8472CC4A6A86F1DEA6CC9CC6E0353A9F5030444DFD94715C4EEBBFCC77FFE0BA80269C9810BE1D89F8E28D3352E519CB3A7F50F
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CB2B1FBC-DF79-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28434
Entropy (8bit):	2.121175278022863
Encrypted:	false
SSDEEP:	192:rIZ/QjiQh0QEFKQHuWQL2QlvQKbyi7y+89MVcKJQXs/Mt8r:rI4ehHKSBOLpoM6XsUK
MD5:	3D75EF0B794B72284F831C33F1CF911F
SHA1:	28CA94F0CCE17724AEFF73BBAF1C45CD994A976E
SHA-256:	6A91C9CFDE7ED356C4647E28DEA9B6F9299094C8D74231D7B5C2E64BE338C6FB
SHA-512:	1BCA7CE57C6016E14579F6F6586E1321A8E22D1D6CB61F8A1B8B7C469185CAE1AC3E9F44F9978CC7CDD1E551E3763D4DBD6F43536EB99AC381A8277B4F6FF7E3
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	5.070960637996196
Encrypted:	false
SSDEEP:	12:TMHdNMNxOEGwJw/CnWimI002EtM3MHdNMNxOEGwJw/CnWimI00ONVbkEtMb:2d6NxOlSHSZHKd6NxOlSHSZ7Qb
MD5:	C820C86A16E361C049E45BD7BD2633B1
SHA1:	8C490BBD560F1C156F467FEDEC469F7992B9E427
SHA-256:	70D14EDC26FF956FB80AB91C702AB9433639F498F05844F25E3983049BDEC58B
SHA-512:	87C8170F7C3A29027796C5A7F9F2B2EA76250C1141CBD9E78969A486E354168148367EC72EE03FF23FF74A2B7E4710E236EB6D036C6DF713E76F8FF68D804758
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.0767930435485145
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2kUKTK7CnWimI002EtM3MHdNMNxe2kUKTK7CnWimI00ONkak6EtMb:2d6NxrLKTKuSZHKd6NxrLKTKuSZ72a7b
MD5:	0566A379CAD412A4472E56F3012ADE53
SHA1:	09C59E53918537468B6BA4C87B8E4D9779C25211
SHA-256:	700A16961A5A598794052284518200F7E7CF50967066AA7540CB0241F287A6A2
SHA-512:	DB6ADCBADF682A766F7DA1AF796500C3121629431138247CFD249F5C1E5AD87A5DF98D53BBE1F9A3602B60001F48AA981E809BC3649426D4785079FB6695873F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0xa1f0d1a5,0x01d77386</date><accdate>0xa1f0d1a5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0xa1f0d1a5,0x01d77386</date><accdate>0xa1f0d1a5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.09038772814423
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLGwJw/CnWimI002EtM3MHdNMNxvLGwJw/CnWimI00ONmZEtMb:2d6NxviSHSZHKd6NxviSHSZ7Ub
MD5:	324831E1E7870332C641A0ADC532DB48
SHA1:	ED6641C62255137886967E337B56ACA1B8103E72
SHA-256:	0A4551E8674190FF4C6CA4DA430DCAA6E4652BA8FEF9B9A7C8554C6E6AD1EB0B
SHA-512:	9CF0414B252A88D3B0D5CF6177222BEF8398DAE53B2753C354DE99F0E4B6E71FFD0519C6F7D091E3002CEED5D83F1E47D0C8E615021A10F6A048743B205E9AFA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	648
Entropy (8bit):	5.085808071867358
Encrypted:	false
SSDEEP:	12:TMHdNMNxiGwJw/CnWimI002EtM3MHdNMNxiGwJw/CnWimI00ONd5EtMb:2d6NxbSHSZHKd6NxbSHSZ7njb
MD5:	F2A7FD434E6DA631F08C263AA5CB8D86
SHA1:	0B87F3DEC9775670FAC4ED2B8C73D0220328F83E
SHA-256:	2F1AA046DE93B7F62BF2983D5710DCAAC6A4864D377FC34F99AD8B0C7577EE9C
SHA-512:	915B08D87832D92213BD204D598BACCA043BC3056362837352C6626B24B9B2416B7ED5F971A90014AC7DFEF4C1EC87971C8B01EEBBBF4E4F075F69230EE9D430
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	5.111091333937085
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwGwJw/CnWimI002EtM3MHdNMNxhGwGw5CnWimI00ON8K075EtMb:2d6NxQ5SHSZHKd6NxQ5vSZ7uKajb
MD5:	9B16649B7FB0304B871035958FA6E45F
SHA1:	18A15A23266DAB013DC5B0533242A6504C949964
SHA-256:	178A3C0B0FFD4D51E8964574836BAF7B02AB19D280D36FA32EC4B8131F78A869
SHA-512:	3B49CC4DC056FFECA26AC3E3CEFC8F911BD09CC19AE7DA7D33D916DC769A0080B86C8BA277AC0D70B251220A2664F300A88B7F4CDE2C2B6F23C5D856D977B653
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa207b505,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.074601648309996
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nGwJw/CnWimI002EtM3MHdNMNx0nGwJw/CnWimI00ONxEtMb:2d6Nx0GSHSZHKd6Nx0GSHSZ7Vb
MD5:	46B355072F66142857F85733C9845FDF
SHA1:	87EB8ED7053F49C3EAF9348EA8D36B70FE5AE30E
SHA-256:	A78C9B36EF276B589D84D36375ED25EAD84154772AAA70B33C2F3AEF3302E6FD
SHA-512:	98B9375ADD8232449387829287340599496110F1A5BA4ACDF3E5E441511F96B6B06943EFCF246DDBFFF21C8D38879DAFC7ACD431D2009C060CCCE169F9101ECE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	5.11053558965378
Encrypted:	false
SSDEEP:	12:TMHdNMNxxGwJw/CnWimI002EtM3MHdNMNxxGwJw/CnWimI00ON6Kq5EtMb:2d6NxoSHSZHKd6NxoSHSZ7ub
MD5:	29C27095F70CE27F08ED4680D4AC18CE
SHA1:	BF26A97CECD18DD8F78D4DBF4440394F494D4B7E
SHA-256:	4DEC647A5C0320FF239EFAE87E2C4181BF813409A9AB019F3403F67ECADC033A
SHA-512:	E27B5366F287F1DC9C603BB17D8CC0CF8531C9E3F38B193D46204DDBA0436C8A69E1F89B4DEFE5ACC3446F72C3307D1A83F5BEAD1DA960769F7737086AD57974
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	660
Entropy (8bit):	5.090841465801232
Encrypted:	false
SSDEEP:	12:TMHdNMNxcGwJw/CnWimI002EtM3MHdNMNxcGwJw/CnWimI00ONVEtMb:2d6Nx9SHSZHKd6Nx9SHSZ71b
MD5:	714DC758FEADC372CF5979C7A52E26A0
SHA1:	28930CA1058279D870189DB532B1996D9BF64F96
SHA-256:	874AA2450E699F8BDDE6D8FCC705265328790FF1B76CDF664825BA7C8111739E
SHA-512:	A810183045FEF141D37A6AEE4AEFA4F3601AF407F6ED60A6843797F63761703F70635C7C1462D86D99F5C99900F7683914FB2FDDBD3F1389E2E485D0E14EC6D8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.071300069294579
Encrypted:	false
SSDEEP:	12:TMHdNMNxfnGwJw/CnWimI002EtM3MHdNMNxfnGwJw/CnWimI00ONe5EtMb:2d6Nx+SHSZHKd6Nx+SHSZ7Ejb
MD5:	DF1C8E0ED2200BDAD29BB5E68A5B86A6
SHA1:	67500311DD242A0B554ADB5CBB97BCCDB5F60AE9
SHA-256:	72E9737B3336D415FF75E06A4BEE0F1536B1B58C2C71F73212172BC60B436495
SHA-512:	40476AE6C98F437E629AB7BFAF901663D792390F934B3AD32B141BFE8029155383159FE285C41E50E26CB620AFCD0B1FA2C254295FDD3DE68DDD14F5E8B5BA41
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0xa20013e5,0x01d77386</date><accdate>0xa20013e5,0x01d77386</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\dikxvqf\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	3384
Entropy (8bit):	4.546830126769735
Encrypted:	false
SSDEEP:	48:pONSvGNwTiNNUBd8dKEGBgT+bzoz7QzM8Y45vl/f4OrWF:gkvGN/NN6uKEn6YXQwMoOr+
MD5:	8F4DED883F678051B34684898FCA42C1
SHA1:	95138326896D7E394AB6E69E12A5BF45952D56EF
SHA-256:	EFFFA36F8FCE3897799F1ED80A93F656F7D46B5E17E226C438690980BFB09D62
SHA-512:	D46EBA8A776D6B076D53D6E4A1D3AA8510C8EDC5A90BBD6C0E6797BAAA453256158D30E66A92D850CD4740152A30F19A9975DF56D46547631B393A24C3989DEB
Malicious:	false
Preview:	.h.t.t.p.s.:././.w.w.w...t.o.u.s.l.e.s.d.r.i.v.e.r.s...c.o.m./.f.a.v.i.c.o.n...i.c.o........... ..............(... ...@...............................................................................................................................!.c^..........................................................aZ........................................IB.....................................................E>...........................................XS...............................................................................................-$.................................................................................................................................................................................................................................................LI...................#..#..#..#..#..!..!...........................................................................#.#.#.#.#.(!.(..&..#.....!.............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\f[1].txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	138064
Entropy (8bit):	5.5669460283060115
Encrypted:	false
SSDEEP:	1536:2Xhvx2zPDi4gC4lsfg4tS+kssmhpfWTxK01CPYxStSTulj6JILDrJOF7R7lMMdPm:NzYl67k2gJxCj62KR7lX1RQ69PM
MD5:	BDB37E14039F70677DCE242D596CABBC
SHA1:	8AD1E0BB3A471D584F6A5ABCACB7C1D3ADB573D2
SHA-256:	BE708150523CC8B5E75C597397DB27DA8A982A077BD14EDB0164EA097C3A7A62
SHA-512:	793978B9CB5C394827E7F0177F625D6A1D51E6BBA067A8BACCD9E96053D2F24ADAC3F227758F17A540FD242557AAD22F768D23518107D4D60EE47657C6A96BA9
Malicious:	false
IE Cache URL:	https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Preview:	(function(sttc){/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var n,aa;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a}; .function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this),ha="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),p={},ia={};function r(a,b){var c=ia[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]} .function ja(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in p?f=p:f=fa;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=ha&&"es6"===c?f[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 24 bits/pixel
Category:	downloaded
Size (bytes):	3262
Entropy (8bit):	4.485268324024185
Encrypted:	false
SSDEEP:	48:wvGNwTiNNUBd8dKEGBgT+bzoz7QzM8Y45vl/f4OrW:wvGN/NN6uKEn6YXQwMoOr
MD5:	0580BE944FDB0CA958CEE222CE2C33EF
SHA1:	76840612E4FB069A0257E1D541CEFF3E05258C5B
SHA-256:	EFDCC2E389940AF4E17F30027E2DE083A4A6206BD93865D573F35AEB24D48548
SHA-512:	2EE223EE90D804AD96C7CD34B37FEE91B04426BBF03390AC3D5BA25D4636E7F0CCE0BCD5F96DD8CF04FCA197C2A4A049EE47FABCB93942558D8117A3803F1842
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/favicon.ico
Preview:	...... ..............(... ...@...............................................................................................................................!.c^..........................................................aZ........................................IB.....................................................E>...........................................XS...............................................................................................-$.................................................................................................................................................................................................................................................LI...................#..#..#..#..#..!..!...........................................................................#.#.#.#.#.(!.(..&..#.....!.............................................................1.2+.2+.1.1./(./(.-&.+$.*#.#..@;.......................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\fond_cadre_gauche[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 20 x 1
Category:	downloaded
Size (bytes):	96
Entropy (8bit):	5.537374739988986
Encrypted:	false
SSDEEP:	3:C2lmRKVA2Hy8jGYF+YdmRa//lillhojE:6sq23Gm+YdQl74E
MD5:	C24692F799AAF2F5AD6639C6B7951AA5
SHA1:	41AAC8D27A14C1A44E0259624B26FD34A548EFFD
SHA-256:	F460795DED908CA63FD1EDDC5A41FE275A916A0DCACDB7A28E2B3D37FB5E36B2
SHA-512:	560B7832F0AA1E02BBDA31A5BD25EBD69EA84CB856F2847B714F6D1F2410D3B104D2C8A6FA9D8B6CAEDDACB01E97F8C6964B48D6B387E3879474599A447D6D4D
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/fond_cadre_gauche.gif
Preview:	GIF89a........L.{.....e..)b....;p.......P~..V........D....!.......,.............EL.....@O.F.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\host_name[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2193
Entropy (8bit):	7.889290673872146
Encrypted:	false
SSDEEP:	48:dM1pX9knogc+HJ2F6onxETbr5a+OwenXz7mD7paMfQ3wPOe:q1sndc+U1ETbrdxenXXmRffPOe
MD5:	AD8E6747D4030231BA900F9B099E7290
SHA1:	3510865939B06510F48A73495B9EF09E8B325C40
SHA-256:	B3208CACE7FFE15BE999E3A06335FDADF465F4AD9D5B53817C73AFD78701CB26
SHA-512:	99F12AC94A7AB8753B3D3F9667DFF84819F0ACA27F092282FC2127F20447D4102813886C7D34A7477A80B568D2D7E060791A3791622EE33196E76EFD0A95D5EA
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/resume/host_name.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...3IDATx..Wil..........z.....$`.7.0k.H..v.J.!.^.J.$.">T.P..Z..R.D.UT.U.4R....BK...u.q..s..X.w...k..........&......{....3........1.J.A..y...i.d.L.....&..t"n(J.&....L(.\P..X,.q.....ZZZ.L&..WRI.f.....w\|.u..'<.JO{..\|..n..H........7:/....$M..e.mmmp.\3....QUU.UU.%P.z.?:..U.6.....w;..9\.L.?...:.<..%.\|..9.._.....(.7.L..\|.x<.g.%..E.}...[..>.../.Kf..S...W..............`.......o...\|C.m.=...7..I.f.w^\|...Ub..#.S.....7..n....J[2...*.............xjw....l.}..~~.7&R/t...9..`$...'.z[.........1.....#..C.....\|.S.ry..w....n.e.....$.&.3`.Dd4.B ..@...PT..h0."TC....Ze\....).......ZZ..^{....7h.=.R.D@..=..V.....A.;........tH..........4.x.....hL./...aC$.`..[..5}.QI&/.!@.....Mc..c.nug2.i..O.}.?......?.A ).n...8;...7.gc""..,.'..L9.i..oRh.#.k.W.l\|ty..1.;}.':;;O.BS...........a..@....R....=:...f..,"..a.3X.a..Q.....L.C.[.V?m...i)w.[....3....-....$<K...N...........uJ....w=..._.(..^.....,...Q].ry..e%.;9'.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\loader[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	263
Entropy (8bit):	4.845707282245
Encrypted:	false
SSDEEP:	6:Qr/8/iFSgbDRWs+Oi+8mgO9l3sGAicLmsBtWcawncG5n:YYiFxDRWXu3xAixsj0wn35
MD5:	939C4AB6F35E346B2014E2719E073E03
SHA1:	A24ACAFA350E3CF1DB80557BF1F5FBF1F1F0F842
SHA-256:	45FCB9A07E3F111F6EB17F93E31450B0D60240FAB0A8CF361478D12F3CA908AB
SHA-512:	0D87F0CE57463594E827F30DE056008A8875B77CEFD45BF0B347ADBC466D03998FE68C3A616D1001B038906160A094BD7A12CE4F05085CDD34F39E6AB484D2F3
Malicious:	false
IE Cache URL:	https://cdn.appconsent.io/loader.js
Preview:	'use strict'.var baseUrl = 'https://cdn.appconsent.io/tcf2/28.4.0'.var head = document.getElementsByTagName('head')[0].var script = document.createElement('script').script.type = 'text/javascript'.script.src = baseUrl + '/core.bundle.js'.head.appendChild(script).

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\memory[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1077
Entropy (8bit):	7.775326271252012
Encrypted:	false
SSDEEP:	24:J8Uvz66BLEp7oPKfsx3OuDivHwaMVAYKpFUOqqr:J8+EhzycHfMVzvYr
MD5:	2BC67C912BCC4A8FCDDD17D405A1F3D5
SHA1:	986EBE371D7040D1740D12AF537BD9755E411781
SHA-256:	EB7813C98D7B33ED273059B95B781918B53F1D02AE42D888577BCE7F8F7DD61A
SHA-512:	55D6BE705F771385C09E5D9E05DA0BFE396FFAB853B884C7C1FBC77D249CF1AAFC1832004F1741D0246CB280AE05DE40089F79A90AA75855675E79FEBA2646B3
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/resume/memory.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..V.o#E......k.v.I8r..:8...DC......!Q .._...QPSs..@.....%$qrk{vg.7.^...).g.....}....{...8..Z9.r`...; .."V..5./.s...z...9cp.73.\4.9.X....5v.....l.7....y...Y.6...;.....^...xT.;]L.)..........Rhc ...9.'....t.6...1h1z.Q....yQ ...w>~e.......NOO...q.qL.J.N.....EB.!.8.Sr`.tVSv..1.4..%.9..C.XlN(.....s....v..Q.i=.........B.<.N,...0s.7:H..S.].\..T......?..;......s...."9...^O...1#.....BJs.......6 p..7H.h.I.5...2..?>~.\..hd._.z..\|..Z.D..@...h..W2.Q.\......V.Q...b..Y+/F..K..P..J.....G..<07.l...A^......K.\|..7N.. BWH...~.PM....p....;.l...d./S~).Qnum..r._A.5.0..H..8c.........U.(..&.V4...QS@..Ui`.......W4.]X.Z..L.....j.7;.\|o.Z-I.t...._~... .=.1t.k.:..`c.d....5dM....A.0..}{29}.........x2....F?b(.Q..gPQ...97n...._..#......W........9C..gKx.....9.q..?.G?9..{o..bw..7.......'(MM.<R;r.....9<....wt....D;...r..L.6...H....:!j..g...t.p..QU.A.....Ht.p./......S...i(2i..0l...Y..D...@....=.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\motherboard[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1286
Entropy (8bit):	7.774039023750853
Encrypted:	false
SSDEEP:	24:LLXrJ8DTdqPB0iXo4ApvL9Oan+Gkn72PQjUtnRHNpB1MJLdJOHCidTsR:LHJ8vddiXivLEFMPQIBRxe7J0sR
MD5:	8B0DF2F8C82A0E94378DE269173A6245
SHA1:	445CB77AB76C36E36687D512882A9547E169FAE2
SHA-256:	7624E79929506F747AAB48020B944198DE22D008CB3F94195B8FEC3C88044BD2
SHA-512:	24066AF31B910A99FE18BEE33AF2632B65AADBCACEBFA8BEE4E60427A985EE3D338F3CAA8FB63EE3C8BAD9D621957458E130F55256A3C0751B0881F895D83077
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/resume/motherboard.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..V]L[e.~........e...c....dH....b..c.,.......%.h\4..g...-t.#..O.*.eA.8(......=..=.._.@7...79..s...y......TU..4=....8$pH...PZ'.....z..........A.1..I.R..f0..]_RR.C...@WW..:`-((8^VV.YXX.n2....b...A......L...u..^.]4..ZZZz........M..rLQ....DQ...\_TTT_UU.....{8..y._TfF.$6s/..C`?.....&...@....z.H...>!A.....EA]]...#....2....g.D...x..3.z.T]]..h....f(...'.F.eY ....}..v........YS555....:..=//..P..@u:]:.d>z.n1\.\|.......<tv...i4g&.6........k....D@...y..j......444....lo.LL......eL.._..k.=..f...{B......g ..x..x<..P(. .p.L/47.@.)......c8&.....(.c...r..M....g....<...6-.v...F...\|...6[..W<..^..Nv..:.....H../..)y....{Mf..t.2P.Y.i:.b2..&..z.aaqxvv...r...b2....&...<X.......h\|...._....!.6.....=..{w.->.........q.UH!%E6..n.W.P.$.$..g>....:..6.x...M.2...%`y......<[...\|.F.c+...{DA...[..]....<.yDU.AQT..UD'PL.....$..h.rs.z..h.%)..z...\| .....KX.Nb.<.(.yh....._......G.$.b.X..c.$!..;.@.F2...Q.,....W...#.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\option_moteur[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	downloaded
Size (bytes):	1022
Entropy (8bit):	6.064376998696999
Encrypted:	false
SSDEEP:	12:pKSinliOl9outoBvk+/O7bUCjSfLZYRHHpwCif+iX3:UGSpe/yGz8HQGiX3
MD5:	C4A9703806307A8F55D5D0DEB047EFCA
SHA1:	5C8A91273A6A2B36E215E2761DDFBE9A7970BCBD
SHA-256:	F76A5BA234C7A9DF93A5566B3ED9E9562934D589F610079418525C1728775633
SHA-512:	D7CB660411B5EA23A68B1D7C0446A1D70804658397705E6BFD87125ECB1F5D87BB19EEE31D56BD3D4DEF9BC7982928E1D92C3B93C05CC48EE70E0FA50E70F779
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/option_moteur.gif
Preview:	GIF89a...........%,....................KII........^`.49.#+.39........./5...<>.......\|~.+0MMM....8;.PT..........ty.6;..........FJK..B....._%'T)*.EJ.^a......6...RW....48..........................ccc.....d...JP=.........?D...>...}........W[..$..be.....-..QQQ...x\|.y}......?::.....&....3..___.......VZ.............JM......FL.RRRC.........")...2...BC....hk.......JM/...MR.....===......[').@F...222....BG=......N.....PPP...<B...AAA...+1.....9>...svE$%...<<<.....................................................................................................................................................................................................................................................................................................!.......,............!.a.(.%@.@)\.P@........b&0..)S.....Y.hM..V..pcH...yD.....464Eq..JG.v..!Df....@M84...>..t8.GI.9A@..4HR..j.. .(....I.Q.....#"9(..#O.6.x1.....(<i...#.Z8...'...u.\.(......0i....;{...#'...2. . ...\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\processor[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1132
Entropy (8bit):	7.78418742492434
Encrypted:	false
SSDEEP:	24:LgcGvPgI+5dyO6dKS/LOPcl1yIhYvEvIFeAEkMrNgvjscomC5H:LgfPgI+5ZzYLCpvDVMiLHOZ
MD5:	BFD62B86E92836CB415C208E20041EA4
SHA1:	8F77DE6D4CFEE18FEE144F11CAC3CCA29FD3FC8A
SHA-256:	4CF76316082969F2EF3200B2E6B7EEF27A9E715E208CBC23DC5BC7987AD2B1E9
SHA-512:	BD1E935FD56C43D829796545829FF6FA0898475778FE663CFABCF30782951C452A6157D3212BDF15A8D738FAC3AE481FEDA5A9DC7B0ED0DF22345D7FB797156B
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/resume/processor.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[O.G...=...0..v1-%.`.8i." .V.J...U{.....w.D..J..R.P...%.B&F....166.k.=t....G.zF...9<...}3.,..B.K.....h.\8.}..........E.. @..}..}..4....)).14H.:w.......M........\|...jvY?.\..=6.-C3.....K....O..8o...~......t........c.C.S#C7.=.n......kY._.Nx...w....\|.....8.^...\|...^.?{.o....:z..n..........fE2.R.B.D..G(..dE.......\|..]....,.........}.>_..#.z0.G.}.S.}.....w'...5.lN.U.<...f,.R.e..$.3.}a...o?....f.........N)`...]N.g...{.....aiv....G.{0[.iZ5.$I.C.$.>....v...1.wAT+.{.1oN.x..u....P...)..._.c-.v.4~\|.+Lf.>.9...%.B3...bA.....T..`.I.EEQD..C".G:.F./"/..d.y.........v.(.aX.E.y....-..[..t4 ht....u=...F...d..0...:XZ.....aWvM!.L"..X)..e.....e...X!......T..R..Vv5V>....&?.._f~..i.....v..;..P.f.@[...6G4.E1......).).-....v:.L.&..>...N.9...%..k.....f..y.]....=@....g.x&;.4gO.\|..Ti...g...J..X..V.U.....eN....9../..............'C.g...N..Z....X.N...Sr...,.r.vw!..H...._\>._.....V.o..._...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\resume[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3089
Entropy (8bit):	7.91147236565472
Encrypted:	false
SSDEEP:	48:hA/JGMA5AYHNw0FZRIV56tlcx6qdE0pbH2boCXbDD7xCXFK9koyZcr0kNoGUx:hA/J25AYweMpPxlEnYXeyZPkNAx
MD5:	113C088A7AF096B0780EA8C7EFE9A05C
SHA1:	5DB34253736A4DA8A4B399F412391C9076E2A443
SHA-256:	41D08DA568B2A2E8703144828DCFADB56D8AB31B221FA8439D26FB8ACB30F80A
SHA-512:	0DCDB93D9DFE821239749412DE2C346519D69EDF9B3E8C1683AB736212B7F8732004A955614511DB420EAD95F0E0CB33E2D9615A5AE3E23857F99D837162E382
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/resume.png
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..YkL[..?.....6.........B.4.J..j.Nk.t...K2......n_..U.}i...&u..tY..P.......&,O........{...^....K6U..\s...w..w....q.M.h..oO.<....@...0....;033..B..B......H$PPX..k...fs....x.......h.d2..D".(..L...7...F..OE.h0........k.T.v..u...7UW....2.h.r ......47}V__.Y......zOO......PZZ....q.#...;vn..B.....{.z}..r...0..E..D,..\N....@0.64.}~...sii.}\.K.R.}.6.......o...q..1...;^.....z.^o.e9..^.&..9R...?..l...[...sL.q.X.....y....]?u.'...]..$..h.eY....}.7o9.g..333s..~4......e....SpoD..W?.....u....`.5......4.S.....OT.r.\b..?.,...v..\..h.Z..`)...y\..Q........A..m.u.2(..@......7XA....ccaG.u...... .wzfy...n...mY.i..s~>...!....0R.F.(P\.DA..1..b;@...~.z=...].(;>..T.<.......z..Z./.s..\~\`...Y..`......9....Q..x.....x0.......,.0K..@.b0(.(....vPZ..B..B0.{.H..Tl..O.xp....;.70.oij<......`$.d..!.l..Eb.h.3..X.........o~.r..05=...x.td..ad.q.&.hP"............LS.-S~........A0....Z/...8..P......l.V........P..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\style[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	24423
Entropy (8bit):	5.069870974752049
Encrypted:	false
SSDEEP:	192:d2wjAMhAUn2J52n4sEcjzg7aD8JL8fWAzy4AXqCFxdlY88E+7ubSL38pR9fOpG5Y:iezPG/4Zx
MD5:	45A9ADE38A96D6750D6B38B769DFEB06
SHA1:	AF7D1E493DEFD724FFE8F79DBA72BA3EC750897E
SHA-256:	104B3BB884AE25296EDE724AF5AEDF559BF5E51C8F38F5E9090F1B97E0484EC3
SHA-512:	650C5C4A9833FC23A8DF24BC23031DA8E8269920914976E492027ABEEFE44B66E8D54225E724AA6ADFA3650EAE416A1201E3446B739A98B60E7F68BD62DCD050
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/style.css
Preview:	body.site..{...margin:5px;...background:#F0F0F0;...font-family:"segoe ui","trebuchet ms",tahoma,verdana;...font-size:13px;...color:#000000;...text-align:center;..}..div.div_principal..{...width:988px;...height:100%;...margin:auto;...padding:0px;...border:1px solid #000000;...background:#004483;..}..div.menu..{...width:100%;...height:25px;...margin:0px;...padding:0px;...border:0px;...font-size:12px;...font-weight:bold;...text-transform:uppercase;...clear:both;..}..div.recherche..{...width:510px;...height:25px;...margin:0px;...padding:0px;...padding-left:10px;...border:0px;...font-size:12px;...font-weight:bold;...color:#FFFFFF;...text-align:left;...float:left;..}..div.options..{...width:auto;...height:25px;...margin:0px;...padding:0px;...padding-right:10px;...border:0px;...font-size:12px;...font-weight:bold;...color:#FFFFFF;...text-align:right;...float:right;..}..div.accueil_alphabetique..{...border:0px;...text-align:center;...line-height:20px;..}..table.tableau_haut..{...width:100%;...h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\touslesdrivers[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	17150
Entropy (8bit):	5.39774626082103
Encrypted:	false
SSDEEP:	384:4GYyLZTviuBFtpRSy+QytqNqTpRSHNkrK6z13mAZJSF1KIZKlpj4Up:kyLZTviOFnR1+ftqQNR8M7mJK7Lj4C
MD5:	88DA5EF5222E92651FAF2358BFCBA19E
SHA1:	8503805D80717E81F2E42CC6DC02E51209C5D350
SHA-256:	45165DE545F39D4DB70F0EEEB93F4AE7DAFEEBB91252B839513929BC4089F544
SHA-512:	65F8A7F707CF601C2103A7903115446C09896523B75B781BF6628F906DD8C1FDB62EB239E4066CBB4112CDA12D5FBC04229ABDE89C0A2784B7E22608AD509868
Malicious:	false
IE Cache URL:	https://tags.smilewanted.com/formats/corner-video/touslesdrivers.com
Preview:	../* TAGS 2 - 2021-07-07 16:02:43 /....function create_pixel_ad_sw(){.. var smile_img = document.createElement('img');.... smile_img.height = 1;.. smile_img.width = 1;.. smile_img.style = 'border-style:none';.. smile_img.alt = '';.... return smile_img;..}....function getRandomInt(min, max){.. return Math.floor(Math.random() (max - min + 1)) + min;..}......function insert_script_js(script_src){.. var insert_script_js = document.createElement('script');.. insert_script_js.type = 'text/javascript';.. insert_script_js.async = true;.. insert_script_js.src = script_src;.. top.document.getElementsByTagName('head')[0].appendChild(insert_script_js);..}......function insert_stylesheet_css(css_src){.. var insert_stylesheet_css = document.createElement('link');.. insert_stylesheet_css.rel = 'stylesheet';.. insert_stylesheet_css.type = 'text/css';.. insert_stylesheet_css.href = css_src;.. top.document.getElementsByTagName('head')[0].appendC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\windows-10[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	795
Entropy (8bit):	7.635887404652688
Encrypted:	false
SSDEEP:	24:sj+XPY9NUyr8wmHDw1GcJlsYi2j2cFCD48:swkH0HDwZ5Ck8
MD5:	70E6CA2183E6990D2D07C64C812B8610
SHA1:	620BC3ECC5D4DC8A31674974DDC894BBB9A7C03C
SHA-256:	5C5ECDF1D507D2FCCA0880DE4548BF435FDBA0895381FB983D2A3269AD44D4C2
SHA-512:	81861D2DBF3832F7C67E15DA7D713FE8D444803C8F422599C7340A2F5FDFA8038574EB763C0A121943DAD05BF59D7E8164783543BF30F3CD89060BF16EE6EC7A
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/systemes/windows-10.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..W?o.P....(...).i....G>..R'.G@,H\|.&....0 .:.!.Z..1t..H.U-...mH.&...g?'i.qb(.x..\|O.w.{........(.......7_.H?,Vr..OC>.:O$..G.Fl....T.+..-.SW.,...Y....&..)P.W..4t.!KhmM...t.s..u..\|#.......3_?@:...b..D..g...i)..R...w.1...u.GA'@c.......I16!.@.P..?.2.5...m3.q.m3.?X...&.<.9.JAa.t(..P.l...x ......A.8H...D..=@..!.Gb.u.d..F..i?..E..u ..1L.....@1wE l.p......0 ....$.Ib.Y...v.~.. .r..K.~.^.D.m.G.&.%.J.e....lu..q.........t....z...}Q.t..n\S....,.I..../..h.Gp..p.Xn....XxNsb?.@...#i...w.....k..}.`m.....".....T.g0.+9.+9.]....y5...G....i....N..\|.\..a...)!.$]..w.....jN..M.....=.:.fik...os.A.....x>...P..w63]..zC....p..6:.{.4j9.}<...n:&i.D.[(}oN`]..s.v..F.@..Rwh....f.....ky..S.k..I...-.....J.f....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\aide[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	downloaded
Size (bytes):	1070
Entropy (8bit):	5.7516212260153265
Encrypted:	false
SSDEEP:	12:W4z/2hyWMt8VVv8bCX2pzlFUqsh4+wab04H25u97QCGl8Knq+O/A9ELdjF5RBphw:7zLATtMaYdMQCa8Kq+8iGpzw
MD5:	F0D40551F94B4B5C709B00858474EE18
SHA1:	8ED6447D78E62966031DD75B0E7E2FBE65B7C2DE
SHA-256:	DB979530CD662BE3DF8742FA1E68E30B5797F84A32F07DED951C43347D4391A2
SHA-512:	9A413C2B862D12DC3F55354B793483781A597A656E40A37BDDBD7E7BF701F20CE2ABA05C79089D4CC6E8B291B3179F6661D343A12102D485215A6787F13A7890
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/aide.gif
Preview:	GIF89a.....................................)_.'X.+`.(Z.-b.+].[..b.0d.-^.1e.0c.2e.2f.4g.3f.2c.2c.1b.5h.4f.4g.2b.6h.6i.6h.6h.8k.3a.;m.8f.Cm.Is.]..c..g..q..........bgq.......................................................................QSV...........................................................................................................................................................................pppWWW..................................................................................................................................................................................................................................................................................................................................................................!.......,.............)3E...8n.9..@.e...(%...B..@...PBBy....3...P.RO.0`^......2?X...(../qP.P..P.%OZ.x....<..!....1P...5.."..*J.G...#..1....[..)0......(Z.!...a........^......k...A.....\..a..0C...c......(...A.+4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\coin_bas_gauche[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 20 x 20
Category:	downloaded
Size (bytes):	758
Entropy (8bit):	7.5004875313232535
Encrypted:	false
SSDEEP:	12:E8VfIPuPvm5alTEUNU4GskL5TkM7p348/WgY8DfZiopTmX9BUnXeN4:E8Wu+algwULskxpp3ZFYSi4TmHqeW
MD5:	F15847DF515D7F4B6C95C1301919D0F5
SHA1:	31B9F56EA0598C86C514E7DC32A2B314274E3566
SHA-256:	AF65CB93C4094FA0B363881CD59B48887C6CD5361A1F10BD0924F5D215F0FFA4
SHA-512:	2E872EFB5D7DEA272B12E79F5C573856D6DD72777AA156B3416BEF302863DD90F7D7744C1F9AF905DC3A142C9AD1333E65C3C8971CC438966722104AC5E30B6A
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/coin_bas_gauche.gif
Preview:	GIF89a........J..R.;o..V..H.V...F....c......r.......Bt.b.....8m."]..K.......f........"].L\|.N}....Ew.d.._...E..X..M.(b..E..G./f..N..................1h.....P.h...T.P...S.6k....4j.......x.........I.'`....)b.R..v..k...........Z....Ew....S........=q..L..O.c.......\|..j...G..U.......X..&`....Hx.......\...Y.3i.....Z.u..M\|..L.....K.....E....Gx....+c.....L........D..................................!.......,............tg..NA1..L+Y..<s..t.W#.3.T..E.8_R...2[...:c..j)J..st...7]`.(?D\F...t%PG&..U;H.^9M-..$O.@...B/X6S.r-..R<tt=.b.ZC...,n.M.J_...'!..0.a...lXL.a$...t...@#...K<...@../\.@......\|.HR.B.4..4 ..u.j... B....Px...LJ..@.M.$K>...........1.)....hyPe........k...S.t.P....1.......Q..p.E. Z.%.F..@L. .Ib.....0...-#.\....(.d\.0..D:$J..0.L..t...;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\f[1].txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	145
Entropy (8bit):	4.498125758800745
Encrypted:	false
SSDEEP:	3:xRqzdK6JAJuLRLOdK6J9QpH6yWHaEHWcHZaE+kpHsWU+J60EHQJq:xReLJRLSLJxyW9HZlsWU+4QJq
MD5:	1A92A1FD251BD6AA2A01FA62F1341B16
SHA1:	E8C29B7B0C5DF6D3730D94F567F5985C7C9FC539
SHA-256:	676D52535C21965D7FE22AF9731986407A002C596AC0E8A1011CB0525D79FA63
SHA-512:	BD4F30640E35596DABDFAA26D0E0C1A9EAACE9378DFFFFD98A12890D23BF3A8468A8D43FFBA744400F93F0C7C1124561CFA8F263C45D3A20247CA4A562F1A05D
Malicious:	false
IE Cache URL:	https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.touslesdrivers.com
Preview:	[["touslesdrivers.com",null,"www.touslesdrivers.com",[[null,"1015413",1,0],[null,"1023879",2,1],[null,"158819131",5,0],[null,"6917646",5,2]]],[]]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\graphics[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1553
Entropy (8bit):	7.830135956630017
Encrypted:	false
SSDEEP:	48:PIoZkEDW87Kb1ShdyPZ98wHrHUWj8gr//7ExMT:PIoZkESpREyPZ9PHrHUa8+G+
MD5:	FC611C23DFA2DCB45B81E655FFA7917E
SHA1:	4A089C97EB976F8F1B6E63FE258C41AE2C30A04C
SHA-256:	3CE5A65EB73B13A87CD4074C4A57519663D8DCEED164B07842442980E5871B0A
SHA-512:	9C845A8166A9F8F0947778CA54D0A25AA6501074CEF0F2B06E4B4C114ABF01BE5981E94B0B3B22635EF74F28399636D66EB1D4495228CD263048A0A53C1A45AF
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/resume/graphics.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..WK..E.=...{.g...@...4#.0b$..+.$.\d...U."..+!....C....].H$.... J$Y..D&L.....{..U.~3.7...i..w....{.j4)%...._..0.$Ip......}s422R>u......9.(...r..m(...m5....>\|x.......977..k.F.oc..B..F..o..J%.R..y...V...@.%...Hy@.].1....i...........q".Q....=..2.u.;/.T#Hx...r\".3.}#.\.......$d&3F_.~.....X.......AQ.6.Rr..iD.1M..8pL...M...&.A<.m.CLY.........J.;P.c9W{.....5)....Vh..l.-.p.Z.!.'&...D.~..j.....0.....w....w$"..r.X.:...!."....<....Ty."'.....#.;.. X.bz. ..)......2...X...78..T.:.z..N..6........[....&.m...>a..s).f.Cp.H....>$...f.......G.`...T&gb...@?.Q...>.C.i\P...p...'.R....h.i..k.B"Y3...[.gG..\|T..J...'.".mZ`.Ch.D2E..pC...M'"gZo......oP.9...2..)...0.e.H%.H.t...L..6.]..#...K..Up9C.J..\...P.e...@1......0.c..c.........t2.p. ...ew.B-.`@..f`l`.... r..:.H(.h...*U.W....q.y_.c.!..D.px../0.\..N.t..[.}>WD.3.V.@..`..qj...N.D.8................q`v.W~......u...]!....f4CF.iF&....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\index[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.2516964360365215
Encrypted:	false
SSDEEP:	3:8ROFKGQIeRvvXbvx9M849RvZ8ouRYQxdzfmEZDqDISLxOdK3MKbHY6Vrxh4z4uhv:AYSIaXLxu9RRtuHzHgLxSbKbHY6TM4n4
MD5:	07EED7B5172684A3129E0ECD0B2FCCC4
SHA1:	3C5079950C57E9EF28A7D771EC6B6CE7125A6E0C
SHA-256:	CEAFB5D7DA9C6B37B506ECB23CF3C212A31F5D9EC3BD1D25C21BA24535206785
SHA-512:	DC622B7AB54FD0350DA295DD367BC24054FC5F61A9CCF483EB5841C4CE87EC0DCCEC82FEA2822247A89400A7AA40E548F35103072704B758172E96AE5958D724
Malicious:	false
Preview:	<head><title>Document d.plac.</title></head>.<body><h1>Objet d.plac.</h1>Ce document peut .tre consult. <a HREF="https://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM">ici</a></body>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\logo_fond_bleu[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 230x90, frames 3
Category:	downloaded
Size (bytes):	9555
Entropy (8bit):	7.940269913655646
Encrypted:	false
SSDEEP:	192:ZrZ47bKsgDpBHt/PNm8cfj+8Z5CK1JZcizICSSWVAp8eY6KMJUwjRTUAnQ4J0P/:DlpB94/nCMJZ9zrZp5JU43nQTX
MD5:	23E22ABF0229B627DA00445714AF9AC3
SHA1:	AE9DEA0D5132D9819362D7A21DF8FCA270D4BBAA
SHA-256:	B1428BA0BB29A2709DE20C8AE63E4366F6E77B2B9E9CF72AF8619758F06BD3CA
SHA-512:	5DEC3E39244E4B883212D497B6FF27893BD298C3BEF0F3D51207EDAD0E65A9157276EF526CDC35E65DE777B785CE729AFECA3982F14488D78715110808813282
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/logo_fond_bleu.jpg
Preview:	......JFIF.....d.d......Ducky.......F......Adobe.d.................................................................................................................................................Z..............................................................................................!1A.Qa.."2...BRq#..r....$...b..V...4U.......................!.1AQ....aq"R......2#..B..3...............?....l2.t..d:[t2.-.......Kn.C..C!....m..t..d:[t2.d6O`t2.m..O.C!........y.~....u..t...X.'...u.%....2.`.Gq....t2.gn.C...{$..2.g.s..v.C..9...C!..+..}....PGq....t2.-.......]..FQ.[t2.-.......Kn.C..C!.9..VF..q.(d...u..(......J.\~).Al.v.......t..R...`...t.'JH...Xi&...}cZY4....../.n..M1.m...~.u..HSqR..h.VB..=4.:...\.F<A&.oj.&..e.s..2]p x.d:...$OB]..2.@.:.....A..%.t..RYX.....aK..I.eJd...].).(._.<Bu.........m....g.\|.].....2x...d..o'.).......o...!..X<x{.G.\|'.,.......)...Bn....e._.JK(AUM;i.J./.5.F..R..\|.R.}.'.o./...U.G. \|......QM.nB..%'..w.Mb....P..(H.k..].S]J.+S.)B..<s.BQ..c.Z.V..Cf..#I.GP...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\network[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1106
Entropy (8bit):	7.764479488532236
Encrypted:	false
SSDEEP:	24:ZO9hdOufulObiyILHNdMUqGCwvU7r2DgCKNtKaNtGcKoxJ813L5Nu97:ZOHddfGOerLEUK7rYCrNt5+1b5Nc
MD5:	627C716857CB369DB460456CEF212FC6
SHA1:	D633581A401417F737AFE99CA377F12238946705
SHA-256:	DAFA2DE794AA0DB620D3C4EC5E0F2F4BAC6584A8ADA34F0A79BB1D970AA0FEE8
SHA-512:	900E572A441CFF96ECB3FB47A876A3C328CC4F1E0FBCFE429DBA0C6A590CE5BFF5E31C4539D3E8EC4D453B3123810CBA5EEAAEAB3C84016207F77968B576182D
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/resume/network.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...o.U.....v&v=.xI..%......"..bR.U."..@......'@B.._.......@H....:DQ....7..8i.'6^fl....V..Q{...F?.y.7.....}:UU.I..O8..u.:@..x.........y.q...C.}.@..2....N..q8....iM$...\|>0.........as__....F\|ii).....:...........+.+g...Gh..F..Y,.O......{....r....q....R..W..G."...?d.s.hv.xmg!5...%..S.....j}..+t...).:#...2.m............H.lM....I4.N...AH]m]..w......T..Y..f..........o..9.u.......l.x#F.2.l..2$.$........Y.k.....l.CK.V-....vuu..\.=&a.9e......7.F.p.li...P..b..!......(.P..P).\.C.../.)LH......(X..Z..,............}...._..mS.I.A.@.....0...$Q.Y.ak..6ogA..h.R...>...k..O..$..L&....6.R....aww..'..z.......0....F..@.z.....H..~..$...p. ......."._...{.S...x.Z[[k..J.....%.b..>.l...4.z..`.).e%d........=dn..;/..L..........\...f~^\\.U....(..zagg....N...G...cL....ld4.$..%y..m/.D...O1.=.$.L........\|.y....y..'Ei....n.s-....~...k.5.x.1\..L..7...Q...9..8.m8yhh....%.8....D.?...`..../E].z..\|.w..?40..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\option_imprimer[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	downloaded
Size (bytes):	344
Entropy (8bit):	5.625170380731303
Encrypted:	false
SSDEEP:	6:NO/bp45z4tLXbV3udgXt5tWunZfhT9qw1JfR32Fo1d2:AF4l4t/V3agdzWu/12W1Y
MD5:	52AB34BB7CDBCD7A1A48C8475E64F643
SHA1:	A0A9035A41765EC1D5C86D0EDEF4564C3182C16C
SHA-256:	CF5CD181B19B9E3FFEAE358C8C3E41CAAEEAFF03CF3C682123D0955ADB56C20D
SHA-512:	1F239E01099AC2B3B09F5AAED19ED9CF89EC40CE62F40279FE2143A257A6A3C71FE0251B5684BE1239272507F5F5AF0DFEA6EFA1173C4847DEEC53FBB5903605
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/option_imprimer.gif
Preview:	GIF89a................$$5@AFy........................M..Pn..Z.CXdu..,l....C[SP.q...$`9..............{{{xxxhhhTTT..........................................................................................!.....".,..........u@.P.)...$..ln..M`J}B..j...x.`..p..h2w....p6.`...x.....?..}}.\.......\...........................I......W".YS......IA.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\option_rechercher[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	downloaded
Size (bytes):	567
Entropy (8bit):	6.654219453782099
Encrypted:	false
SSDEEP:	12:x9NetOXBQhvswzdCWRBaxlN2zauIxamx4XpVgHNy00KC:x/45s2dCWRBaKauaBWXCNe9
MD5:	B23F2CC1CAD76B4F1C57621E0AFD7775
SHA1:	FB1C3E2193A551570B39114F7F9010CEAF08EBDD
SHA-256:	B3C26803A31FACEA8F871CE1484CC662B903630F306098DC44ADEBE9753883F0
SHA-512:	461AAC1928CE34E331D84A33D63B4DC51B85D8FEE01C5576800B7CD387B18399FA99EE29363F965DA5F99F1D0D906269A8986767D59801F14714049EFBBC3CD0
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/option_rechercher.gif
Preview:	GIF89a.................................................................................................................................................................................................................................................K..N..N..O........z.......<.<.=.@.A.......sp.ro.sp....sr.........................................................!.....m.,............m..........m..:?=*......,& 07...Q.!)24>/..-8%.BFGDC..6($@HNPMI..#1'BLSURJ...51A...3....<EKOT...[`f..+;9".._Vdg..ZYbi...\Waj..m^X.!.M.2l..l.f..6...;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\options[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1976
Entropy (8bit):	7.872877123173845
Encrypted:	false
SSDEEP:	48:YMp92RgpMuBbUOhZo17PEFgSrmMa+jIy9I:YMWcMPso1YZI
MD5:	940ED732BF865EDA62DC30F097D1430A
SHA1:	45AFFAD2A061DCB21911563668A9FDE44F4C13CD
SHA-256:	FB3D8F2500CDAC839A8A1CD8483A11FFADC20D71CBBBA4ABFC3387DDD0F02867
SHA-512:	270AF31EB67B6B19E8E20C9815D57535AC727EA2DEA72C1CB59B7D19845289DBA99CFFBB381313768D9D4AD545C4EBEEB09AAA307DDE18F57033BFB723E971A1
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/options.png
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx..Zyl.U.....mA.E...k..r..T..`.(6@....A$^..........E....G AA.pZB.B..r....p.......-...;..ZCd.......s..Y\..)........p1.D............~...l../..9.......t..va.... .l..!..=..{MI..4...q.\|.=FH..mo.i..x.+.A(v\|....J/1.gAv...Q~...rDa..X`Q.!.dI..2.h.w....5.(.6h:.;`OE.u.a.+.1&.&..r.."....LZ.0....s]...2h.V.X.G....@I%.RS.J..;.....T.Y)..tVEb.!)ru...}0>I...8J...'..O.V.....N.$......3....0'p..m=.3Y....o5....n..3....$x...[...,..S......Q..<.c%....R.\|.m.nu..u\...%.%sB....W...#-.B".~.B.\jAOS.+.....o..`..5...B.. .@AH...4.R2...b.*%x..x/.K:..[<......~..{.DT+....."........L...hF.Xz..3..+...'.iX...>.sW..3...\.{.g;....k..#...4..N...t.f.C!...5..8.....a/oN..J\|....E$......z/JAd%.L...@4.>.U.H.I..v.Q...@....bH.K.&.....k..gv..=....&D..x.DK.s..II..}.!..............:.@+..A..WU..\.....'y.........U...qvX.....2...X....(.1j.E-.B1.w.V..g....M..?..p<.^.tJ ....Am.H^9.a.-5L.c...]...3..B..}(....d.<.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\pubads_impl_2021062901[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	336329
Entropy (8bit):	5.4979853949800335
Encrypted:	false
SSDEEP:	3072:17F0x4/w25h0NHg+10awM1IfruQLmLCAJSwg39P7G+LwgarXt:4xxr9uLaxJy39Pr8gaDt
MD5:	F2DC4879B80EF68790C42C3F0958FC95
SHA1:	A0981897EAB0F18D0F658F29B7BEC2DDC4C462D6
SHA-256:	B3AF206751CC535EA2F272EE9C3B5A3D2CE8957A719C103720234C2A02472C26
SHA-512:	5FDC94896C61891BCF778B9E87173C58DB2CF07052E5F119E2673BFBB2A65CBCD33B688693181256548DD8238E89882B7030A1F382296064B59C3482BED4E98F
Malicious:	false
IE Cache URL:	https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062901.js
Preview:	(function(_){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa,ca,ba,ea,fa,ha,ka,ma,pa,ua,la,sa,va,wa,xa,ya,za,Ba,Ea,Ga,Ia,Fa,La,Ma,Oa,Qa,Ra,Ta,Va,Xa,Ya,$a,bb,cb,fb,gb,ib,kb,qb,rb,tb,ub,vb,Fb,Gb,Hb,Kb,Lb,Mb,Nb,Pb,Ob,Sb,Ub,Tb,hc,w,mc,jc,qc,rc,sc,uc,wc,yc,zc,Oc,Rc,ad,hd,kd,md,rd,td,wd,Ad,Dd,Ed,Fd,Gd,Kd,Md,Od,Ud,Wd,ce,he,ie,le,ne,pe,qe,se,te,ve,we,xe,ze,Ae,Be,Ee,Fe,He,Je,Le,Ne,Ke,Te,Xe,bf,gf,We,zf,Af,Ef,Ff,Hf,Kf,Lf,Mf,Nf,Of,Pf,Rf,Wf,Yf,$f,ag,bg,dg,fg,eg,kg,lg,og,qg,rg,wg,zg,Bg,Dg,Ig,Jg,Kg,Mg,Ng,Og,Pg,Vg,$g,ch,fh,ih,kh,oh,sh,uh,xh,Bh,Ch,Mh,J,Nh,Oh,Ph,Qh,Rh,D,Sh,Th,Uh,Vh,Tf,Wh,Xh,Yh,bi,ci,di,si,ti,ra,ja,ui,vi,wi,xi,Df;ca=function(a,b){b=ba(a,b);return 0>b?null:"string"===typeof a?a.charAt(b):a[b]};ba=function(a,b){for(var c=a.length,d="string"===typeof a?a.split(""):a,e=0;e<c;e++)if(e in d&&b.call(void 0,d[e],e,a))return e;return-1};ea=function(a,b){b=_.da(a,b);var c;(c=0<=b)&&Array.prototype.splice.call(a,b,1);return c};fa=function(a){var b=a.length

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\storage[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1461
Entropy (8bit):	7.806113204330809
Encrypted:	false
SSDEEP:	24:93qOSZVICK6qPaOvUpQ/7hwvSONPbFswjgodQWJFn/lVyfLP1HWkqub:4OeHKJBDjyvSOdmwBQEN/ls5HWkqub
MD5:	C6D43B97B02A1FC945C88F3CBB645609
SHA1:	4E253786BCF27FADDA2A999FE372519968F1A822
SHA-256:	D3768B9D6DF3F6BBB7E8440FC22E249D2048885E44A5CA8187B850C1A4CD3022
SHA-512:	3B0B8E154B44DBE2B313D4F2940E8707A3104BA0C83BC6FAE9BA5217DA26EB9C3DE332AA55205F132E68655E8AD782218D8640051ED6F0EBDC3C6A9061B90B0D
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/resume/storage.png
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...WIDATx..V[O[G..c...&./..P.$..MB.m...%.N...=........&...~A+....T.MP... .......ccl..9.Y...H /ya...>g..v...$I./9.S...N... ..T.....$d.&......D^PXP.r...H.T.(.J.8.>.r9(....`0.....J.......l.l...o\|.Rk....}h........g".` G.)..k...X.j.3..d.......S.pDL.D.W)...v.1.~olz.....w..S[[[}.?.D..V.=.%"..y......3.).......vp....;...H..5i.'........S__.E......\|..Q.}2>.........i.L..(Bnn...dj...n].Z.kll4.UJ..K@<....D....p8.V.yV....S....%...(,,T.....kj.a.8.R..d..}..D.4..B?q.c"........=.......O....CYy9TWWCee%...@&.A...8?.4...<.B...(JY.....T..j.....U.h.PZZ.U..S.#..@.....e..V.....<H..)8rN.F/..9!..22.l8.....k@......qM~..E..$..........`.E.N.SVV.^.&:L0#$.fz.<..d..P(.uu..qQj.t.(...,u.(UQ..o......d..t:C....kk.r^...X..^Y9.#......^..8..b.(.l.i......@D`.6.....V.UX...h.X~...D.6...^O.......&t...... @ .`...\|.1.I.fv....\.(4.....H..h.m...G..6..,....j,E....0.:.\|.....455C..Yd...T.i.S.D1....Vk.......a..FcQ.K..&a..a...`.t.b....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\systeme[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2324
Entropy (8bit):	7.887056390234713
Encrypted:	false
SSDEEP:	48:IhPG7RZdhxRKlNy1aWm4wiY3EaTJeTQyeS2z1:Ih+/3xRKlYFztwzT4cyeSI1
MD5:	4B96278270EC17AB767A668989C4F906
SHA1:	C4651AEC1CEA11042CBB78E7765FE5778D39B6D7
SHA-256:	36875AB32B094B7E436945EEC069C29466E6FE2F61A0EEC4E897AFC099D3ABA1
SHA-512:	E233818550D30C354228729EB368EB159BF9DFA7F5994A3F91B7DAE8D21DA2863F93820DA44A3191F4CCCEF324B8F00CA1A2FDCB1906EC624D20DFFC92C4920D
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/classes/systeme.png
Preview:	.PNG........IHDR... ... .....szz.....IDATx..V{PT........KX.P.".(.C....1.5q...c;..j.6.M..IG.T'#M..........X......X.N#.......,.>...{QF;..t..3.f.....;..;........m..LK&{....G$..O.6..-.9.......K.......\|^YYY..b1.7.MR..K.g.^\.@..W,;...}l.J-.i..=..+?)...IK.....Y.C.B.B..`...u.#_.....>fnIII~q.%..by..t.n..X.d..../..>x....H.X....}..;....:-b.#0iR...2%...%yyy.93#2.e.''..GEF>e.1..U.$>.~..Y.s..l..s...S.N....G.HMN2...Jv{.......G..#.j@f..Z..`.n...H.2R.N.Ebb.&.1...Tei.s....~.....#....?R<-.Nfwu..?5. i...sF..h....5....(.....h.^_....\.@..B..@..................y...V.!Wh.%.... ....(.`~J...;2.8t.j..a...........x=..b..=6.._.y..G2p...../...f.\|.yX....`u.X ...b.{o...{.0.&\|..S...6.../v..QI.T.G..w.....,.J9/:.r...R..u.W..EYk..Q?....\|Z$$..s...y$n e.3$sF.C.?k..%.?......~..........d...sYttLJtt,.x.0..HX.....a...>B...z[E@.D@..N..M.0...$........K...;..1.......@...mU.]..j.yZJJvrJ...\|>.....?#j2.\|M......N7.....(....S.r].2&.i.C..T..L..L..k..@'.GQWW...8:..W~v~...+_T...<..v..S*

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\zrt_lookup[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	10178
Entropy (8bit):	5.4736397929046365
Encrypted:	false
SSDEEP:	192:28di1oblV3nWkQO86/Mf085PIoZ+ToHCDZ2pridM:2tyDWsEfF5gy+TpZ2pridM
MD5:	0A37869DAD80436884288D9FD263E34F
SHA1:	A70DEFB0E96A5D81A2559D82AB9896FDA7D6DD53
SHA-256:	20B3BAD1427E2212DD847357841F993F025B5061C4AF1D382DCC727E102CC1E4
SHA-512:	6754AB7373A0BEFAE160A606EEA85DD0B8D55104D47DDAF3CA047DB2490D7193C4511D8D89B0E669CEEB91DD06ECD9193765ADB93935D69084FA1DE6F801B03A
Malicious:	false
IE Cache URL:	https://googleads.g.doubleclick.net/pagead/html/r20210630/r20190131/zrt_lookup.html
Preview:	<!DOCTYPE html><html><head></head><body><script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this);.function da(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}}da("Array.prototype.find",function(a){return a?a:function(b,c){a:{var d=this;d instanceof String&&(d=String(d));for(var e=d.length,f=0;f<e;f++){var g=d[f];if(b.call(c,g,f,d)){b=g;break a}}b=void 0}return

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	49377
Entropy (8bit):	5.521008419138659
Encrypted:	false
SSDEEP:	768:/yR3fYFBCwsNDsP5XqY0TyPnHpl1TY3SoavyVv6PU+CgYUD0lgEw0stZK:/y9g1r5h0UHp/Y3SowCw0sy
MD5:	042B7183D8645F5CF9D0D6ACD5FF8358
SHA1:	447A98467EA31E253ECB63EE8564C8B5E1E77D58
SHA-256:	73D6A5EA11FB7BF6E6A6CCD44B1635D52C79B0A00623D0387C9DDDD4B7C68E89
SHA-512:	72AA2F221BB5EFEC3A9C0CBC2D01DEBD827361369F7E84AA613D4CA70838FF68EA2C3300167FB263A4F416A857BABF0354A1FF8B3EC669BF88452633981CA18F
Malicious:	false
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q={},r=function(){q.TAGGING=q.TAGGING\|\|[];q.TAGGING[1]=!0};var t=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},v=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var x=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var y=window,z=document,A=function(a,b){z.addEventListener?z.addEventListener(a,b,!1):z.attachEvent&&z.attachEvent("on"+a,b)};var B=/:[0-9]+$/,C=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},F=function(a,b){b&&(b=String(b).toLowerCase());if("p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\coin_haut_gauche[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 20 x 20
Category:	downloaded
Size (bytes):	758
Entropy (8bit):	7.448773312814686
Encrypted:	false
SSDEEP:	12:E8VfIPuPvm5alTEUNU4GskL5TkM7p3clnH+PEFPbrKw/oKO05MsKz4Ua7D5pw7uS:E8Wu+algwULskxpp3+H3FjrX5b5B7D38
MD5:	58D1EF5E4D9950918BADDD39CDD5F1A6
SHA1:	BA808305C1198333426F1144B4CC309308B5C9A5
SHA-256:	0D250FEB5FD1F1686D04CB8C78A6A1CC1F390605CCBB5B590371FBFE451949E1
SHA-512:	5B3880D6120B487D2B044D98595B97A1F5B99A22351696692B7680D102707C26BCF29CBD535D52BC22D30BF80B7513B4ADA02CDBD3D1D7B7321E41A2C74A7379
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/coin_haut_gauche.gif
Preview:	GIF89a........J..R.;o..V..H.V...F....c......r.......Bt.b.....8m."]..K.......f........"].L\|.N}....Ew.d.._...E..X..M.(b..E..G./f..N..................1h.....P.h...T.P...S.6k....4j.......x.........I.'`....)b.R..v..k...........Z....Ew....S........=q..L..O.c.......\|..j...G..U.......X..&`....Hx.......\...Y.3i.....Z.u..M\|..L.....K.....E....Gx....+c.....L........D..................................!.......,............t.......V.$%...g.t...=OP.2W..t..'..G.[#..i.."4!.@&7..N.qt .0..Qb..].3A..k..a>.....`..1. .d.5.fZ.U.:T....do.IK.CB;(c.....0a..m...(.@.CA.&.....F....a.....EV.Q..F....x(.'...^.......Q.....M.6,..0....A=.H..A......p....%_*.!.d......y.....rZ\. ....P..pP...$.S..h...9x...z....(~..b....x.L..%...:.(.&.....N.2B...T.4(....)......I....0Y..@......;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\ecrans[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2552
Entropy (8bit):	7.908104740806198
Encrypted:	false
SSDEEP:	48:0A7DrodpiwR/cigbzSll5NQt6M+VBjSnX4jzqkxTQ+S/0xY35/9ymc:dH4/cbzSFNQR+VhSnX4jzq0t1YB9tc
MD5:	18D833E44DF2DD742BE9188284C20546
SHA1:	644EE4FD678BDCA8B3F27A1C6E16D8A425F98C68
SHA-256:	06EB1DF7F5F99ACD74C86B0E47F41EF3DBA445E24883E64A33E667728DCA884E
SHA-512:	2CE913B73BA1439803E62BE8CA04974AC237F9003C58365C06A9C7F7C0CC070A6BB381EEAB3261DA908990214C88C1FB77C27FA4177B3E8D3101BBE429F15CEE
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/classes/ecrans.png
Preview:	.PNG........IHDR... ... .....szz.....IDATx...yl\......f.g..c;..K.....%,J[..".)..E......H..".4@..G(.5.MZR5.5..,..8&`...3.x......{.s..'.1...+....w.s......w.5.Pq.cF..K..!..zDQ.Z..:..c.f/j.>....K?h4..H..qQ....5...5k..Y}].]uu5..jk.......M&.Yv........^...x8&l...b.._.8\......I(..0.3..".M.."..r...;{..!.p..2Qd2Az.g.!. .'E{.. .}#cI.....,..z%....l.U...y..?..y.Q.....(.a...2O..i$%c...I$...$..'.IE.D&........_..9w_ I..=.8.w.k..2.0c(hG(.G..b.XV.......@..Qu.....r..ym!........z..r>.~.s.}..s.....{....kw..E.Y.....Z".J.. ...%..H....<N.>..B..b..y^.n..V..C.&@M."Dp..+.L&w~..'..g...c..l6...=.h>.`F...2+....@.b..?o.a.J.l.....@..B..{..{.IP).d...N..n...+..45.Z..S...b........M.`.y.>e..z+......i... ..t..../.X..#..K.=M..5..p..M?.Dc......]>.j...#...8.\. .[q..l.Q.G.UT............f..:.Ncpp.o..........W...-...B..2..W.c.....U.7..I..V.q...\|.....&=.mV....u..q....=.H$.........4}pe0..ko.Q..2.\|...T..cqV..W.8m.......$RY....sN.W...Xx.....S..b.......G..tv......X...c......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\f[1].txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	277784
Entropy (8bit):	5.512300070739565
Encrypted:	false
SSDEEP:	3072:DkHn6jxH8gd4ICcdF5VWjW0qydAvz3mahbGrxWQyPaJdOnXhKacDBHpto:b2gqICcdF52iqAvTmahbkV0cacDd8
MD5:	28EC0C791D6CEED5874946013989C66E
SHA1:	1DA65838CD547A33B3B5A3BABB8643FFA757B00D
SHA-256:	BEA65CFCABEC36415D41AD2D31CDCFECE92129DE0329D11AC0373AC623F07ED2
SHA-512:	BC6163516DF91553312388A096203A718A0764ADFC25E175A67F4D4C7BDF718FCF0A646A75D70899448DF2D2D79498E61B2773BDE8533F448E5CB10D5170FB21
Malicious:	false
IE Cache URL:	https://pagead2.googlesyndication.com/pagead/js/r20210630/r20190131/show_ads_impl_with_ama.js?client=ca-pub-9949628778928908&plah=www.touslesdrivers.com&amaexp=1&bust=exp%3D31061746
Preview:	(function(sttc){/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var t,aa;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a}; .function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=fa(this),ja="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),u={},ka={};function v(a,b){var c=ka[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]} .function x(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in u?f=u:f=ha;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=ja&&"es6"===c?f[d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\fleche[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 12 x 12
Category:	downloaded
Size (bytes):	123
Entropy (8bit):	5.543481781708185
Encrypted:	false
SSDEEP:	3:CkGlpGB1GQl+zaXaaa/lwljr6spSgtd5im6We:HyW1Eea5dIS69e
MD5:	93EE8B1F523DAE138C009317F5901E5B
SHA1:	805A8CBAD70517540ED6DE3E57771B3230F35854
SHA-256:	41B3BAB569F3397D8CA19738D8CE5F4A0BE337F09F12E18B06AE71A6594B172E
SHA-512:	37A75C2DD7CE42B444CA4E7ACCA537B674F07D4AE0A38086997BED8486130902584DC495636FD4D5AE92EEF9860C2D9613513AEDAE5152B3ACA483296DB03C4A
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/fleche.gif
Preview:	GIF89a.................d..k..n..x#..K.g..z.................!.......,..........(..I....u..\.m.1.g1... 0....!us.%._gH...;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\fond_cadre_bas[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 20
Category:	downloaded
Size (bytes):	96
Entropy (8bit):	5.495708073322321
Encrypted:	false
SSDEEP:	3:CBM0KVA2Hy8jGYF+YdmRa//liZCMJn:wCq23Gm+Yd4ZCMJ
MD5:	76FE5C98A87C786DD24C78CC83BE35C2
SHA1:	4A07827CBA888544B8A7F264B7991210044D7BE9
SHA-256:	0C69488DDAEC47BA919B9262CEC30872392161D1348CD927043CDC1665CC645B
SHA-512:	D4AD16750DF12671F54AC0131BCD5E8749958BB4F088B2F27473E9942E0F838FD2373B24EB8256BA2F513D5E31EE0177101B497BE099FE7420269FBEF6FDB8D0
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/fond_cadre_bas.gif
Preview:	GIF89a........L.{.....e..)b....;p.......P~..V........D....!.......,............I.DY..0.!..D.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\javascript[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	28609
Entropy (8bit):	5.356446510786698
Encrypted:	false
SSDEEP:	768:/Mqa7g7TkoETgshtGaf6wZKLzdLueRv0zZ7fxSlcRA5dQfSi7RHyum:/Mqa7g7Mg4Gaf6wZKLzdLueRv0zZ7fx6
MD5:	FBF6DB649596193E7FA1CEA3B4048F5D
SHA1:	81D4406B460EA4FEDBC14DD0582979D4A8134AD8
SHA-256:	5B98B036FF932A147228CEAED725CA868B9B6D8D502EA70575FCF98C87671B90
SHA-512:	5D00BD936BEE43EC82F41979D3F004B3F4B0F4EB23E9C5AFE54438292CDAD40693C9C42E8FAEA31EBBD97E44F23A468583F3FCD958168E443386A74D5049FA14
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/javascript.php
Preview:	..function navigateur()..{...var ua = navigator.userAgent;...var reg_ie12 = new RegExp('.msie 12.','i');...var reg_ie11 = new RegExp('.msie 11.','i');...var reg_ie10 = new RegExp('.msie 10.','i');...var reg_ie9 = new RegExp('.msie 9.','i');...var reg_ie8 = new RegExp('.msie 8.','i');...var reg_ie7 = new RegExp('.msie 7.','i');...var reg_ie6 = new RegExp('.msie 6.','i');...var reg_ie5 = new RegExp('.msie 5.','i');...var reg_ie4 = new RegExp('.msie 4.','i');...var reg_ff = new RegExp('.firefox.','i');...if(navigator.appName == 'Microsoft Internet Explorer' && reg_ie12.exec(ua) != null)...{....return 'ie12';...}...if(navigator.appName == 'Microsoft Internet Explorer' && reg_ie11.exec(ua) != null)...{....return 'ie11';...}...if(navigator.appName == 'Microsoft Internet Explorer' && reg_ie10.exec(ua) != null)...{....return 'ie10';...}...if(navigator.appName == 'Microsoft Internet Explorer' && reg_ie9.exec(ua) != null)...{....return 'ie9';...}...if(navigator.appName == 'Mi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\option_demarrage[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	downloaded
Size (bytes):	1039
Entropy (8bit):	5.735189013161626
Encrypted:	false
SSDEEP:	12:tjeQYpTk2Ro/v2RDxCoxNVxGZyGgfLLRvpBFQEEyUYnPacmjGSM1E:IQ0TkHnoDxRH2yGgfLFnFQEEMic0Gh1E
MD5:	86D1C8F1D03361FBAFFA7D510FCF741A
SHA1:	8B96C6AC221D6F97E9E9B9FDEC3E95229198B9A2
SHA-256:	45F55ED174CE419D4583BB5AA861D6605C864E3B313AAC04583EAED7B7059E25
SHA-512:	2EFF160D028ABB73417CA83CAA71A953C378971C920C5793D2DA15C6482DF377FC30A0EFCDDAB956D5475ADC72830767BA054EE6E3EA981E2C99E90DCF5A7CC4
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/option_demarrage.gif
Preview:	GIF89a..........8S..................dq...............;.&A........O..................................0@...............................&?.....H........=..................?y..........gim(Gt......"<a/C^...=CQ.........L.#O....<Y.....=.......................................................TZf....D............1Q{....Ao/A....;=C...........................AFR...JV..............................3.HMZ......`.@.BY}.........................................................................................................................................................................................................................................................................................................................................................!.......,..............X....>..t.....n..`. @.....Q.@G..9,b...A..\...PDdC...1! ...@.\.X.......\.s.....v....h..4.<.c4...YF....M..-..1..L.8+...q...+B..!C......8.......$.Rc...?...C...:H\x.c.o.Af. r..E..T.p....*4....A..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\option_rss[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	downloaded
Size (bytes):	1085
Entropy (8bit):	7.019133672798381
Encrypted:	false
SSDEEP:	24:GuWGTPxqr24VzADSskVoooe5hAivkQ5HoH1:1vj49eQVVh5kQKV
MD5:	7CEB3D6E2A6BA71E1FF4DEFAFADA2F46
SHA1:	3882737C518CAC57FE9B6D68DB2125D7D286CF7E
SHA-256:	3561DA5EF20565EC264830E67E282FF04D782183C3C86E76421A6B03299EDF26
SHA-512:	E968D1AB1810E4DB05D9D136F9C3D85C7E670DE7B861D126BD72BF7672ECBA998F471D85FEFFE3A3B99B2A8C89C5EA6F85692B380409A2E712EDB8819DC5CF36
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/option_rss.gif
Preview:	GIF89a......................../..0..4..8..8..9..:..G..R..S..]...............#../..7..8..9..9..9..<..C..F..]..^.._..s........................%.'.0..1.1..1.3..6.5.6.6..7..7.6..8..8.7..9..9..:..<.@.C..E..t..t..w..\|...............&.).)..,.-..2..3.4.4.4.6.>.A.?.@..i.z.................-..-./.0.0.1.2.3.?.=.>.?.?.?.>.>.@.@.?.B.K.R.`.a._._.`.k...............s%.z.x.x-.}1.~3..4.~3.>..<.=.=.>.>.>.?.?.?.N.W.h....p'.q).u0.w2.z5.\|:.{<.{;.}=.~=..>.}=.V.W.l........h$.m&.k(.o).n-.p0.r3.u8.y;.x;.w;.y<.N...b".g(.j+.n2.J.~L...~.....^ .Z .^%.f+....U..U .[&.Z'.d.............................................................................................................................................!.......,.............M...$Jv..sgK...@.zU...+Wh...a..i.`.b....'-n..@..?.b..@sL.!.4..`..$D...JA...4....4f..A"&....fLY.f..=.....AB..E..I.I...4..x`.D.Bx.}.....!#(.@..G...8..GG....L..DJ....:.'..#..tP....b.....EF..%

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\plus[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	323
Entropy (8bit):	6.996682098827877
Encrypted:	false
SSDEEP:	6:6v/lhPkd5nDsp7JOhDJE6T2JX+YZ+2TOGsj60Nfw7k20R0JrFjp:6v/7yOROJPT6k2CPG0Nfw7/0iJJN
MD5:	B0CAB0221BE8F354F593A7E0C55B0CFC
SHA1:	F122C70B312091DD06B9A253B680F1EAE02EE951
SHA-256:	50B47EDCAF67166B3F97A97F9A4D90476694223DDC33AC493038051C21101C37
SHA-512:	D20EB00C48528D201D85507818C9034518BC695726F4C8EC4B60575BAFC58620A1E0878F3ECEDEEE23BA580BD682A51CAAEC01A4B1F12E5E452D2EAD77448D74
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/plus.png
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\|P..D@.....(..Ft>.O...N.;T*.F..$..N.'.+..N"Vv..3g.=s...A..:c..#.e!.=.#._..mI.eM...TU.p..qR..."d....}../..z..,....(..i..Y..a@...(J...0..$Y... ...a.Y..y..1..q.....((:..n....4"...4M.e9...W. T....,.#0..$P....a.S....\|v.@<."....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\titres[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	downloaded
Size (bytes):	1016
Entropy (8bit):	5.86443252822339
Encrypted:	false
SSDEEP:	12:PuKkxdBYM0aR69GdHmenlR5fhiOPHkxfWDJmWukQp1/ktijOaaO7rnq5aw6yXJZd:PyFYM0nQnn75fEOHkJWz8/5iaaJ9J6An
MD5:	64662C06E79D5BA2A7FBF0E59A77A3D9
SHA1:	35B9E7EB489C92F076C7CC86F47BDCFBCCD9BAC8
SHA-256:	218DE8AA4E39FE2E929D901A264C38B604C56893222DE282FD4A3913A185F5BD
SHA-512:	1FDE8F7A88ADC80F01AEBA1B01D85702D51165C321B4D441B14E56CE550B81360BD80A9DF6DE8DDAD5950AE49F890D2BA8615C009346958987041C24C2117ADF
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/titres.gif
Preview:	GIF89a..........................................................................................................................................................................o.......................a..........s..t..}....v...................y..y..p.....x.................C..Q..d..A..I..R..p..j..K..j.g.................?.8.D..:..9..S..S.T..b..[..]..]..D..o.._..u.\|L....Y..Z..............j........x..............Y.~H..R.......................................................................................................................................................................................................................................................................................................................!.......,............9..H......Ar.).@M#.:a..."I\..r..%.nVT.pAF.+K.l.....N.b..a...3N....N..P...G...<t.f..D~Lp..C...j.!".....&..K...M.1.I...0..Y ....<z..{.....}ar...%B..1.g.....\.2.L.;^...e..7v*.S..!8$.@ 0...K.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\usb[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1125
Entropy (8bit):	7.818938363635054
Encrypted:	false
SSDEEP:	24:ckwxaWzKaE3b+7xhy4zT/PAGcZHEYrj91mbNG4i62V1qIORXNPoOchJwW227:6xv+13aNo43p1YrpyNvi62V1qIOdNX27
MD5:	DEB8BE8E772CB97EA6B2FA4F56471CA3
SHA1:	C6C5CBC200EF6DC15B46AA426F2A909685E504F8
SHA-256:	0D021445DF903C57A7DE927A542E5E5EEC7373B71B2C156DDC598D28017EFDB7
SHA-512:	0C7B2D1A264015468F5811807038A5D9605AC9322B530EFA9D727E4FFDAC09EBE6D926C40EA4C25C5230AA15BECC339E094B7B4E7A15515ADAC1B1C0F2B857FE
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/classes/usb.png
Preview:	.PNG........IHDR... ... .....szz....,IDATx..TkL[e.~......r.F..B......s.C.....1....F.. 1.X\b.....G.f.....ua..dq3..@`....=PJ;z9.-.......<.\|'.}..y.....C.1.">..'.i.U..&..Hk:......3&.y.............../.......q..d.....~...8.j..&Z....7.........db.\|.i..../X.. .J.I..]juz~.&]..hd..g..8.....A...wB#.#..].....I].i.....i...\|.;......l.b{..bKK..x.....,..$Zj.FYl..H.UU.......U...H.........L[C.~.e...R..I.I!....I...AaA>.j....[.]...c......y.Iy_.-(..&IY9.q................u5.N........4.4p...i..9]....u.m....T..2.,.mD..6.D.U..0..F.}?.Co..X^^......t.G-...e(.<.Q..P8LLN...5...JHKK...P(....h.i.4\|'.!.0.q..A.`(.R.$@Q.....c.x........a...S.N.{.d..\..~.4j....p.\|/...%XXrAfF..dg...2.\..SSSXI.$"..+R..&&T.....x[./4E.VQ.....h.^'...`,..T.i...........!....h..s066..``....Nh..y..........w2..J...... ..a..{....}8.xX.........A.QO.....8409q.w....UO ..c.P.g;...@J.1...>..=......@o0Br....5..D.L.........W....:.N...37. ....\|.I......pf+F../..+.U.........,.l..`...A._..=XZ\...ZX.x....S"nD....?

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\cartes-reseaux[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1320
Entropy (8bit):	7.822834708351263
Encrypted:	false
SSDEEP:	24:ZJJJPox0YTr+hkpZ1ClmtPK9AYn4FsD/KC5ayPTNewaYQbgw9LK2+uuiecboO1:3J5oB+s1ClmFKiY4yD/KCcyPxeClwk2d
MD5:	A2AF4E32BE5326B570465E1689CD628A
SHA1:	4F01D503D192D07458997C185207F62C6089B393
SHA-256:	28D2CA0C449AF087B5BFB75577CC4A8A08A60EFF24F025D31CCCEF45F01D3712
SHA-512:	879C038AF6F75309616548D0AA607C198DFEE07647DCC011856828183949C37DB083849792BE3199F50DE52E05D4D6F1402BDE67FCC76F2C2651B5B32DCFF59C
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/classes/cartes-reseaux.png
Preview:	.PNG........IHDR... ... .....szz.....IDATx..W{L[e.?}...-t.F.#v..)..#..if..6.h ....Kt......d...m...%c.C......._...:..e<..(..BK......[.0{..'.q...}.;...]...54\|.......LB..#./.577[...N....V..nj.6=... ...b..1.XI...K.Z[[_.j.O.^V.!,..%..G....-0z........D.\|..,//..s$-..,f.- ,...^..-._.-%iP.........0/I.A._........5_(.T..S..D..W....@.....w......X..t.>.S.G"B.EH.Q-I.[.n..... ..}.d..\..8.....n.e .@...X..<......022y9..yH./F..M..(.....qw.....=.YPf.......tc....T....d..@.k....l..#i..@d.O..E06.3....8.........}}Ca.)9..p.9.<.........%%.YuumE.l..du...GT)..-}.T.H$a0.d.P,.T.........b\...s...L...x ........Y.>..\|...\.d.t`Qc\k@W\\|..../...?.r-..ir8.............'..!L.ka..]....UTTG....3.w....z....69`.d......N..=je$......<................7...u..6;../^b.Q)\|6.+....VUU......7;..6f<.d..%6...Vb.....Mhjj".l....{..%.l...X..........vvv......{...SA.Z[H.".\.....{K.b.GN.Jb...#GJ.2/...........I......a..J6q...R..d,.....8q..rv..Q.V.x...f..X.3#W....*>..l$...VV.../...,dB.h...&.H..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\core.bundle[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	322912
Entropy (8bit):	5.335646858089646
Encrypted:	false
SSDEEP:	3072:1CcY/QFb6ncS/ebSEIuB3wZdFkI1VGPeQ/yoaMSgh1oUKgi4cwcAd4o:1CcPuFGPXqoHci
MD5:	EF40427DE4D853AC6C7DF003FEE68F17
SHA1:	0CC88A0CB14EBE3A46B7A7312E1A9DE94EBA8B19
SHA-256:	722C50C6E8C66E55DC3BE656D1DEE0D0091451A65F012259508AACC81E87C1A5
SHA-512:	7386CC1B2B41685141BB5E0364680B531BA67B7C40D72B18CDE8533241A73FAFE4030CA47E9EB1508D1984A26AE25428A40DC588F33266A195F4A0447079EBE2
Malicious:	false
IE Cache URL:	https://cdn.appconsent.io/tcf2/28.4.0/core.bundle.js
Preview:	var appconsent=function(e){function t(t){for(var n,s,a=t[0],c=t[1],l=t[3]\|\|[],p=0,f=[];p<a.length;p++)s=a[p],Object.prototype.hasOwnProperty.call(r,s)&&r[s]&&f.push(r[s][0]),r[s]=0;for(n in c)Object.prototype.hasOwnProperty.call(c,n)&&(e[n]=c[n]);for(u&&u(t),l.forEach((function(e){if(void 0===r[e]){r[e]=null;var t=document.createElement("link");i.nc&&t.setAttribute("nonce",i.nc),t.rel="prefetch",t.as="script",t.href=o(e),document.head.appendChild(t)}}));f.length;)f.shift()()}var n={},r={10:0};function o(e){return i.p+""+({0:"Consentable~Mandatories~Mandatory~Privacy~StackDetails~VendorsScene",1:"Banner",2:"Consentable",3:"Mandatories",4:"Mandatory",5:"Privacy",6:"StackDetails",7:"Success",8:"VendorScene",9:"VendorsScene",11:"ui",12:"vendors~VendorsScene",13:"vendors~ui"}[e]\|\|e)+".bundle.js"}function i(t){if(n[t])return n[t].exports;var r=n[t]={i:t,l:!1,exports:{}};return e[t].call(r.exports,r,r.exports,i),r.l=!0,r.exports}i.e=function(e){var t=[],n=r[e];if(0!==n)if(n)t.push(n[2]);else{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\devices[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2908
Entropy (8bit):	7.916331340776394
Encrypted:	false
SSDEEP:	48:taC1HzBbjkJmPsrogzL9YaohHIF2yJiF1i:XtXFPs7H9AoF2yJiFU
MD5:	FEB8F633A2BFC01CC571526E9AA0926F
SHA1:	718F32D2F40B30E39E41BF8A09F6B610383AB168
SHA-256:	D5EAFA01511DDCE1D284306ED3362578EEE26D7FEB0CFB9D5FCFD701BF00275E
SHA-512:	ED5C56E1F83C9023664A309DE0E7A35D67FC1C2CEA712B7292C4326B775CB8F7AA6C7C60119CF58FAD8325FEFB04CEC54825FD49B874228255890B4D5C957637
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/devices.png
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z[l.....;.......l.......&1$5.M..75..P...Z./.U.ZEU$.-$.)T..PD.D.&j(..&.................=...4`...~........#.../.!..~\|..K...P.I4.../...q......7m..C.....%g. ...9.;ssq.\|H.Qm....v.hgg.T..g...B.POO.jjj.H......9f.7....\|.`%.6...b....y...A.9..4d.#G.l...<..D"s..e.~.....(..V.. .$.#......\..k.sq.XA.....$.::...eB...<...;..~.n.C#..4W...WP..T...C...H....,.....H\.r:......`...pg..fz....x9.......Y....[...y..`.<..E...n..0z?...8.N.&.d..PP.n4......B.=J\|.5.....,......Qh.5.g.d.u..gA8......R...(.k).-..X..4...=/-.]....Du..;YA]..=Mr....".....+ =+....]........g.l~.B!444..+.z......^....{x...}2....4..G!/......q..YQ.Q..p~..Kv.E"3...._..\|Y..u<.......`.ooj.mo..><48....-....w..N74n.{..mm;......-.8..N.<1.&...>....QxxT..+..@...jw....m;w=.~..z..!..m...v.A.....7o...J!.[..H$...e...vjtt4F...}.+...S.;...K...o..5.B.4h._..N....R pD.f..2..L.u....q...hAa..N.8...O......L#1._.\O\|..u...Z..z<..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\disques-durs-internes[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1289
Entropy (8bit):	7.771537600081928
Encrypted:	false
SSDEEP:	24:OVLUao94DAq7EVtLYphu34U6t6Ox5DlF80jt4HccG9SuIGC8Lx9OqfTSCW:Uz1Dp78tYY4UkLBlF80j9SuIYxIgTxW
MD5:	64804589C24B89169B0E21ADF20B707A
SHA1:	90F583E900EB6550FEF58D53CCFFDAF33CC7D8FF
SHA-256:	3B9BEF5C6192B1167D6CE3DD1D8DC748A2335740255356848295A06E6B0D64AE
SHA-512:	800E080E5C2150E6A55F78B840327A506F39C96A25A878BEAF88BF16F419E597BE7EBC5CC682A8F1B5684C3F119D6E30EED88181021E36FEF3D4D3DA04DFB277
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/classes/disques-durs-internes.png
Preview:	.PNG........IHDR... ... .....szz.....IDATx..ViH.W....8..w.....Q+.P..\.......K.6b#tA....1.....Vh.HA..R...RE.u...d..1u7~=..ZHC..)^8\|...{.9....:..:.......)--........[...zRWW.mJJ......H1..f.zYPP.fhhh......K.V.QVVVBHH.......-...B...X.8666...Cmff......-N.D...5.M..W...4.........@kkk+ooo....$......LLLH.R....*===.33.}."22Rcii.B.....[(!.H@............. @...488H..........-...+..............ff.........m.....iG.k..MHH....!......`...Sss3UTTPLL. s.`u..bH...B.....555.........-.F#.3...'......%.'sss:88...=.....;::........icc...#.$...y.....U.).>....<.-.$I..666.2...D..D...DA............)._....;&..omm..7...=..~!..H..o...... ..R... .n.....4??/6.l..........$...999..c(.J.....yyy.'+....9j......}4<...E.NP.......<.........!!;.".z^7...$K...'.mnnR[[.edd....MOO.'....L......Mcc?..bm...nP..Y....\|........]...SSS...!.......2....e.2...E$..S.9. .x1.{....&&...},?.Ab=.(........n............O H.......9./t`%,...x..._.....o.r............a..R..}.O;...m.y/8882;;[....6b+....G.H......1tzQ.g..LMMA.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\fond[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 110
Category:	downloaded
Size (bytes):	531
Entropy (8bit):	5.236762969184709
Encrypted:	false
SSDEEP:	6:KZv24QEdpyJfKDfyFBaKylGmsYgOR+TINwi9YWbHUXS6L9lDh15lzlJnhlP4Bf1h:8OHGoJFB5xCoTwHYc0TDhfnp4af4p
MD5:	65894FBCA40316DB335F6C46489D6A82
SHA1:	21D15B84CE95C348D3539327369CAF434347B1F8
SHA-256:	2B540D49D5121A63B206F73240713D331A8A308CFB0D89860773686C63ECF32B
SHA-512:	BAA7A6080A72C45792408EDBFDF7EF567D12F6CAD322FC6911AEEB3EF2F35B423754B37BB020BFECD4E09ECF0A9DA51FD9DEBF0BCEE15AC8595B8912AD09651D
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/fond.gif
Preview:	GIF89a..n.....;q.B..@{.9m.......B..@\|. <.!>."@.B~..3.(M....)P....+S.,T.'K.2`.3b..,....6i.&J.7j.?z.D..1_..'.0^...&H.3c.C...'.."..;./\.!?.C..P..9.#C.)N.0].=v.7l..2..8.$F.. ..!..)..7. =."A....(L....,U.2a..%.:o.6h.>x..$../.-X.<t.=u..6.>y.4e..1.<s..#..(.....:..Y..".5g.:p.A}.D...,.&G./Z.$E..0.#D..%.7k.4d..5.;s.>w.+R.-W................................................................................!.......,......n...p...<..O..45%RMC]?.$N6 e.W.:D[K1.`H72+P&.8.(.9,\Z3X!..;.-.c..=dEQY'....>."_JSA..^0..@T..aLFG/bBI.....U.....)#.V..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\fond_cadre_haut[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 20
Category:	downloaded
Size (bytes):	96
Entropy (8bit):	5.537374739988986
Encrypted:	false
SSDEEP:	3:CBM0KVA2Hy8jGYF+YdmRa//lRE:wCq23Gm+YdvE
MD5:	4B71B963E4B535A7DAEBCE91951D8032
SHA1:	88F22E4E042B1ECF2D09EB4F5BBC3F540391E7FD
SHA-256:	E445A6B92FEFDA7B58D77E741F18168EF9F6E60E26293EC30B8B68AE8BE02BAA
SHA-512:	94514D2E8E682D9031DBD4ED2F3CCF1B00E58233A93704DB048AD9823207D14ACEAA891C1BF3D3452319B3F33D2B52C5346AA7EB01A70DF5C44B077A7B4D3658
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/fond_cadre_haut.gif
Preview:	GIF89a........L.{.....e..)b....;p.......P~..V........D....!.......,.............EL.....@O.F.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\gpt[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	70017
Entropy (8bit):	5.631218215251697
Encrypted:	false
SSDEEP:	1536:uJstHwjMlwyx03j/m9DwwjuqfFBBPLNVtxirPtL/iS:6s9wjOC/mPBbTUPtLf
MD5:	DAE2D8F68E7C0DF6075F47CFE46F76EB
SHA1:	F4FD399EC1D8B64E3C8060FD816077F90A931445
SHA-256:	2A4FDC9B11DABFBA0B95C811036BE6523C8502F43A21783F0C55E91958BDABBB
SHA-512:	FFD060439FE75B1BDF0BD10E3614C65E42673634702E8FCFB1D60270F054AC73B8E89F8D9EC97FCEB7A255D492DBC5DC5755D7EA2213BE12DD67B9DBC1F3CFB1
Malicious:	false
IE Cache URL:	https://securepubads.g.doubleclick.net/tag/js/gpt.js
Preview:	(function(E){var window=this;if(window.googletag&&googletag.evalScripts){googletag.evalScripts();}if(window.googletag&&googletag._loaded_)return;/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},da=ca(this),ea="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),m={},fa={},n=function(a,b){var c=fa[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]},p=function(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\index[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	39056
Entropy (8bit):	5.240538189249216
Encrypted:	false
SSDEEP:	384:SMuWsR0ToqiKlKilKit7aJHfc3eN/XjcB7utVMEvAi6dCCKDCU+75Mu1l6H2aQil:SuDToqiSzlzVEr+7H+65cB
MD5:	54EA94F9B16797296F0E34CCFA9C7E6D
SHA1:	07083D67A091BC5CDF8AFEBDEC2ACAF93DF726C2
SHA-256:	F06FAED5C678C840BDB779640BAA9E7CDE432DA4BC7A4DA6DE2DDB43B955EFFA
SHA-512:	B05CD09C6AA74EC9F2A9E70269C397A1172D30E698B959117A43B3D627680A09DE6BC37BAE8FA48A0C7B50884FCD7B0C14EB0253F3B10708A2EA6F7724D3CABC
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">...<head>....<title>Mes Drivers - détection automatique des drivers, des pilotes et de la configuration</title>...<meta name="description" content="TousLesDrivers.com permet de télécharger gratuitement toutes les mises à jour nécessaires au bon fonctionnement d'un PC. Les drivers, pilotes, BIOS, firmwares, utilitaires, logiciels et applications sont téléchargeables rapidement et facilement grâce au classement des fichiers par catégories de matériel et par marques. Plus de 1500 fabricants informatiques sont référencés." />...<meta name="keywords" content="drivers,driver,pilotes,pilote,bios,firmware,firmwares,drivers carte graphique,driver carte graphique,drivers carte son,driver carte son,drivers carte mere,driver carte mere,drivers im

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\manettes[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2140
Entropy (8bit):	7.901809119079006
Encrypted:	false
SSDEEP:	48:SCuLCTgRuNknMXnumq6k07OHSbh6NeJ9SHbaMFpdy+7pdIBxImz:S0ZXqd07lbW8S2m8Vz
MD5:	F703CC1FADF387E3AD3543AB6166DDB5
SHA1:	85C8F512D8B3951F51482A88764D14CDA09F745B
SHA-256:	93047161D6B912EE525228FA1B1BB183D169FA28AFD4D81EBA482D83BCA65708
SHA-512:	7EB8C02D8B379471571976BC44A5220688416DDAC1257279816EAF01B6D812E8DE61944611801B2691709ECEC806F9B4846650DED36A74D773C7AD6A353E4868
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/classes/manettes.png
Preview:	.PNG........IHDR... ... .....szz....#IDATx..VyP...~v.]........K...9DP.rU@.%.5....hD...5.&..<.jl..)U)VGkt.JHL...C\.Z..e..~..hF.8.....g.ov.}.y........0z.....&01iM..-...?\....21u.[..c..3.cV,[..........\|....Pa...9.:9.D....d..R..Jfalm%a..Fl.....XFF^..]Lx...Qq..JO.....b......e...+=...?/T..N.mj.v`..]..vh.]...-...wuC...#6.m)...1..A.Q.....{e....m....N.7=.v...rW..?f..z.......=.b1.L...<..\|3...0.1..A...[.B".4...L....z.._..1~.x..........<t.".k..Ox.X.3>.....x.Gk....A..&....d#...C.8.8]\|.o.Bnc.x....k..z.....8.(...:\.......~g.).H.[...<f..l..Z.&5P1.F...N...Z...Q..)....z.z.....&{L...l..Y?..U[........<0.....\|Q[p.wK.p.....1.Lr.......b90.>}d...L0....1f.4A..@}G.2......n.C30....=.U..l.Q.>-,....F.c...G)/8.#.x....`.^..X.'.l....a.@...oB.p.m..../.:I.-9x.R.I..0.[......>\...sW.\|...~...........o"...JI.d.....H..../.s....hi..;.Q]..L...Ssx{.chd.e.=@HH..l.@7..u......V....j.u.B:...=0a2i......_mA.y:..@.....BK.r.7.Z..E1..n..t..Z.6........!....l....(*...E%.....Dcs...&..N.^

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\mes_drivers[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 180x60, frames 3
Category:	downloaded
Size (bytes):	5078
Entropy (8bit):	7.889414565056289
Encrypted:	false
SSDEEP:	96:D0Z2+/jO9GLDla5SRLh2G4aRiRPXqHtEAip5eB4fX7n8jhV:f+/yola5SRLgPkiRfqHtja8jhV
MD5:	A1EC386AD35E52BBF7378F43ECAA3F05
SHA1:	584CBE8683703F0C030AB8E2EAE384DECBF8F5E0
SHA-256:	C1134C18F6CFA5025695E819A60322E14145502D75D4AFF8175C0557184BC6DE
SHA-512:	BE3E532E56CAC977AE57ADF278C1F37EC645EA77F3E9E61A9C4FE72A143B0497760FEE0FFF91726DDAAFF7CF4DB639EB21009CDB89304EFBEC70212A1D0F6B95
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/mes_drivers.jpg
Preview:	......JFIF.....d.d......Ducky.......F......Adobe.d.................................................................................................................................................<.............................................................................................!...1A"Qq...a.2#..BRb3...r$..c..&V........................!1..AQa.q".....2.BR.....b#..r................?....(.;....c4Sm..f`.........../.$U...T.._.......D...J...Ob.H.......B`rJ/.mj?.#...o<..L.sn...S.p[^h2%.q<.<.9~..Sm~..O...,9W.{w.l.cX.N[..........<....2.......J.S..E....O...../6.@B.h..(.Y..&.0..L"a...D.&.0..L"a...ER...H..Q.9%...W...5...OQ~.<..&W.....0..VP^.Ft.J\|.L.}Yo..3_>.....I.........z...!n..z..$.HD.S........L.5..3.?.8...`.,yrB+.......I.h^...(..@.F.`.....W..s......5M..y....=..].wB.\...l.A........<.W....x...0.Z^...=.x.xc.9x..........Qr.u."a...D.&.0..L"a...D.&.0..}........58.F.x.<h.:^.U...g,..!..Y.+....t..d...y....k.E.M.2.#.\|Um...5;+y.l.?=.. `.,..y..:....c..5."...:.....w.c.<

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\option_envoyer[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	downloaded
Size (bytes):	1051
Entropy (8bit):	6.527634676403194
Encrypted:	false
SSDEEP:	24:EOCkWvrEYcl8I+VyIFzyz1HzWs6xNVnSZ4usE:qQviLyIFzyzxzWs6xNNSuQ
MD5:	6B8E1CBDA2E2E7C6851BC9272DB2F156
SHA1:	C5D8D19713599F5833C54D1E90C7FB6AA4018691
SHA-256:	F3FBE24E565206A92046F4FFB55A571FAA054E2005FF257C8EB2B06FE33986D7
SHA-512:	9AAAD2EB13B5993E8FA88C749E8426B317413190D06E0B25C905634DC101383EE938C84FC88F1B51EDBE44A65E31DEA6C45A2C9F1DBC36755DF5BAB608E9B1C5
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/option_envoyer.gif
Preview:	GIF89a.....................................................................................................................................................................................................................................................................................................................................................................................................................................{.............................................................................................................................................................................................................................................!.......,...............H....*.8B..Q.l18.P .N.J..5K.0....B....Z.\|..6..@..L.E..`........a....t.R.P........W.2a.D.&O..........6.Ze A..X.1...O$:M,D.$...j.....O.F...14I..99..aR."DO.<r.h..CrlPA.....A.%...7o...1#M..q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\option_favoris[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	downloaded
Size (bytes):	574
Entropy (8bit):	7.212915520705348
Encrypted:	false
SSDEEP:	12:n/5P6ClLzJxG4CvFCr18tiprYFSpWKJcc+hcXTCfoxhJTbttCVmrhKPSWe:n/NzJxkFSJpeS8c+qjiattvoPe
MD5:	E4EDDF2D20FCEA5320963A52F0C73D69
SHA1:	099519A5E939D9DA4099587BDFCA7196F4FDD5F7
SHA-256:	5C1FADC5DBEE4BC7EB75BE521D7C88E4C163B48E34383AB4E3FB3DC2AE8DC695
SHA-512:	1785BC70EA8A40DD4B66B2536AD1B41C472579D2A5758E85D047755B7F218D5490CC7E03DA62B6AA70E9C355EDC9C564953432761216CD5A225D7AD388B030A1
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/site/option_favoris.gif
Preview:	GIF89a..........................................i..{........P..a..m....@..W..b....?..J..L..R..R...........%..&..-..1..1..6..<..F..b..c..i...........................................#..(.)..0..C..J..L..u...............!..d..v...............7.<...(.....4..........,..0..>..C..F..M..M.s....-..>.f..a.e....K..b.._.{.{.}.{............^..h..p.....................!.....{.,............{..{l`...b>..{J8d..u?1Z..o(,U..a%.Fi.\=*.+MI06.LB@G<^zT9....C"..../Oj.cN$#25....:[.tX;.....Ps.kH3....].h&.....Eq.yR4!Qf..Dm.w'-S..Y..J.+7....$..D_.$rsF..@.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\slm.prebid.touslesdrivers[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16749
Entropy (8bit):	5.409147335144714
Encrypted:	false
SSDEEP:	384:Ti/kOXmXC38F7DJgDfQf4Dsyfxv0ZqJBt:2MumX7FIt
MD5:	89E6092876ECDD0820176584BE14BE40
SHA1:	FB30F0DC022C6526F1C0E6BBA455B74F941526E6
SHA-256:	5C1EE526F487606C846F5465C380C9D6B86241DE0DD58CB7915DF2F75BF025FC
SHA-512:	80BC92FC5D8DCD8BDB413BE484209CBBF7D3B4F4504D818F7D84A218E5ADF2673CBFA183195E5806855566A742D195FF6C084D8EA0CC51548F87035C256426E6
Malicious:	false
IE Cache URL:	https://ads.sportslocalmedia.com/slm.prebid.touslesdrivers.js
Preview:	(()=>{var e,a,d={},i={};function r(e){if(i[e])return i[e].exports;var a=i[e]={id:e,loaded:!1,exports:{}};return d[e].call(a.exports,a,a.exports,r),a.loaded=!0,a.exports}r.m=d,r.n=e=>{var a=e&&e.__esModule?()=>e.default:()=>e;return r.d(a,{a}),a},r.d=(e,a)=>{for(var d in a)r.o(a,d)&&!r.o(e,d)&&Object.defineProperty(e,d,{enumerable:!0,get:a[d]})},r.f={},r.e=e=>Promise.all(Object.keys(r.f).reduce(((a,d)=>(r.f[d](e,a),a)),[])),r.u=e=>({1662:"slmadshb",2937:"instream",8216:"advanced-video-player"}[e]+".js"),r.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),r.hmd=e=>((e=Object.create(e)).children\|\|(e.children=[]),Object.defineProperty(e,"exports",{enumerable:!0,set:()=>{throw new Error("ES Modules may not assign module.exports or exports.*, Use ESM export syntax, instead: "+e.id)}}),e),r.o=(e,a)=>Object.prototype.hasOwnProperty.call(e,a),e={},a="slm-ads:",r.l=(d,i,s)=>{if(e[d])e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\souris[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1542
Entropy (8bit):	7.8247839964894865
Encrypted:	false
SSDEEP:	24:7A0APoLZo9zlYwn/bu6BMDyeADrNei3d5709ddSTwEj6oKWtHEGx6:M06oL2zDu6imfDrgi3wddUwM7KMEGx6
MD5:	8158744CD7509D7AC5B58AF7154669D5
SHA1:	5462F27B98223202FF3B900C922DDDC19ED8B34B
SHA-256:	6C9736223A39C89BF37ED59BB818A0F47F627DFB1E149C87215FAE07F245DD44
SHA-512:	57674061DA6B06D54A617395C30CE050DE1A54AE134C9988A8BC17106A42C12D5B1A7838CE0B3896DC99E2BA9E8C406F239A61069CB2D9E8D27F4C265D0EFBAE
Malicious:	false
IE Cache URL:	https://www.touslesdrivers.com/images/mes_drivers/classes/souris.png
Preview:	.PNG........IHDR... ... .....szz.....IDATx..VkH.g..?O...)M.CZ..<-...a..$[...p...c....ls.1h...).....?.. A..h5.K.<.Y...].=?...b...........~.y5^..}8>....C...~.......9.FQQQzaaaBYY......;7......ZRR.g.}...........~......V..............=~.x..Gm._.;s...z...........'....9::.,--e. t...yyy......;o...P/..a_...m.)....NCCC....~...].v.........x&......%88X."....\XX.....[@.q.-......R.....g.~2...Y.eff~...y....)ioo...7..;...d..w..~........{.Jgg..?.^....e....ILL..RU....=...J.....q..............[.$$$Dz{{...[....^.....y....+........o\|.........mY...G..........!.03777.{.>[ZZdnnNe...........H]].X,.........9e...;cfdd.<66V.O.Y........o1#........L.^....r........(.....RbOOO9~.....{l6..+..0&I.Vd#v....zegg.....F.n......4k...Nk.l`,]'A...jkk.......:KFp.Q..,..._...@nn.......t...t......-.L.L.....c......k.I\|\|../.P.q..}...A"..u.?....X.$...I5..677k..DP.Iy)7.QN...Q.2K.Np.M.%.q..c.Fp...X%.L..`.d...".....!..g@u......N....&%...*...I..ettT.9I...4........k........pr

C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM Download File
Process:	C:\Users\user\AppData\Local\Temp\aes_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	22964
Entropy (8bit):	7.988416177688223
Encrypted:	false
SSDEEP:	384:2vIEb1SlH/ad6/yqlZGZLwgwgF8FI3ojaON4rXEiD7blpPlpFFh7QkD/idV2Tsop:uaHyPQ8LT8FGOMUiDHlvpFFh7Q8/idVA
MD5:	9E12786503113586E5B7697F573D37F9
SHA1:	525A4D4D38B9EC5711CB8F1318E0DFED64921CAF
SHA-256:	16A8BEDB47003743DDDAC64848275A0FB49AA9761A05AD481CA0C1CE3303E5A5
SHA-512:	1DF907649A9117ADCB1463F8460A361DBE4B36689CD87CBA0E68563A40CFA721A3FE39C90993B82C20B379EDBEE8D20F42D597697EE04B55E48B380E853ACA67
Malicious:	true
Preview:	AES....CREATED_BY.aescrypt 3.10......................................................................................................................................P.........on../^..)._...../.A.].ol{.H.(......~d..=3.JO...E7a=.NG....(#......l..Z.r...D`.EzWG.......k..........:.pY.4.ld.+...."..T..Z....0]awiQz......).f..(.....pW.WX..e.<...M$...../m=I.))..&Q.....~..5.e6....kB ........]k-......A.\|.$Z\|H...aD:/.>..h%g,..M(.d..jE...VR...K...?d].M..jK..?....(.8.=....s.'O..wi........6;....L..~.`..Sc.a/...)..4........?.".!.....;...+...-tF.K.k..O`...'...a.\|N,X) 9eyN..j.u"Bb.T.............=z.S.0./8......Q..^Q.u.[t...QF.b>.7.e&...v0.....w....Q..B..V.3...N5....f...........X.d..q.}.z....5..#..'.....b.c."o..G@.Yy.2....l.g!0.O..A.....S..^..I..mN1`....bn8.$.5.....FZ.....;....Zd.`3...H.D.Up.=._.x.$B.q.{3J.d......GT.E.....FG..c .#2~[.r-<.+..L..{.`..Z.px..8B...Rt.....3...V.9*..........}...O......\..L...iS....e...u.e.D+L..I.d.^m.m...9...i?o9.ga.9...f..\.`

C:\Users\user\AppData\Local\Temp\aes_x64.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\detection.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155136
Entropy (8bit):	6.66841365910386
Encrypted:	false
SSDEEP:	3072:qPjqdc4gShSWvT+Ykjse0/xZ3ElLpPShi76u7:qPWIWvT+jse05KEi
MD5:	E5125D4651C008EBA61D9FD3ABD5AB31
SHA1:	4A85E5D6AB73891832C9ADAA4A70C1896773C279
SHA-256:	874CB7A8513B781B25E176828FE8FE5AC73FA2FE29EA2AAC5FE0EAAD50E63F39
SHA-512:	26BA2CECF7324E1C5FE46112C31523E2FABAD8DE34FE84CE3A9E3A63922B0F85D84982E7C6BAE13D2E3CF65193F7A19A67A2FC80AF5A78EF8CFE611FCE1A9409
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe, Author: Joe Security
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e....O...O...O.\|.O...O.\|.O...O.\|.O...O..O...O...O...O...O...O.\|.O...O.\|.O...O.\|.O...ORich...O........PE..d...u{1U.........."......>.....................@.....................................%....@.....................................................<....0....... .......................R...............................................P..h............................text...j<.......>.................. ..`.rdata...E...P...F...B..............@..@.data....q..........................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..:............X..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aes_x86.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\detection.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.805779966193588
Encrypted:	false
SSDEEP:	3072:NgzEhDpHGk/gqrYxgHNEt3koN0Shi76u7:NiEhNHgqrLme+i
MD5:	82FF688AA9253B356E5D890FF311B59E
SHA1:	4A143FC08B6A55866403966918026509BEFCC7C1
SHA-256:	B68FC901D758BA9EA3A5A616ABD34D1662197AA31B502F27CBF2579A947E53E9
SHA-512:	CBB3D81E3237B856E158C5F38F84230A50F913BDADA0EF37B679E27E7DDF3C970173B68D2415DD8A7377BA543206BB8E0FE77C61334B47C5684E3DDFFF86ACED
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: C:\Users\user\AppData\Local\Temp\aes_x86.exe, Author: Joe Security
Antivirus:	Antivirus: Metadefender, Detection: 21%, Browse Antivirus: ReversingLabs, Detection: 21%
Joe Sandbox View:	Filename: 53c0505a_by_Libranalysis.exe, Detection: malicious, Browse Filename: hztxqReczN.exe, Detection: malicious, Browse Filename: BleachGap.exe, Detection: malicious, Browse Filename: SuperEnjoy.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d..d..d.A...d.A...d.A..7.d.....d..e...d.....d.A...d.A...d.A...d.Rich..d.........................PE..L...P.1U.................$...................@....@.................................N.....@..................................p..<...............................p...pA...............................k..@............@..0............................text...J#.......$.................. ..`.rdata...7...@...8...(..............@..@.data... g...........`..............@....rsrc................p..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\curl_x64.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\detection.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	860232
Entropy (8bit):	6.330103845723899
Encrypted:	false
SSDEEP:	12288:VBhSKWefubWiuJBmMSa1ayJZlQyyEmRwYGd0Cj/cHBg3ui7KMTFhlMVs+b:VBhSBwy76MM1vBycddHj/cGTFS
MD5:	E80C8CB9887A7C9426D4E843DDDB8A44
SHA1:	A04821E6D51F45B72A10BDBD3BB7E49DE069CCD2
SHA-256:	3DF4725778C0351E8472A0F8E18CAF4FA9B95C98E4F2D160A26C3749F9869568
SHA-512:	41B4BD84336785D4DA13B5653183BF2A405B918AFAD3ACD934F253D23B1E00460173E36B2D65A61F77EF2B942DBA735655FC5B4EC561C375896F5A010E053D33
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............._..._..._..._..._.-._..._.-._..._..._..._.-._..._.-._..._.-._..._.-._..._Rich..._........PE..d......X..........#......6..........0G........@..............................P..............................................................4Q..x........B......h^......H............................................................P..H............................text...n4.......6.................. ..`.rdata.......P.......:..............@..@.data....;...`.......J..............@....pdata..h^.......`...b..............@..@.rsrc....B.......D..................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\curl_x86.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\detection.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	690760
Entropy (8bit):	6.379028616802886
Encrypted:	false
SSDEEP:	12288:yy+N4we0nEbORHuybDm5EsKDiVwx3g5smKQwT49zw64GdUCjfcwC6dum7O8TPVsT:CN4X0nvjbDm5v5wizH9dnjfcsTI
MD5:	213A2CE0C3E3BCC71DF42A9EDAD0BA35
SHA1:	A82D8374BDBEA0CD3B08EDBDE32EAC29E061AD96
SHA-256:	FBC0D3A56DCC0B9C6FFE556D1FD58C57502325780F137B64788FBBBDFC13BB82
SHA-512:	77BECC9354014573A7C348E94632ED484C156C24585EB4CBA3E62FD8BB13085D41090EBBED056A58BE0658DA5918E639BF5F0AEBF4FCEE3F2270E8A701A1348C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r...r...r...a..~...w..p...w.o...w.......r...........y...............s.......s...Richr...................PE..L...+..X..........................................@.................................I6......................................8...x....0...B...........p..H...............................................@............................................text.............................. ..`.rdata...3.......@..................@..@.data...d+....... ..................@....rsrc....B...0...P... ..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\detect_x64.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\detection.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	82432
Entropy (8bit):	4.904297032300948
Encrypted:	false
SSDEEP:	1536:mGdmm1zdwlinYnyxH0GSrFc5VfJF4O7W5ia:mGdsqZxM5cXLRW5i
MD5:	6A7EC375AF8BA2E87FF7F23497E9944E
SHA1:	791FB650E9E27E9857B332F534A0ADE1EAE28BE7
SHA-256:	65C68FD55281A0A4598807EA83531A0CB0E4E79A8C5BF38E9637E776F72C3514
SHA-512:	C6FA4AC94692DDB8D60C8AB40AA33B17E9D0800C802EE5D3C7D6F0DB24C507638743287A274D7EC62FE568B6AA1C69932D52E74A50040720A89138CB5C8BE7AA
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j....pN..pN..pN.VsO..pN.VtO..pN.VuO..pN.VqO..pN..qN..pN.VyO..pN.V.N..pN.VrO..pNRich..pN........................PE..d...2..W.........."......b..........@j.........@.....................................P....`.......... ..................................................................................8............................................................................text...0a.......b.................. ..`.rdata... ......."...f..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc...............@..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\detect_x64_2.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\detection.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	81408
Entropy (8bit):	4.8816791730814995
Encrypted:	false
SSDEEP:	768:rrNzEAAwF11A/YuQu2QVoh1Ad5pWQlqTORopXJAiFaptHJ82BSOe9oKSJ2SLD0BF:NEAlA/YuQNNeUTORopXebptHJF4O7W1
MD5:	635E57FD7AEFFAF87F6242AF79F419AA
SHA1:	BC727A929A778C395675BACCF281A803B4CAD4EF
SHA-256:	4A097314779F4D9CC594F40DB5509487AA4C2C8BDC58BC7230FCB183334BFD97
SHA-512:	69E5BEDB1925CFD5A2618C57C2F7DE82816183423B8F022614681511931B86A961FE02DB4F9FB94700981A0B8948E8A55DFCC60897462233DB819594D4DECEAD
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j^...?...?...?....q.,?....r.o?....s.>?....w.!?...?...?....o.-?...../?....u./?....p./?..Rich.?..................PE..d...P..S.........."......l...........n.........@....................................z9....`.......... .........................................................l............p......@................................................................................text....j.......l.................. ..`.data................p..............@....pdata..l............t..............@..@.idata...............x..............@..@.rsrc...............................@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\detect_x86.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\detection.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	4.9059415705271885
Encrypted:	false
SSDEEP:	768:w44f/8vj/BaTwqy4Sj5dED/bAzqYptHh82BSOe9oKSJ2SLD0BEZWkSiSbA:wHsvFaUY/khptHhF4O7W5iSbA
MD5:	42344B0A6F2941A402BF7AAC3893A6BA
SHA1:	713476D0AF007882639A8F703EE5CBCE34380293
SHA-256:	F6971D84A1600EA51FD7508C4DA636BE8BF9EA406D472FC2D9E42B4AC58B77D8
SHA-512:	8C3BBB98507B963FB0F77C404CAAE78ADFDCFD132DF53985C9D8E9692FFC50744B19D52477C2701810A7967BD6E5ECF13AF912D2EFF47FC2CA68BD045C56D695
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........nG.i...i...i..^....i..^....i..^....i..^....i...i..&i..^....i....~..i..^....i..^....i..Rich.i..........................PE..L...\|..S.................^..........2b.......p....@..........................P.......r....@...... ...........................................................@..0... ...................................@............................................text...4\.......^.................. ..`.data...D....p.......b..............@....idata..h............d..............@..@.rsrc................t..............@..@.reloc..\....@.......$..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\detection.exe Download File
Process:	C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	1165312
Entropy (8bit):	7.9946328993180025
Encrypted:	true
SSDEEP:	24576:4AmTUWOc8w79cO634s6zyG2fzjTrqVHqOx:4B/OBVloswV2LjHzOx
MD5:	02BA1C44B6392F013A7AA0B91314F45A
SHA1:	724C1977101ECAE88E4F104A8422B64BFEC01A98
SHA-256:	7FBE59195F5F6F45C8B38B12488A169FDCB3A272004DBAF44C9D92A60A3690CB
SHA-512:	56BED935B028257E6EB485C555002F3E07E86788452CCA0E28786098CC9254A7462B777A7A46AE6594911A73D786A6D15DEE248F05A4C33A1BC749BE071BCC3D
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 10%, Browse Antivirus: ReversingLabs, Detection: 28%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....+.W.................d...$".......(...........@..........................0)......O........................................(.......(.l6............'.x/...`..............................0.(.....................@.(.@....0..T....................MPRESS1..(......~.......................MPRESS2X.....(..........................rsrc...l6....(..8..................@..............................................................................v2.19..n\|.. ..........h../'.'...xN.r..^BT%.....6.sJ.F..n..L.U...RX.Tsb....^.y...zIw. .1..x.;T.^#..#....cy..u....DW.....w.k.z._by..hp...YCJ..D(@....k~?...w..W...Ho0.%e\|L(...n...n..mR..<.;..#=UF"z..x=]..]..9..("#...~...okoQt.-...V2iZ.....0J..r..2UK5.Njz.Sx..Wr@..@(X..E..;.g...o.Z.D.~"....Ui...$`....UD6.v.....w ...J.....A...........L...1V.TE9...6....F......f./.......5...JX.kLg...R.a....+..X.51?...S...<G...".NNm.....m..wW'o'a....W..%.....:j!.=.#.-.,B..< ...G..w.\..~)V...

C:\Users\user\AppData\Local\Temp\interface.cmd Download File
Process:	C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF, NEL line terminators
Category:	dropped
Size (bytes):	2669
Entropy (8bit):	5.137308062929335
Encrypted:	false
SSDEEP:	48:A5SvrvPuel4uFaBRACQzqNuXl5bRTmlvy5BkdNN439kfOk0rn:A5SvzPJl4FRAPzGuV5bmvs84kfvgn
MD5:	E0EB53551ACA2ACFF814DDD7ACA212E2
SHA1:	EE825C865D5ABF244D6165EE838735F1BA05BFCB
SHA-256:	11993A03F68A33500A3CE8FBEB3E3C2042A28299D04F39EED40147709E76CA79
SHA-512:	DDDE3D274B2EA8DA0D645F88BD6B340902DCA83E599BA0C7249953A7C1F2DD512F764802134A6EFA1F48CA6CAE23B78881569228F908DD0746ABE3C46E95A348
Malicious:	false
Preview:	@ECHO OFF..SETLOCAL....COLOR F0..MODE CON: COLS=76 LINES=15....SET "version=3.0.4"..::SET "version=%version% b.ta"....TITLE Mes Drivers %version%....SET "dossier=%TMP%\"....IF EXIST "%dossier%mes_drivers_update" (DEL /F "%dossier%mes_drivers_update")....VER \| FINDSTR /I /R /C:"version 5\.[0-1]\." > NUL 2>&1..IF %ERRORLEVEL% EQU 0 (SET "waitfor=waitfor_x86.exe") ELSE (SET "waitfor=WAITFOR")....SET "titre=TousLesDrivers.com - Mes Drivers - %version%"..SET "message_1=Etape 1/4 - Recherche d'une nouvelle version de l'application..."..SET "message_2=Etape 2/4 - D.tection de la configuration syst.me..."..SET "message_3=Etape 3/4 - D.tection des composants mat.riels et des drivers install.s..."..SET "message_4=Etape 4/4 - Envoi des informations au serveur TousLesDrivers.com..."..SET "message_update_1=Cette version de l'application n'est plus . jour."..SET "message_update_2=T.l.chargez la derni.re version sur www.TousLesDrivers.com"..SET "message_error=Erreur fatale"..SET "message_attente=Merc

C:\Users\user\AppData\Local\Temp\interface.lnk Download File
Process:	C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Jul 7 22:18:15 2021, mtime=Wed Jul 7 22:18:15 2021, atime=Wed Jul 7 22:18:15 2021, length=2669, window=hide
Category:	dropped
Size (bytes):	1947
Entropy (8bit):	3.6394959900450687
Encrypted:	false
SSDEEP:	24:8C2/kFJNMGAZREgKDbmM4m2yAfo8KYbOPYCTp7aB6m:8v/kF7AZR+6MXufo8vCEB6
MD5:	5A67FBC6C1C047B2548C6B2ADD486510
SHA1:	8A35A359AD9987D3B599FA00E502078D7D3E7431
SHA-256:	95D4DD8CE16C7F44BBE46DDCBE2A71F6D23A2D9B5E85CE7F8F234BF73AD767AE
SHA-512:	B3BF54845F70811FF9CDBD8B66F988DA744EA0367BBF899E8BB1C53EC9BBE1195132594E0133576A771AD1DDEBCBB48264E9058648617E42E1CBFA012F02F36E
Malicious:	false
Preview:	L..................F.@.. ....q.\.s...q.\.s...q.\.s..m.........................:..DG..Yr?.D..U..k0.&...&...........-.....8...8p.].s......t...CFSF..1......NM...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......NM..RB......Y.....................R..A.p.p.D.a.t.a...B.P.1.....>Qbu..Local.<.......NM..RB......Y...................../..L.o.c.a.l.....N.1......RC...Temp..:.......NM..RC......Y......................A.T.e.m.p.....h.2.m....RH. .INTERF~1.CMD..L.......RH..RH.....:S....................,.n.i.n.t.e.r.f.a.c.e...c.m.d......._...............-.......^..............g.....C:\Users\user\AppData\Local\Temp\interface.cmd......\.i.n.t.e.r.f.a.c.e...c.m.d.#.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.-.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.D.e.s.k.t.o.p.\.M.e.s._.D.r.i.v.e.r.s._.3...0...4...e.x.e.........%USERPROFILE%\Desktop\Mes_Drivers_3.0.4.exe................................................................................................................................

C:\Users\user\AppData\Local\Temp\waitfor_x86.exe Download File
Process:	C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.771125779123941
Encrypted:	false
SSDEEP:	768:ZQ1aoTfPUGS21Rux8NVB/QA6I1uZXs8f0XUwpBq4pjC0uIr3HX:+1Tr8ovpQA6I1isiTEB8Ir33
MD5:	DD8C73BDCF2077B82DBB6DDD8ECB6A6D
SHA1:	34D59EAFBC485052C5BD5C61697FCCC3D0878D5B
SHA-256:	C3370E8EC5CA54E8FD7EAC19C278689CF122EDAC91FAA4376DC24B1D807FE510
SHA-512:	8E01822020C34B9F08BF01CB64FCCEBE03709797C4B2350C3E14DC174D2B8CD0A7D46A1108409DFEEFAFED13F30B8E217E55F6A47E791868EE60C14F774482D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J..u...&...&...&...&...&..&...&...&g..&..&...&..&...&..&...&..&...&Rich...&................PE..L......>.................h...*......0%..............................................&\........... .......................... o..........8&..............................................................@...P........................................text....g.......h.................. ..`.data................l..............@....rsrc...8&.......(...n..............@..@.$.>X....$.>e....$.>o....$.>z....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.USER32.dll.NETAPI32.dll.WS2_32.dll.SHLWAPI.dll.MPR.dll.Secur32.dll.VERSION.dll................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\waitfor_x86_2.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\detection.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.771125779123941
Encrypted:	false
SSDEEP:	768:ZQ1aoTfPUGS21Rux8NVB/QA6I1uZXs8f0XUwpBq4pjC0uIr3HX:+1Tr8ovpQA6I1isiTEB8Ir33
MD5:	DD8C73BDCF2077B82DBB6DDD8ECB6A6D
SHA1:	34D59EAFBC485052C5BD5C61697FCCC3D0878D5B
SHA-256:	C3370E8EC5CA54E8FD7EAC19C278689CF122EDAC91FAA4376DC24B1D807FE510
SHA-512:	8E01822020C34B9F08BF01CB64FCCEBE03709797C4B2350C3E14DC174D2B8CD0A7D46A1108409DFEEFAFED13F30B8E217E55F6A47E791868EE60C14F774482D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J..u...&...&...&...&...&..&...&...&g..&..&...&..&...&..&...&..&...&Rich...&................PE..L......>.................h...*......0%..............................................&\........... .......................... o..........8&..............................................................@...P........................................text....g.......h.................. ..`.data................l..............@....rsrc...8&.......(...n..............@..@.$.>X....$.>e....$.>o....$.>z....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.USER32.dll.NETAPI32.dll.WS2_32.dll.SHLWAPI.dll.MPR.dll.Secur32.dll.VERSION.dll................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF085E27A7477E5391.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	37347
Entropy (8bit):	0.8254349064808411
Encrypted:	false
SSDEEP:	192:kBqoxKYQ1Q5QSQnKQdKQVQnQBQSQ2y+89MVcKJQXs/M:kBqoxKYqGtYKyKKQuN5IM6XsU
MD5:	EDD41FC06BF8A21DCF9C4CA190C3CB72
SHA1:	6DF7968465B8388D4A7D5DFE7C694CBB1113C7BA
SHA-256:	4AB3F27326EC6714FEB54A5EAD1CA2A12537DC49D2186161F95D270847AF1893
SHA-512:	6CD58CC5465A598F3E793DC7C12EF83AE7830935404BE55F869A9F97A4106BFA91F2E404ECD513460BE9A305B31C905116F0AE153A7EB076C91DF5E5B3BBC892
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF64AAEB065551F5B2.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12965
Entropy (8bit):	0.4181458623307724
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loeI9loeY9lWeDKIkNkYKQII2:kBqoIejeVeGIkNkYTII2
MD5:	FDDB2C34C8D8854EC0A0B438C2836284
SHA1:	0BB28171D280454C46BF468AB91B27BE6C420C17
SHA-256:	BA4FCA736A2075E91B07B932523A8D2B141B8C5102E097882C2B1111EACEBB97
SHA-512:	EA5DFB8140252D67FB3D7FB46A59E8D85A5F378E4EE7A8956254F6173A077F84BF27018889A5BF204EDDE0C507973AE9134A5C574CE1F9CECD7E1C25B716D764
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.80639394183153
TrID:	Win32 Executable (generic) a (10002005/4) 99.40% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	Mes_Drivers_3.0.4.exe
File size:	1624440
MD5:	50a5e891da27e63d54e68511e48aa026
SHA1:	87073d85a7ba420b15c8bb9a9e4adc64db2bcfef
SHA256:	0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6
SHA512:	6df8811e3e1f6a4110ca3b7c498af13898b46962a30888879180b2f11dda24344a1de4807663d46dd86f7ea11855d08137980cc85fe71e688d082f2f79994909
SSDEEP:	24576:AfHFw5b9DOnFYrv+kjqipUompMEoNMDYSkbDknoI6JK+ZYtEi8ETtAM5B:sjFYrv+kjV45oeYSRnyJhOtEVcf5B
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	03894ca5a5c1e074

Static PE Info

General
Entrypoint:	0x45678c
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x57D32BF4 [Fri Sep 9 21:39:00 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	1d58845e01168b11e8fe1f814f39f398

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	11/30/2016 4:00:00 PM 12/1/2017 3:59:59 PM
Subject Chain	CN=Tous Les Drivers, OU=IT, O=Tous Les Drivers, STREET=75 avenue de Marseille, L=Vitrolles, S=Bouches-du-RhÃ´ne, PostalCode=13127, C=FR
Version:	3
Thumbprint MD5:	9FCA37DC296D67356D8D08964CD71785
Thumbprint SHA-1:	48171D12F1CC636CEC19B926648D3CA247711D48
Thumbprint SHA-256:	70833935EE77C609DAFC1CF8395D3E99A1D44ED204943FB57D375B1F3AFF8343
Serial:	4513E8E5C8BBB6D79305E44A01921076

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
mov ecx, 00000006h
push 00000000h
push 00000000h
dec ecx
jne 00007F3C4CAFFD3Bh
push ecx
push ebx
push esi
push edi
mov eax, 00451AF0h
call 00007F3C4CAB36E4h
xor eax, eax
push ebp
push 00456C06h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor eax, eax
mov dword ptr [0045F080h], eax
mov eax, dword ptr [00458934h]
xor edx, edx
mov dword ptr [eax], edx
mov bl, 01h
xor eax, eax
push ebp
push 00456801h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00456C24h
push 0000000Ah
mov ecx, dword ptr [00458A24h]
mov ecx, dword ptr [ecx]
mov dl, 01h
mov eax, dword ptr [00433D40h]
call 00007F3C4CAE6A4Bh
mov dword ptr [0045F080h], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007F3C4CAFFD58h
jmp 00007F3C4CAAEF43h
xor ebx, ebx
mov eax, dword ptr [0045F080h]
call 00007F3C4CAAE34Fh
call 00007F3C4CAAF44Eh
test bl, bl
je 00007F3C4CB00102h
mov dl, 01h
mov eax, dword ptr [00450778h]
call 00007F3C4CAF9D6Ah
mov dword ptr [0045F078h], eax
mov eax, dword ptr [0045F078h]
mov byte ptr [eax+04h], 00000000h
mov eax, dword ptr [0045F078h]
mov byte ptr [eax+05h], 00000001h
mov eax, dword ptr [0045F078h]
add eax, 08h
mov edx, 00456C44h
call 00007F3C4CAAFF29h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x60000	0x1486	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6e000	0x13029c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x189a00	0x2f78	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x65000	0x0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x64000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6044c	0x30c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x62000	0x154	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x54bac	0x54c00	False	0.41686255531	data	6.34358551635	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.itext	0x56000	0xcd0	0xe00	False	0.561383928571	data	5.76394574755	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x57000	0x1c90	0x1e00	False	0.377213541667	data	3.91882656946	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.bss	0x59000	0x6098	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x60000	0x1486	0x1600	False	0.323686079545	MIPSEB-LE MIPS-III ECOFF executable stripped - version 0.6	4.84798937347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.didata	0x62000	0x154	0x200	False	0.30859375	data	2.41945210787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x63000	0x10	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x64000	0x18	0x200	False	0.05078125	data	0.206920017787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x65000	0x80a8	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x6e000	0x13029c	0x130400	False	0.954636786154	data	7.98099551661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
TYPELIB	0x6e420	0x204c	data
RT_ICON	0x7046c	0xca8	data
RT_STRING	0x71114	0x38	data
RT_STRING	0x7114c	0x6f8	data
RT_STRING	0x71844	0x32c	data
RT_STRING	0x71b70	0x388	data
RT_STRING	0x71ef8	0x3a4	data
RT_STRING	0x7229c	0x148	data
RT_STRING	0x723e4	0xcc	data
RT_STRING	0x724b0	0x204	data
RT_STRING	0x726b4	0x39c	data
RT_STRING	0x72a50	0x368	data
RT_STRING	0x72db8	0x2b8	data
RT_RCDATA	0x73070	0x12acd2	data
RT_GROUP_ICON	0x19dd44	0x14	data
RT_VERSION	0x19dd58	0x33c	data	English	United States
RT_MANIFEST	0x19e094	0x205	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	MessageBoxA, CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, lstrcpynW, VirtualQuery, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, GetCurrentThreadId, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	SetWindowLongW, GetWindowLongW, CreateWindowExW, UnregisterClassW, TranslateMessage, SetTimer, RegisterClassW, PostThreadMessageW, PeekMessageW, MessageBoxW, LoadStringW, KillTimer, GetSystemMetrics, GetClassInfoW, DispatchMessageW, DestroyWindow, DefWindowProcW, CharUpperBuffW, CharUpperW
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQueryEx, VirtualQuery, VirtualFree, VirtualAlloc, SizeofResource, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, LockResource, LocalFree, LoadResource, LoadLibraryW, IsValidLocale, GetVersionExW, GetUserDefaultLCID, GetTickCount, GetThreadLocale, GetTempPathW, GetSystemDefaultLCID, GetStdHandle, GetShortPathNameW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileAttributesW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchangeAdd, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageW, FindResourceW, FindFirstFileW, FindClose, EnumSystemLocalesW, EnumCalendarInfoW, DeleteFileW, CreateFileW, CreateEventW, CompareStringW, CloseHandle
advapi32.dll	RegSetValueExW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, DispGetIDsOfNames, RegisterTypeLib, LoadTypeLibEx, SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, SysFreeString
ole32.dll	CreateBindCtx, CoTaskMemFree, CLSIDFromProgID, StringFromCLSID, CoCreateInstance, CoLockObjectExternal, CoDisconnectObject, CoRevokeClassObject, CoRegisterClassObject, CoUninitialize, CoInitialize, IsEqualGUID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
URLMON.DLL	MkParseDisplayNameEx
shell32.dll	SHGetSpecialFolderPathW

Version Infos

Description	Data
LegalCopyright	Copyright 2016 Tous Les Drivers - Tous droits rservs
InternalName
FileVersion	3. 0. 4. 0
CompanyName	Tous Les Drivers
LegalTrademarks
Comments
ProductName	Mes Drivers
ProductVersion	3. 0. 4. 0
FileDescription	Mes Drivers
OriginalFilename
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 7, 2021 16:18:20.480421066 CEST	49718	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:18:20.540138960 CEST	443	49718	85.31.204.81	192.168.2.5
Jul 7, 2021 16:18:20.540363073 CEST	49718	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:18:20.559083939 CEST	49718	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:18:20.619585037 CEST	443	49718	85.31.204.81	192.168.2.5
Jul 7, 2021 16:18:20.619623899 CEST	443	49718	85.31.204.81	192.168.2.5
Jul 7, 2021 16:18:20.619651079 CEST	443	49718	85.31.204.81	192.168.2.5
Jul 7, 2021 16:18:20.619668961 CEST	443	49718	85.31.204.81	192.168.2.5
Jul 7, 2021 16:18:20.619987965 CEST	49718	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:18:20.809349060 CEST	49718	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:18:20.870106936 CEST	443	49718	85.31.204.81	192.168.2.5
Jul 7, 2021 16:18:20.886295080 CEST	49718	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:18:20.943873882 CEST	443	49718	85.31.204.81	192.168.2.5
Jul 7, 2021 16:18:20.944575071 CEST	49718	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:18:20.944601059 CEST	49718	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:18:21.001641989 CEST	443	49718	85.31.204.81	192.168.2.5
Jul 7, 2021 16:18:21.001687050 CEST	443	49718	85.31.204.81	192.168.2.5
Jul 7, 2021 16:18:21.001890898 CEST	49718	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.425966978 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.483319998 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.483565092 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.529664993 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.590296984 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.590333939 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.590358019 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.590517044 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.590547085 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.590701103 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.599939108 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.661529064 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.694638968 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.751827002 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.752733946 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.759641886 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.819139957 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.819286108 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.819442987 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.819480896 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.819520950 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.819679976 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.819789886 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.819895983 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.838443995 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.876914024 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.877105951 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.877245903 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.877397060 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.953710079 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:34.954535961 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:34.954673052 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:35.013068914 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:35.013091087 CEST	443	49734	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:35.013262033 CEST	49734	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.333246946 CEST	49735	80	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.333874941 CEST	49736	80	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.390886068 CEST	80	49735	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.390923023 CEST	80	49736	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.391021013 CEST	49735	80	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.391068935 CEST	49736	80	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.407059908 CEST	49735	80	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.464884043 CEST	80	49735	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.465008974 CEST	49735	80	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.483196974 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.542851925 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.543082952 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.554483891 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.614872932 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.614932060 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.614969015 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.615041018 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.615087032 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.615093946 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.652616024 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.659405947 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.714837074 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.715034962 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.745074034 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.805619001 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.805707932 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.805747986 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.805753946 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.805804014 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.805814981 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.805831909 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.805876970 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.805891991 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.805949926 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.806016922 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.806032896 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.864624023 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.864690065 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:38.864818096 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.864856005 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.955403090 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:38.956854105 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.012830019 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.012890100 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.012932062 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.012969017 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.013019085 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.013066053 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.013076067 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.013082981 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.014163017 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.014276981 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.033080101 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.036228895 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.042767048 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.043401957 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.064316034 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.070888042 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.070971012 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.071815968 CEST	49736	80	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.072887897 CEST	49735	80	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.076987028 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.077045918 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.077059031 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.092046022 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.092178106 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.092680931 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.094165087 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.094238043 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.094316959 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.094376087 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.095166922 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.095278978 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.109111071 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.109124899 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.109199047 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.111888885 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.112195015 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.112498999 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.123302937 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.123343945 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.123423100 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.123492002 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.123492956 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.123543024 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.123613119 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.123661995 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.123692036 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.123764992 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.123800039 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.123881102 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.123923063 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.123944044 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.123971939 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.123996973 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.128546953 CEST	80	49736	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.129535913 CEST	80	49735	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.129595995 CEST	49735	80	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.130407095 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.130490065 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.134650946 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.134679079 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.134697914 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.134816885 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.134834051 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.136049986 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.138781071 CEST	443	49742	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.138911009 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.143981934 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.144078016 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.144285917 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.150017023 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.150106907 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.150433064 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.150526047 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.151854992 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.151978016 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.154125929 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.154328108 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.154793978 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.159707069 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.159754992 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.159774065 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.159789085 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.159832001 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.159913063 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.160054922 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.160094023 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.160113096 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.160123110 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.160135031 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.160176992 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.166234970 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.166347027 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.166840076 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.169418097 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.169464111 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.169511080 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.169531107 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.169550896 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.169594049 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.169725895 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.169774055 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.176146984 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.192126989 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.192650080 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.195235968 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.195291042 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.195374966 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.195415974 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.198626041 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.198674917 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.198733091 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.198767900 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.200979948 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.201093912 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.201118946 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.201191902 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.203461885 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.203917027 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.203991890 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.204463005 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.208992004 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.209148884 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.210701942 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.211379051 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.211422920 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.211513996 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.213418007 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.214764118 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.218277931 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.218286037 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.218672037 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.219629049 CEST	443	49742	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.222830057 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.222829103 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.223186970 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.223701000 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.224246025 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.224272966 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.224288940 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.224320889 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.224390984 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.227288961 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.227333069 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.227437019 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.227452993 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.227475882 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.227493048 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.227505922 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.227544069 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.229965925 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.231964111 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.234476089 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.238750935 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.239289999 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.240354061 CEST	443	49742	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.240375996 CEST	443	49742	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.240387917 CEST	443	49742	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.240432978 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.240479946 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.240607977 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.240917921 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.241264105 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.244357109 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.244930029 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.244971037 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.253371954 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.253549099 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.253710985 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.253779888 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.257687092 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.257864952 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.257890940 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.257944107 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.257973909 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.261053085 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.261177063 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.261248112 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.261823893 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.261852980 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.261903048 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.261924982 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.263802052 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.263819933 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.263830900 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.263897896 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.263910055 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.263950109 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.263987064 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.267745972 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.267904997 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.269197941 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.269294977 CEST	443	49752	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.269309044 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.269315958 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.269323111 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.269407988 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.269413948 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.270433903 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:39.270766973 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.270853043 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.273591995 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.274938107 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.276209116 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.280904055 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.280919075 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.281019926 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.281059980 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.282247066 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.283299923 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.283319950 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.283334970 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.283423901 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.283432961 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.283468962 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.283490896 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.284836054 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.284871101 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.285665035 CEST	49747	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.285893917 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.287321091 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.289848089 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.290131092 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.290152073 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.290213108 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.290374041 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.291621923 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.291731119 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.292352915 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.294408083 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.294424057 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.294445038 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.294470072 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.294492960 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.294507980 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.294511080 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.294524908 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.294527054 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.294559002 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.294939041 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.295006990 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.295238018 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.295298100 CEST	49748	443	192.168.2.5	104.26.7.39
Jul 7, 2021 16:19:39.296315908 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.296335936 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.296400070 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.296427965 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.298046112 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.298327923 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.298342943 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.298422098 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.298446894 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.298568010 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.298588991 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.298636913 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.298682928 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.299937010 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.300000906 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.305058956 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.305679083 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.309254885 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.310084105 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.312232018 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.324728966 CEST	443	49747	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.331465960 CEST	443	49752	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.331554890 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.331881046 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.332767963 CEST	443	49752	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.332803965 CEST	443	49752	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.332829952 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.332858086 CEST	443	49752	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.332870007 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.332894087 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.332906961 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.333606958 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.334444046 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.334471941 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.334489107 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.334537983 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.334573030 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.335356951 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.335383892 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.335398912 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.335418940 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.335438967 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.335486889 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.339565039 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.339601040 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.339660883 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.339698076 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.342256069 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.343169928 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.343713045 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.343744040 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.343803883 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.343837023 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.343852997 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.344105959 CEST	443	49742	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.344176054 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.344214916 CEST	443	49742	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.344281912 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.345312119 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.345333099 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.345403910 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.345432043 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.345509052 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.345676899 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.347970963 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.348001003 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.348042965 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.348068953 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.348779917 CEST	443	49748	104.26.7.39	192.168.2.5
Jul 7, 2021 16:19:39.349522114 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.349612951 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.349633932 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.349708080 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.349750996 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.349770069 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.349787951 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.349807024 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.349848032 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.349865913 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.354562998 CEST	443	49742	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.354681969 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.355077028 CEST	49742	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.357939959 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.358042955 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.359622955 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:39.359656096 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.359682083 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.359740019 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.359760046 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.361376047 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.361732006 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.361767054 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.361804008 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.361826897 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.363420010 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.363447905 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.363512039 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.363528013 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.363554001 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.363583088 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.365942955 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.365983009 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.366008043 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.366027117 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.367218971 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.367590904 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.367897034 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.367925882 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.367975950 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.368029118 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.376703978 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.390577078 CEST	443	49752	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.390614033 CEST	443	49752	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.390688896 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.390732050 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.391088963 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.391155005 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.391156912 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.391215086 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.391309023 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.391338110 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.391367912 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.391415119 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.392179966 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.392239094 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.392374039 CEST	443	49752	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.392431974 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.394311905 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.394342899 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.394371033 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.394402027 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.394488096 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.394562006 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.395916939 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.395962000 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.395981073 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.396003962 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.398042917 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.398083925 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.398117065 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.398134947 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.415643930 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.415740013 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.415781021 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.415813923 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.419061899 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.419109106 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.419164896 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.419433117 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.428498030 CEST	443	49742	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.446114063 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.446391106 CEST	49752	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.447035074 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.447299004 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.452513933 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.457726955 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.467885971 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.468384981 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.470079899 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.474009037 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.494616985 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.497900963 CEST	443	49752	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.509768963 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.509819031 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.509896040 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.510694027 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.510745049 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.512459040 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.515224934 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.515266895 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.515388966 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.515484095 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.525211096 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.525253057 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.525324106 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.525347948 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.525471926 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.525543928 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.525592089 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.525650978 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.527179956 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.527215958 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.527261019 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.527287960 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.530983925 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.531258106 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.540472984 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.543387890 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.544783115 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.545303106 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.546215057 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.569730997 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.569777966 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.569813967 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.569833994 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.569849968 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.569880009 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.571760893 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.572056055 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.580131054 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.600461960 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.600562096 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.602272987 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.603154898 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.603194952 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.603281975 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.603321075 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.604724884 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.604763985 CEST	443	49738	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.604816914 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.604847908 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.604866028 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.604918957 CEST	49738	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.604947090 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.604988098 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.606357098 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.606399059 CEST	443	49744	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.606466055 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.606497049 CEST	49744	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.614084005 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.615444899 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.631341934 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.631392956 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.631423950 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.631438971 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.631472111 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.634310007 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.642594099 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.662410021 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.662477016 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.662555933 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.662606001 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.665344954 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.665373087 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.665410042 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.665436983 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.665682077 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.665712118 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.665752888 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.665781975 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.666279078 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.666986942 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.667026997 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.667054892 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.667083025 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.668293953 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.668337107 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.668379068 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.668421030 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.670778990 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.670818090 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.670842886 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.670870066 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.673355103 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.673396111 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.673444986 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.673463106 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.673626900 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.673669100 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.673695087 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.673715115 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.673743963 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.673753023 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.675043106 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.675162077 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.675740957 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.675782919 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.675812006 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.675937891 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.678253889 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.678304911 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.678329945 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.678365946 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.680741072 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.680780888 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.680808067 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.680830956 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.683233976 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.683278084 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.683322906 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.683348894 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.685714006 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.685765028 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.685805082 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.685831070 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.688199043 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.688241959 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.688290119 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.688318968 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.690685987 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.690736055 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.690764904 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.690824032 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.693180084 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.693221092 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.693247080 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.693279028 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.695677042 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.695719957 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.695760965 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.695815086 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.698160887 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.698204994 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.698246956 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.698375940 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.700670958 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.700715065 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.700771093 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.701973915 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.725109100 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.725162983 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.725191116 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.725244045 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.726274014 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.726315975 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.726349115 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.726376057 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.728861094 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.728903055 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.728962898 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.728986025 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.731419086 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.731451988 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.731533051 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.731556892 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.733896971 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.733944893 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.733995914 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.734031916 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.736392021 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.736435890 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.736449003 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.736486912 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.738758087 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.738797903 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.738848925 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.738872051 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.741259098 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.741306067 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.741353035 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.741372108 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.743710995 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.743762016 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.743793964 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.743815899 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.746220112 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.746263027 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.746294022 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.746321917 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.748697996 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.748765945 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.748771906 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.748830080 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.751255035 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.751344919 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.751384974 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.751425028 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.753706932 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.753762007 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.753799915 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.753829956 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.756140947 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.756184101 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.756277084 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.756311893 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.758495092 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.758541107 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.758616924 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.758861065 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.760576010 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.760632038 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.760695934 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.760751963 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.762680054 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.762722015 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.762777090 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.762794971 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.764699936 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.764751911 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.764771938 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.764821053 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.766712904 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.766767025 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.766773939 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.766809940 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.768733025 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.768771887 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.768783092 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.768829107 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.770693064 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.770737886 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.770746946 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.770787954 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.772651911 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.772700071 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.772701979 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.772758961 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.774715900 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.774759054 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.774768114 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.774802923 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.776673079 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.776719093 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.776734114 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.776756048 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.778690100 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.778753042 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.778776884 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.778830051 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.780616045 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.780673981 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.780679941 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.780721903 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.782649040 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.782716036 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.782716990 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.782777071 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.784594059 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.784636974 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.784651041 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.784676075 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.786571026 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.786612988 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.786619902 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.786655903 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.788589954 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.788646936 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.788666964 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.788696051 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.790564060 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.790611029 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.790640116 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.790673971 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.797460079 CEST	49743	443	192.168.2.5	142.250.180.226
Jul 7, 2021 16:19:39.856065035 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.864707947 CEST	443	49743	142.250.180.226	192.168.2.5
Jul 7, 2021 16:19:39.870138884 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.872438908 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.873493910 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.889971018 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.906217098 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.906265020 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.906328917 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.906399965 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.907972097 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.908005953 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.908093929 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.911485910 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.911520958 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.911602020 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.911644936 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.914834023 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.914865971 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.914942980 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.914977074 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.917860031 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:39.917876005 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:39.918345928 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.918386936 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.918432951 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.918508053 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.921781063 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.921823978 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.921881914 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.921926975 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.925332069 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.925395012 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.925493956 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.925537109 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.927503109 CEST	443	49737	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.927634954 CEST	49737	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.928698063 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.928742886 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.928791046 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.929033041 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.929397106 CEST	443	49746	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.929475069 CEST	49746	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.930401087 CEST	443	49745	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.930488110 CEST	49745	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.932137966 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.932188034 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.932226896 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.932256937 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.935612917 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.935739994 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.947348118 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:39.947422028 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:39.953587055 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.953618050 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.953708887 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.955275059 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.955296040 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.955377102 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.958754063 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.958782911 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.958831072 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.958862066 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.962176085 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.962208986 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.962266922 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.965606928 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.965630054 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.965713024 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.969055891 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.969084024 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.969135046 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.969167948 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.972523928 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.972554922 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.972611904 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.975963116 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.975991011 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.976035118 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.976057053 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.977487087 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:39.977678061 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:39.977881908 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:39.977967024 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:39.979446888 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.979475021 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.979516029 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.979547977 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.982913017 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.982939959 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.982992887 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.983457088 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:39.983588934 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:39.986439943 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.986463070 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.986514091 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.986540079 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.988996983 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.989027023 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.989114046 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.989193916 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.991837025 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.991862059 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.991905928 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.991930008 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.994616032 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.994647026 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.994695902 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.994716883 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:39.997442007 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.997472048 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:39.997550964 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:40.000281096 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:40.000303030 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:40.000382900 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:40.003086090 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:40.003109932 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:40.003196001 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:40.005934000 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:40.006125927 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:40.006788015 CEST	49751	443	192.168.2.5	35.227.209.167
Jul 7, 2021 16:19:40.046096087 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.046396971 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.061542988 CEST	443	49751	35.227.209.167	192.168.2.5
Jul 7, 2021 16:19:40.067663908 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.067750931 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.067825079 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.067827940 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.067862988 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.067873001 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.067881107 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.067923069 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.067970991 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.067990065 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.068013906 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.068016052 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.068049908 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.068058014 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.068094969 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.068149090 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.075088978 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.075454950 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.075653076 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.083758116 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.094069004 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.126168966 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.126261950 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.126341105 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.126416922 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.126451015 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.126476049 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.126478910 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.129097939 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.130021095 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.130100012 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.130614042 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.130688906 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.138726950 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.138777018 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.138816118 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.138878107 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.138907909 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.138920069 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.140232086 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.140315056 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.144326925 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.144356012 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.144398928 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.144442081 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.145239115 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.154817104 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.157109976 CEST	49756	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.175568104 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.177090883 CEST	49755	443	192.168.2.5	216.58.214.194
Jul 7, 2021 16:19:40.190932989 CEST	443	49755	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.211944103 CEST	443	49756	216.58.214.194	192.168.2.5
Jul 7, 2021 16:19:40.426322937 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:40.483843088 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:40.483884096 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:40.483911991 CEST	443	49739	85.31.204.81	192.168.2.5
Jul 7, 2021 16:19:40.483926058 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:40.483969927 CEST	49739	443	192.168.2.5	85.31.204.81
Jul 7, 2021 16:19:44.319806099 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:44.319897890 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:44.319972038 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:44.320014000 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:44.320468903 CEST	49741	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:44.325774908 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:44.325814009 CEST	443	49740	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:44.325890064 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:44.325923920 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:44.326160908 CEST	49740	443	192.168.2.5	46.105.202.207
Jul 7, 2021 16:19:44.369843006 CEST	443	49741	46.105.202.207	192.168.2.5
Jul 7, 2021 16:19:44.375830889 CEST	443	49740	46.105.202.207	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 7, 2021 16:18:08.084530115 CEST	52441	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:08.130726099 CEST	53	52441	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:09.334423065 CEST	62176	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:09.382443905 CEST	53	62176	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:09.485014915 CEST	59596	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:09.555056095 CEST	53	59596	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:10.440381050 CEST	65296	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:10.495359898 CEST	53	65296	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:11.646542072 CEST	63183	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:11.694940090 CEST	53	63183	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:13.035132885 CEST	60151	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:13.081505060 CEST	53	60151	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:14.139647961 CEST	56969	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:14.185878038 CEST	53	56969	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:15.339871883 CEST	55161	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:15.386109114 CEST	53	55161	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:16.529110909 CEST	54757	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:16.584440947 CEST	53	54757	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:17.950264931 CEST	49992	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:17.996478081 CEST	53	49992	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:20.389908075 CEST	60075	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:20.444008112 CEST	53	60075	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:20.647758007 CEST	55016	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:20.696362019 CEST	53	55016	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:36.161525965 CEST	53813	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:36.220650911 CEST	53	53813	8.8.8.8	192.168.2.5
Jul 7, 2021 16:18:40.911262989 CEST	63732	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:18:40.967371941 CEST	53	63732	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:03.852724075 CEST	57344	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:03.909598112 CEST	53	57344	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:08.766072989 CEST	54450	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:08.833605051 CEST	53	54450	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:16.703607082 CEST	59261	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:16.775482893 CEST	53	59261	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:22.148367882 CEST	57151	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:22.204935074 CEST	53	57151	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:34.233503103 CEST	56432	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:34.289171934 CEST	53	56432	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:37.000659943 CEST	61004	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:37.056885958 CEST	53	61004	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:37.108648062 CEST	56895	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:37.166660070 CEST	53	56895	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:38.239557981 CEST	62372	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:38.311676025 CEST	53	62372	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:38.977114916 CEST	61515	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:38.982193947 CEST	56675	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:39.035197020 CEST	57172	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:39.036107063 CEST	53	61515	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:39.037107944 CEST	53	56675	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:39.077255011 CEST	55267	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:39.093420029 CEST	53	57172	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:39.131894112 CEST	53	55267	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:39.151463032 CEST	50969	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:39.200596094 CEST	53	50969	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:39.450536013 CEST	64362	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:39.504690886 CEST	53	64362	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:39.846795082 CEST	54766	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:39.913527966 CEST	53	54766	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:51.669810057 CEST	61446	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:51.727696896 CEST	53	61446	8.8.8.8	192.168.2.5
Jul 7, 2021 16:19:54.833399057 CEST	57515	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:19:54.891074896 CEST	53	57515	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:06.822349072 CEST	58199	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:06.877989054 CEST	53	58199	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:07.828789949 CEST	58199	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:07.875370979 CEST	53	58199	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:07.896188974 CEST	65221	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:07.945730925 CEST	53	65221	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:08.830646038 CEST	58199	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:08.877408028 CEST	53	58199	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:08.892146111 CEST	65221	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:08.949754000 CEST	53	65221	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:09.892213106 CEST	65221	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:09.944355965 CEST	53	65221	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:10.847820044 CEST	58199	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:10.897819042 CEST	53	58199	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:11.907320976 CEST	65221	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:11.964919090 CEST	53	65221	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:14.845395088 CEST	58199	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:14.900710106 CEST	53	58199	8.8.8.8	192.168.2.5
Jul 7, 2021 16:20:15.923302889 CEST	65221	53	192.168.2.5	8.8.8.8
Jul 7, 2021 16:20:15.982098103 CEST	53	65221	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 7, 2021 16:18:20.389908075 CEST	192.168.2.5	8.8.8.8	0xbee	Standard query (0)	www.touslesdrivers.com	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:34.233503103 CEST	192.168.2.5	8.8.8.8	0x6df	Standard query (0)	www.touslesdrivers.com	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:37.108648062 CEST	192.168.2.5	8.8.8.8	0xf631	Standard query (0)	www.touslesdrivers.com	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:38.239557981 CEST	192.168.2.5	8.8.8.8	0x3ddd	Standard query (0)	www.touslesdrivers.com	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:38.977114916 CEST	192.168.2.5	8.8.8.8	0x5a92	Standard query (0)	ads.sportslocalmedia.com	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:38.982193947 CEST	192.168.2.5	8.8.8.8	0x30ac	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.035197020 CEST	192.168.2.5	8.8.8.8	0xeafa	Standard query (0)	tags.smilewanted.com	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.151463032 CEST	192.168.2.5	8.8.8.8	0x6328	Standard query (0)	cdn.appconsent.io	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.846795082 CEST	192.168.2.5	8.8.8.8	0xb80d	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 7, 2021 16:18:20.444008112 CEST	8.8.8.8	192.168.2.5	0xbee	No error (0)	www.touslesdrivers.com	srv1.touslesdrivers.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 16:18:20.444008112 CEST	8.8.8.8	192.168.2.5	0xbee	No error (0)	srv1.touslesdrivers.com		85.31.204.81	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:34.289171934 CEST	8.8.8.8	192.168.2.5	0x6df	No error (0)	www.touslesdrivers.com	srv1.touslesdrivers.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 16:19:34.289171934 CEST	8.8.8.8	192.168.2.5	0x6df	No error (0)	srv1.touslesdrivers.com		85.31.204.81	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:37.166660070 CEST	8.8.8.8	192.168.2.5	0xf631	No error (0)	www.touslesdrivers.com	srv1.touslesdrivers.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 16:19:37.166660070 CEST	8.8.8.8	192.168.2.5	0xf631	No error (0)	srv1.touslesdrivers.com		85.31.204.81	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:38.311676025 CEST	8.8.8.8	192.168.2.5	0x3ddd	No error (0)	www.touslesdrivers.com	srv1.touslesdrivers.com		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 16:19:38.311676025 CEST	8.8.8.8	192.168.2.5	0x3ddd	No error (0)	srv1.touslesdrivers.com		85.31.204.81	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.036107063 CEST	8.8.8.8	192.168.2.5	0x5a92	No error (0)	ads.sportslocalmedia.com	ads.sportslocalmedia.com.web.cdn.anycast.me		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 16:19:39.036107063 CEST	8.8.8.8	192.168.2.5	0x5a92	No error (0)	ads.sportslocalmedia.com.web.cdn.anycast.me	46-105-202-207.any.cdn.anycast.me		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 16:19:39.036107063 CEST	8.8.8.8	192.168.2.5	0x5a92	No error (0)	46-105-202-207.any.cdn.anycast.me		46.105.202.207	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.037107944 CEST	8.8.8.8	192.168.2.5	0x30ac	No error (0)	securepubads.g.doubleclick.net	partnerad.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jul 7, 2021 16:19:39.037107944 CEST	8.8.8.8	192.168.2.5	0x30ac	No error (0)	partnerad.l.doubleclick.net		142.250.180.226	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.093420029 CEST	8.8.8.8	192.168.2.5	0xeafa	No error (0)	tags.smilewanted.com		104.26.7.39	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.093420029 CEST	8.8.8.8	192.168.2.5	0xeafa	No error (0)	tags.smilewanted.com		172.67.71.185	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.093420029 CEST	8.8.8.8	192.168.2.5	0xeafa	No error (0)	tags.smilewanted.com		104.26.6.39	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.200596094 CEST	8.8.8.8	192.168.2.5	0x6328	No error (0)	cdn.appconsent.io		35.227.209.167	A (IP address)	IN (0x0001)
Jul 7, 2021 16:19:39.913527966 CEST	8.8.8.8	192.168.2.5	0xb80d	No error (0)	googleads.g.doubleclick.net		216.58.214.194	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.touslesdrivers.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49735	85.31.204.81	80	C:\Users\user\AppData\Local\Temp\curl_x64.exe

Timestamp	kBytes transferred	Direction	Data
Jul 7, 2021 16:19:38.407059908 CEST	5945	OUT	GET /index.php?v_page=31&v_id=8KVKWmfznwDbzahM HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.touslesdrivers.com Connection: Keep-Alive
Jul 7, 2021 16:19:38.464884043 CEST	5946	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Location: https://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM Server: HTTP X-Frame-Options: SAMEORIGIN Date: Wed, 07 Jul 2021 14:19:35 GMT Content-Length: 211 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 64 c3 a9 70 6c 61 63 c3 a9 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 74 20 64 c3 a9 70 6c 61 63 c3 a9 3c 2f 68 31 3e 43 65 20 64 6f 63 75 6d 65 6e 74 20 70 65 75 74 20 c3 aa 74 72 65 20 63 6f 6e 73 75 6c 74 c3 a9 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 75 73 6c 65 73 64 72 69 76 65 72 73 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 3f 76 5f 70 61 67 65 3d 33 31 26 61 6d 70 3b 76 5f 69 64 3d 38 4b 56 4b 57 6d 66 7a 6e 77 44 62 7a 61 68 4d 22 3e 69 63 69 3c 2f 61 3e 3c 2f 62 6f 64 79 3e Data Ascii: <head><title>Document dplac</title></head><body><h1>Objet dplac</h1>Ce document peut tre consult <a HREF="https://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM">ici</a></body>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jul 7, 2021 16:19:39.159789085 CEST	46.105.202.207	443	192.168.2.5	49741	CN=ads.slmads.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Fri May 21 17:28:17 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Thu Aug 19 17:28:17 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.159789085 CEST	46.105.202.207	443	192.168.2.5	49741	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.160123110 CEST	46.105.202.207	443	192.168.2.5	49740	CN=ads.slmads.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Fri May 21 17:28:17 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Thu Aug 19 17:28:17 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.160123110 CEST	46.105.202.207	443	192.168.2.5	49740	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.195291042 CEST	104.26.7.39	443	192.168.2.5	49747	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Aug 18 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Wed Aug 18 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.195291042 CEST	104.26.7.39	443	192.168.2.5	49747	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.198674917 CEST	104.26.7.39	443	192.168.2.5	49748	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Aug 18 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Wed Aug 18 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.198674917 CEST	104.26.7.39	443	192.168.2.5	49748	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.224272966 CEST	142.250.180.226	443	192.168.2.5	49743	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jun 22 15:35:18 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Sep 14 15:35:17 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.224272966 CEST	142.250.180.226	443	192.168.2.5	49743	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.240375996 CEST	142.250.180.226	443	192.168.2.5	49742	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jun 22 15:35:18 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Sep 14 15:35:17 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.240375996 CEST	142.250.180.226	443	192.168.2.5	49742	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.332803965 CEST	35.227.209.167	443	192.168.2.5	49752	CN=cdn.appconsent.io CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed May 26 12:09:31 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Tue Aug 24 12:09:31 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.332803965 CEST	35.227.209.167	443	192.168.2.5	49752	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.334471941 CEST	35.227.209.167	443	192.168.2.5	49751	CN=cdn.appconsent.io CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed May 26 12:09:31 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Tue Aug 24 12:09:31 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:39.334471941 CEST	35.227.209.167	443	192.168.2.5	49751	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 7, 2021 16:19:40.067873001 CEST	216.58.214.194	443	192.168.2.5	49755	CN=*.g.doubleclick.net CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Jun 22 15:35:26 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Tue Sep 14 15:35:25 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jul 7, 2021 16:19:40.068058014 CEST	216.58.214.194	443	192.168.2.5	49756	CN=*.g.doubleclick.net CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Jun 22 15:35:26 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Tue Sep 14 15:35:25 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Mes_Drivers_3.0.4.exe PID: 400 Parent PID: 5784

General

Start time:	16:18:14
Start date:	07/07/2021
Path:	C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Mes_Drivers_3.0.4.exe'
Imagebase:	0x400000
File size:	1624440 bytes
MD5 hash:	50A5E891DA27E63D54E68511E48AA026
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000000.218185318.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 1500 Parent PID: 400

General

Start time:	16:18:16
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\cmd.exe' /C START '' 'C:\Users\user\AppData\Local\Temp\interface.lnk'
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 2904 Parent PID: 1500

General

Start time:	16:18:16
Start date:	07/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: detection.exe PID: 5556 Parent PID: 400

General

Start time:	16:18:17
Start date:	07/07/2021
Path:	C:\Users\user\AppData\Local\Temp\detection.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\detection.exe'
Imagebase:	0x400000
File size:	1165312 bytes
MD5 hash:	02BA1C44B6392F013A7AA0B91314F45A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000004.00000003.399944667.00000000009B3000.00000004.00000001.sdmp, Author: Arnim Rupp Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000004.00000003.225305782.000000007FA70000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000004.00000003.401509038.0000000002A78000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000004.00000003.401894830.00000000024D1000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 10%, Metadefender, Browse Detection: 28%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5976 Parent PID: 5556

General

Start time:	16:18:17
Start date:	07/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5064 Parent PID: 1500

General

Start time:	16:18:17
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\interface.cmd' '
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5468 Parent PID: 5064

General

Start time:	16:18:18
Start date:	07/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: mode.com PID: 5624 Parent PID: 5064

General

Start time:	16:18:18
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\mode.com
Wow64 process (32bit):	true
Commandline:	MODE CON: COLS=76 LINES=15
Imagebase:	0x7ff797770000
File size:	27648 bytes
MD5 hash:	D781CD6A6484C276A4D0750D9206A382
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 2588 Parent PID: 5064

General

Start time:	16:18:19
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c' VER '
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: findstr.exe PID: 6040 Parent PID: 5064

General

Start time:	16:18:19
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	FINDSTR /I /R /C:'version 5\.[0-1]\.'
Imagebase:	0x11c0000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: curl_x64.exe PID: 5968 Parent PID: 5556

General

Start time:	16:18:20
Start date:	07/07/2021
Path:	C:\Users\user\AppData\Local\Temp\curl_x64.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request GET 'https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4'
Imagebase:	0x400000
File size:	860232 bytes
MD5 hash:	E80C8CB9887A7C9426D4E843DDDB8A44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: waitfor.exe PID: 2172 Parent PID: 5064

General

Start time:	16:18:20
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\waitfor.exe
Wow64 process (32bit):	true
Commandline:	WAITFOR unlock
Imagebase:	0x910000
File size:	32256 bytes
MD5 hash:	83E921720CA3BD03CF6BF5686E802C3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: waitfor.exe PID: 1012 Parent PID: 5556

General

Start time:	16:18:21
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\waitfor.exe
Wow64 process (32bit):	true
Commandline:	WAITFOR /S DESKTOP-716T771 /SI unlock
Imagebase:	0x910000
File size:	32256 bytes
MD5 hash:	83E921720CA3BD03CF6BF5686E802C3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 5852 Parent PID: 5556

General

Start time:	16:18:28
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	SC query Winmgmt
Imagebase:	0xb60000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: waitfor.exe PID: 2904 Parent PID: 5556

General

Start time:	16:18:30
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\waitfor.exe
Wow64 process (32bit):	true
Commandline:	WAITFOR /S DESKTOP-716T771 /SI unlock
Imagebase:	0x910000
File size:	32256 bytes
MD5 hash:	83E921720CA3BD03CF6BF5686E802C3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: detect_x64.exe PID: 360 Parent PID: 5556

General

Start time:	16:18:34
Start date:	07/07/2021
Path:	C:\Users\user\AppData\Local\Temp\detect_x64.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\detect_x64.exe' driverfiles 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Imagebase:	0x7ff7a7450000
File size:	82432 bytes
MD5 hash:	6A7EC375AF8BA2E87FF7F23497E9944E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: detect_x64.exe PID: 5504 Parent PID: 5556

General

Start time:	16:18:34
Start date:	07/07/2021
Path:	C:\Users\user\AppData\Local\Temp\detect_x64.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\detect_x64.exe' drivernodes 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Imagebase:	0x7ff7a7450000
File size:	82432 bytes
MD5 hash:	6A7EC375AF8BA2E87FF7F23497E9944E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: detect_x64.exe PID: 1012 Parent PID: 5556

General

Start time:	16:18:35
Start date:	07/07/2021
Path:	C:\Users\user\AppData\Local\Temp\detect_x64.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\detect_x64.exe' hwids 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Imagebase:	0x7ff7a7450000
File size:	82432 bytes
MD5 hash:	6A7EC375AF8BA2E87FF7F23497E9944E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: detect_x64.exe PID: 1692 Parent PID: 5556

General

Start time:	16:18:35
Start date:	07/07/2021
Path:	C:\Users\user\AppData\Local\Temp\detect_x64.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\detect_x64.exe' stack 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Imagebase:	0x7ff7a7450000
File size:	82432 bytes
MD5 hash:	6A7EC375AF8BA2E87FF7F23497E9944E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: detect_x64.exe PID: 1704 Parent PID: 5556

General

Start time:	16:18:36
Start date:	07/07/2021
Path:	C:\Users\user\AppData\Local\Temp\detect_x64.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\detect_x64.exe' status 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
Imagebase:	0x7ff7a7450000
File size:	82432 bytes
MD5 hash:	6A7EC375AF8BA2E87FF7F23497E9944E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: waitfor.exe PID: 6812 Parent PID: 5556

General

Start time:	16:19:27
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\waitfor.exe
Wow64 process (32bit):	true
Commandline:	WAITFOR /S DESKTOP-716T771 /SI unlock
Imagebase:	0x910000
File size:	32256 bytes
MD5 hash:	83E921720CA3BD03CF6BF5686E802C3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: aes_x64.exe PID: 7004 Parent PID: 5556

General

Start time:	16:19:32
Start date:	07/07/2021
Path:	C:\Users\user\AppData\Local\Temp\aes_x64.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\aes_x64.exe' -e -p anT^UpFuzpuC@lOvsoPVe2kiNTidaBo<zI]BeaRnU0ResFwAy@dEnuCkUd)hAzOh -o 'C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' -
Imagebase:	0x7ff697680000
File size:	155136 bytes
MD5 hash:	E5125D4651C008EBA61D9FD3ABD5AB31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000024.00000000.386024517.00007FF697695000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: C:\Users\user\AppData\Local\Temp\aes_x64.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: curl_x64.exe PID: 7020 Parent PID: 5556

General

Start time:	16:19:33
Start date:	07/07/2021
Path:	C:\Users\user\AppData\Local\Temp\curl_x64.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\curl_x64.exe' --connect-timeout 5 --max-time 20 --fail --silent --request POST --form 'v_configuration=<C:\Users\user\AppData\Local\Temp\8KVKWmfznwDbzahM\8KVKWmfznwDbzahM' 'https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=8KVKWmfznwDbzahM&v_version=3.0.4'
Imagebase:	0x400000
File size:	860232 bytes
MD5 hash:	E80C8CB9887A7C9426D4E843DDDB8A44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7064 Parent PID: 5556

General

Start time:	16:19:35
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\cmd.exe' /C START '' 'http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM'
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: waitfor.exe PID: 7072 Parent PID: 5556

General

Start time:	16:19:35
Start date:	07/07/2021
Path:	C:\Windows\SysWOW64\waitfor.exe
Wow64 process (32bit):	true
Commandline:	WAITFOR /S DESKTOP-716T771 /SI unlock
Imagebase:	0x910000
File size:	32256 bytes
MD5 hash:	83E921720CA3BD03CF6BF5686E802C3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 7120 Parent PID: 7064

General

Start time:	16:19:36
Start date:	07/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' http://www.touslesdrivers.com/index.php?v_page=31&v_id=8KVKWmfznwDbzahM
Imagebase:	0x7ff69bf80000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 3000 Parent PID: 7120

General

Start time:	16:19:37
Start date:	07/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7120 CREDAT:17410 /prefetch:2
Imagebase:	0x1030000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Mes_Drivers_3.0.4.exe PID: 400 Parent PID: 5784 Mes_Drivers_3.0.4.exeCOMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.5%
Total number of Nodes:	958
Total number of Limit Nodes:	29

Executed Functions

Function 0044C2B0, Relevance: 4.6, APIs: 3, Instructions: 96
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E0044C2B0(char __eax, void* __ebx, intOrPtr* __edx, void* __edi, char __esi) {
				char _v8;
				struct _WIN32_FIND_DATAW _v600;
				char _v604;
				char _v608;
				char _v612;
				void* _t58;
				intOrPtr* _t62;
				intOrPtr _t73;
				void* _t80;
				void* _t85;

				_t81 = __esi;
				_push(__esi);
				_v612 = 0;
				_v608 = 0;
				_v604 = 0;
				_t62 = __edx;
				_v8 = __eax;
				E0040673C(_v8);
				_push(_t85);
				_push(0x44c404);
				_push( *[fs:eax]);
				 *[fs:eax] = _t85 + 0xfffffda0;
				if( *0x458918 == 0) {
					E00406658(_t62);
					while(1) {
						_t80 = FindFirstFileW(E004072B8(_v8),  &_v600);
						if(_t80 == 0xffffffff) {
							break;
						}
						_push(0x44c420);
						E0040734C( &_v604, 0x104,  &(_v600.cFileName));
						_push(_v604);
						_push( *_t62);
						E00407584(_t62, _t62, 3, _t80, _t81);
						E00419A74(_v8,  &_v608);
						E00406A80( &_v8, _v608);
						FindClose(_t80);
						_t81 = _v8;
						if(_t81 != 0) {
							_t81 =  *((intOrPtr*)(_t81 - 4));
						}
						if(_t81 > 2) {
							continue;
						} else {
							L8:
							if( *_t62 != 0) {
								E00419AD4(_v8,  &_v612);
								E004074FC(_t62,  *_t62, _v612);
							}
							L10:
							_pop(_t73);
							 *[fs:eax] = _t73;
							_push(0x44c40b);
							E004066B8( &_v612, 3);
							return E00406658( &_v8);
						}
					}
					E00406658(_t62);
					goto L8;
				}
				E00407424(_t62, 0, 0x105);
				_t58 =  *0x458918(E004072B8(_v8), E00406C18(_t62), 0x104); // executed
				E00407424(_t62, 0, _t58);
				goto L10;
			}

0x0044c2b0
0x0044c2ba
0x0044c2be
0x0044c2c4
0x0044c2ca
0x0044c2d0
0x0044c2d2
0x0044c2d8
0x0044c2df
0x0044c2e0
0x0044c2e5
0x0044c2e8
0x0044c2f2
0x0044c32c
0x0044c331
0x0044c346
0x0044c34b
0x00000000
0x00000000
0x0044c356
0x0044c36c
0x0044c371
0x0044c377
0x0044c380
0x0044c38e
0x0044c39c
0x0044c3a2
0x0044c3a7
0x0044c3ac
0x0044c3b1
0x0044c3b1
0x0044c3b6
0x00000000
0x0044c3bc
0x0044c3bc
0x0044c3bf
0x0044c3ca
0x0044c3d9
0x0044c3d9
0x0044c3de
0x0044c3e0
0x0044c3e3
0x0044c3e6
0x0044c3f6
0x0044c403
0x0044c403
0x0044c3b6
0x0044c34f
0x00000000
0x0044c34f
0x0044c2fb
0x0044c316
0x0044c320
0x00000000

APIs

GetLongPathNameW.KERNELBASE(00000000,00000000,00000104), ref: 0044C316
FindFirstFileW.KERNEL32(00000000,?,00000000,0044C404), ref: 0044C341

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FileFindFirstLongNamePath
String ID:
API String ID: 1502323026-0
Opcode ID: 719a6e42e559144f637aca422b1d939e339a9b974acb50b6df4450421440a699
Instruction ID: 03565896c61021fb2ee898d3b4fd61a94f003fc0cb4358114dae8133a6d1d5c8
Opcode Fuzzy Hash: 719a6e42e559144f637aca422b1d939e339a9b974acb50b6df4450421440a699
Instruction Fuzzy Hash: 7A31E330A052589FDB10EF69CC8669DB3B9AB44304F1044BEF809B3392DB38AE459A59

Uniqueness

Uniqueness Score: -1.00%

Function 00409514, Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00409514(char __eax, void* __ebx, intOrPtr* __edx, void* __eflags) {
				char _v8;
				short _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _t29;
				void* _t40;
				intOrPtr* _t44;
				intOrPtr _t55;
				void* _t61;

				_push(__ebx);
				_v24 = 0;
				_v20 = 0;
				_t44 = __edx;
				_v8 = __eax;
				E0040673C(_v8);
				_push(_t61);
				_push(0x4095d4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t61 + 0xffffffec;
				_t21 =  &_v16;
				L00402834();
				GetLocaleInfoW( &_v16 & 0x0000ffff, 3, _t21, 4);
				E0040734C( &_v20, 4,  &_v16);
				E004074FC(_t44, _v20, _v8);
				_t29 = E004093DC( *_t44, _t44); // executed
				if(_t29 == 0) {
					_v12 = 0;
					E0040734C( &_v24, 4,  &_v16);
					E004074FC(_t44, _v24, _v8);
					_t40 = E004093DC( *_t44, _t44); // executed
					if(_t40 == 0) {
						E00406658(_t44);
					}
				}
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(E004095DB);
				E004066B8( &_v24, 2);
				return E00406658( &_v8);
			}

0x0040951a
0x0040951d
0x00409520
0x00409523
0x00409525
0x0040952b
0x00409532
0x00409533
0x00409538
0x0040953b
0x00409540
0x00409546
0x0040954f
0x0040955f
0x0040956c
0x00409573
0x0040957a
0x0040957c
0x0040958d
0x0040959a
0x004095a1
0x004095a8
0x004095ac
0x004095ac
0x004095a8
0x004095b3
0x004095b6
0x004095b9
0x004095c6
0x004095d3

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,004095D4,?,?), ref: 00409546
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,004095D4,?,?), ref: 0040954F

Part of subcall function 004093DC: FindFirstFileW.KERNEL32(00000000,?,00000000,0040943A,?,00000001), ref: 0040940F
Part of subcall function 004093DC: FindClose.KERNEL32(00000000,00000000,?,00000000,0040943A,?,00000001), ref: 0040941F

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: a5435af2690ed83d03cafef96d5c95a9a92018838943695a9f89185b5a8808e4
Instruction ID: 15de35645d8bf70296df6676663de938cef6acefe7a400a34489ff6f15f698f6
Opcode Fuzzy Hash: a5435af2690ed83d03cafef96d5c95a9a92018838943695a9f89185b5a8808e4
Instruction Fuzzy Hash: 26117570A041099BDB04FB96C992AADB3B9EF48304F51447EB904F33D2DB786E04C669

Uniqueness

Uniqueness Score: -1.00%

Function 004093DC, Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004093DC(char __eax, signed int __ebx) {
				char _v8;
				struct _WIN32_FIND_DATAW _v600;
				void* _t15;
				intOrPtr _t24;
				void* _t27;

				_push(__ebx);
				_v8 = __eax;
				E0040673C(_v8);
				_push(_t27);
				_push(0x40943a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27 + 0xfffffdac;
				_t15 = FindFirstFileW(E004072B8(_v8),  &_v600); // executed
				if((__ebx & 0xffffff00 | _t15 != 0xffffffff) != 0) {
					FindClose(_t15);
				}
				_pop(_t24);
				 *[fs:eax] = _t24;
				_push(E00409441);
				return E00406658( &_v8);
			}

0x004093e5
0x004093e6
0x004093ec
0x004093f3
0x004093f4
0x004093f9
0x004093fc
0x0040940f
0x0040941c
0x0040941f
0x0040941f
0x00409426
0x00409429
0x0040942c
0x00409439

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040943A,?,00000001), ref: 0040940F
FindClose.KERNEL32(00000000,00000000,?,00000000,0040943A,?,00000001), ref: 0040941F

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 7e8eb0037a2d4fec462e2177786a459ad80c2f456b19d1e266322cde48af5052
Instruction ID: df8ede975d1abec706a8734cf00eaa5cc95f46cf04a3a9bd0aebc18cf1da01ee
Opcode Fuzzy Hash: 7e8eb0037a2d4fec462e2177786a459ad80c2f456b19d1e266322cde48af5052
Instruction Fuzzy Hash: 04F0E230548204AEC711FB75CD1284EB3ECEB08318BA105BBB404F32D2E73C9E109518

Uniqueness

Uniqueness Score: -1.00%

Function 00448AA4, Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000001,00000000,00000005,00448B94,00000000,00000000,00448AFF,?,00000000,00448B84,?,?,02406F00,?), ref: 00448AEB

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 751b9ffea23bdc3304942ecf797a50bbc05d7172f2c5f1da137a34141f1a1ef6
Instruction ID: 070b467c0c326727bd3fef0887191de0a453da5b4f1d3c01d230b045e4e7357b
Opcode Fuzzy Hash: 751b9ffea23bdc3304942ecf797a50bbc05d7172f2c5f1da137a34141f1a1ef6
Instruction Fuzzy Hash: 6401F7B06087446EE705DF659C53D6E7BACE749B14F62487FF400E26C1EA3C59108418

Uniqueness

Uniqueness Score: -1.00%

Function 00409F3C, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00409F40

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 892a1458177ddbc30532e121afcf2d17a31201bd759466eadc3da6d18afdee03
Instruction ID: 5f2b6cd9aeb78cadd0574cbfd4c8ed5f84073c06ef25e4bb75ab62456a1477af
Opcode Fuzzy Hash: 892a1458177ddbc30532e121afcf2d17a31201bd759466eadc3da6d18afdee03
Instruction Fuzzy Hash: 72A012148084010BC40CB7194D4340B31801940214FC40325785CA62C2E619856402EF

Uniqueness

Uniqueness Score: -1.00%

Function 0040900C, Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 174
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E0040900C(char __eax, void* __ebx, void* __edx) {
				char _v8;
				char* _v12;
				void* _v16;
				int _v20;
				short _v542;
				long _t51;
				long _t85;
				long _t87;
				long _t89;
				long _t91;
				long _t93;
				void* _t97;
				intOrPtr _t103;
				intOrPtr _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t111;

				_t109 = _t110;
				_t111 = _t110 + 0xfffffde4;
				_t97 = __edx;
				_v8 = __eax;
				E0040673C(_v8);
				_push(_t109);
				_push(0x409231);
				_push( *[fs:eax]);
				 *[fs:eax] = _t111;
				if(_v8 != 0) {
					lstrcpynW( &_v542, E004072B8(_v8), 0x105);
				} else {
					GetModuleFileNameW(0,  &_v542, 0x105);
				}
				if(_v542 == 0) {
					L18:
					_pop(_t103);
					 *[fs:eax] = _t103;
					_push(E00409238);
					return E00406658( &_v8);
				} else {
					_v12 = 0;
					_t51 = RegOpenKeyExW(0x80000001, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
					if(_t51 == 0) {
						L10:
						_push(_t109);
						_push(0x409214);
						_push( *[fs:eax]);
						 *[fs:eax] = _t111;
						E00408E18( &_v542, 0x105);
						if(RegQueryValueExW(_v16,  &_v542, 0, 0, 0,  &_v20) != 0) {
							if(RegQueryValueExW(_v16, E00409324, 0, 0, 0,  &_v20) == 0) {
								_v12 = E00404484(_v20);
								RegQueryValueExW(_v16, E00409324, 0, 0, _v12,  &_v20);
								E00407310(_t97, _v12);
							}
						} else {
							_v12 = E00404484(_v20);
							RegQueryValueExW(_v16,  &_v542, 0, 0, _v12,  &_v20);
							E00407310(_t97, _v12);
						}
						_pop(_t105);
						 *[fs:eax] = _t105;
						_push(E0040921B);
						if(_v12 != 0) {
							E004044A0(_v12);
						}
						return RegCloseKey(_v16);
					} else {
						_t85 = RegOpenKeyExW(0x80000002, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
						if(_t85 == 0) {
							goto L10;
						} else {
							_t87 = RegOpenKeyExW(0x80000001, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
							if(_t87 == 0) {
								goto L10;
							} else {
								_t89 = RegOpenKeyExW(0x80000002, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
								if(_t89 == 0) {
									goto L10;
								} else {
									_t91 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Locales", 0, 0xf0019,  &_v16); // executed
									if(_t91 == 0) {
										goto L10;
									} else {
										_t93 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v16); // executed
										if(_t93 != 0) {
											goto L18;
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				}
			}

0x0040900d
0x0040900f
0x00409016
0x00409018
0x0040901e
0x00409025
0x00409026
0x0040902b
0x0040902e
0x00409035
0x00409061
0x00409037
0x00409045
0x00409045
0x0040906e
0x0040921b
0x0040921d
0x00409220
0x00409223
0x00409230
0x00409074
0x00409076
0x0040908e
0x00409095
0x00409135
0x00409137
0x00409138
0x0040913d
0x00409140
0x0040914e
0x0040916f
0x004091be
0x004091c8
0x004091e0
0x004091ea
0x004091ea
0x00409171
0x00409179
0x00409193
0x0040919d
0x0040919d
0x004091f1
0x004091f4
0x004091f7
0x00409200
0x00409205
0x00409205
0x00409213
0x0040909b
0x004090b0
0x004090b7
0x00000000
0x004090b9
0x004090ce
0x004090d5
0x00000000
0x004090d7
0x004090ec
0x004090f3
0x00000000
0x004090f5
0x0040910a
0x00409111
0x00000000
0x00409113
0x00409128
0x0040912f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040912f
0x00409111
0x004090f3
0x004090d5
0x004090b7
0x00409095

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00409231,?,?), ref: 00409045
lstrcpynW.KERNEL32(?,00000000,00000105,00000000,00409231,?,?), ref: 00409061
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409231,?,?), ref: 0040908E
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409231), ref: 004090B0
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,?), ref: 004090CE
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 004090EC
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040910A
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00409128
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00409214,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,?,00000000), ref: 00409168
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,00409214,?,80000001), ref: 00409193
RegCloseKey.ADVAPI32(?,0040921B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409214,?,80000001,Software\Embarcadero\Locales), ref: 0040920E

Strings

Software\CodeGear\Locales, xrefs: 004090C4, 004090E2
Software\Borland\Locales, xrefs: 00409100
Software\Borland\Delphi\Locales, xrefs: 0040911E
Software\Embarcadero\Locales, xrefs: 00409084, 004090A6

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Open$QueryValue$CloseFileModuleNamelstrcpyn
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 512384800-3496071916
Opcode ID: 40437729ae3c15a0b5a19c8fd79b494f63d2dc7b32d8a7f9a91b2aa39fbf7d76
Instruction ID: 3fe3941f57f47c9320a46739c2cf5f27722e9435ff5171952647e5bc01f72933
Opcode Fuzzy Hash: 40437729ae3c15a0b5a19c8fd79b494f63d2dc7b32d8a7f9a91b2aa39fbf7d76
Instruction Fuzzy Hash: D351F675B4020DBEEB10EA95CD46FAE73BC9B48704F5045BBBA04F61C3D6B8EE408659

Uniqueness

Uniqueness Score: -1.00%

Function 0045678C, Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr* _t44;
				intOrPtr _t92;
				signed int _t96;
				void* _t105;
				intOrPtr _t107;
				intOrPtr* _t110;
				intOrPtr* _t114;
				intOrPtr* _t119;
				void* _t125;
				void* _t177;
				intOrPtr* _t178;
				intOrPtr _t193;
				intOrPtr _t207;
				intOrPtr _t208;
				intOrPtr* _t232;
				intOrPtr _t235;
				intOrPtr* _t236;
				intOrPtr _t241;
				intOrPtr _t249;
				intOrPtr _t254;
				intOrPtr _t255;

				_t269 = __fp0;
				_t252 = __esi;
				_t251 = __edi;
				_t254 = _t255;
				_t177 = 6;
				do {
					_push(0);
					_push(0);
					_t177 = _t177 - 1;
				} while (_t177 != 0);
				_push(_t177);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				E0040A148(0x451af0);
				_push(_t254);
				_push(0x456c06);
				_push( *[fs:eax]);
				 *[fs:eax] = _t255;
				 *0x45f080 = 0;
				_t44 =  *0x458934; // 0x457000
				 *_t44 = 0;
				_push(_t254);
				_push(0x456801);
				_push( *[fs:eax]);
				 *[fs:eax] = _t255;
				_t178 =  *0x458a24; // 0x45903c
				 *0x45f080 = E0043D4F8( *_t178, 1, 0xa, L"RC_SCRIPT");
				_pop(_t207);
				 *[fs:eax] = _t207;
				if(1 == 0) {
					__eflags = 0;
					_pop(_t208);
					 *[fs:eax] = _t208;
					_push(0x456c0d);
					E00406658( &_v56);
					E004066A0( &_v52);
					return E004066B8( &_v48, 6);
				} else {
					 *0x45f078 = E00450850(1);
					 *((char*)( *0x45f078 + 4)) = 0;
					 *((char*)( *0x45f078 + 5)) = 1;
					E00406A38( *0x45f078 + 8, L"ScriptCryptor");
					 *0x45f088 = E0043CB80(1);
					 *0x45f07c = E00404DEC(1);
					 *[fs:edx] = _t255;
					E004509A8( *0x45f078, 1,  *0x45f080, __edi, __esi, 1, __fp0); // executed
					E004508D4( *0x45f078,  *0x45f07c, L"SCRIPT", __edi, _t254);
					E00407424(0x45f084,  *0x45f07c, E00407E34( *((intOrPtr*)( *((intOrPtr*)( *0x45f07c))))( *[fs:edx], 0x456bd1, _t254),  *((intOrPtr*)( *0x45f07c)), 2, 0));
					E00406C18(0x45f084);
					 *((intOrPtr*)( *((intOrPtr*)( *0x45f07c)) + 0xc))( *((intOrPtr*)( *((intOrPtr*)( *0x45f07c))))());
					E0043D3BC( *0x45f07c);
					E004508D4( *0x45f078,  *0x45f07c, L"DATASECTION", __edi, _t254);
					 *((intOrPtr*)( *((intOrPtr*)( *0x45f07c)) + 0x14))();
					 *((intOrPtr*)( *((intOrPtr*)( *0x45f07c)) + 0xc))();
					E0043D3BC( *0x45f07c);
					_t92 =  *0x45eff0; // 0x0
					E00451994(_t92,  &_v28, __esi);
					E00406A38(0x45f090, _v28);
					_t96 =  *0x45f090;
					if(_t96 != 0) {
						_t96 =  *(_t96 - 4);
					}
					if( *((short*)( *0x45f090 + _t96 * 2 - 2)) != 0x5c) {
						E004074A4(0x45f090, 0x456cac);
					}
					E004508D4( *0x45f078,  *0x45f07c, L"RESOURCES", _t251, _t254);
					_t175 =  *((intOrPtr*)( *0x45f07c));
					 *((intOrPtr*)( *((intOrPtr*)( *0x45f07c)) + 0x14))();
					 *((intOrPtr*)( *((intOrPtr*)( *0x45f088)) + 0x70))();
					_t105 =  *((intOrPtr*)( *((intOrPtr*)( *0x45f088)) + 0x14))() - 1;
					if(_t105 >= 0) {
						_v24 = _t105 + 1;
						 *0x45f08c = 0;
						do {
							E0043D3BC( *0x45f07c);
							E004191A0( *0x45f08c,  &_v32);
							E004508D4( *0x45f078,  *0x45f07c, _v32, _t251, _t254);
							 *[fs:eax] = _t255;
							_t175 =  *((intOrPtr*)( *0x45f088));
							 *((intOrPtr*)( *((intOrPtr*)( *0x45f088)) + 0xc))( *[fs:eax], 0x456a3f, _t254);
							E004074FC( &_v36, _v40,  *0x45f090);
							E0043D338( *0x45f07c,  *((intOrPtr*)( *0x45f088)), _v36, _t251); // executed
							_pop(_t249);
							 *[fs:eax] = _t249;
							 *0x45f08c =  &( *0x45f08c->i);
							_t22 =  &_v24;
							 *_t22 = _v24 - 1;
						} while ( *_t22 != 0);
					}
					_t264 =  *0x45efe8 - 0x8000;
					if( *0x45efe8 == 0x8000) {
						E00409E88(0x45198c,  &_v44, _t254, 0x30);
						E00409E88(0x451984,  &_v48, _t254, E004072B8(_v44));
						MessageBoxW(0, E004072B8(_v48), ??, ??);
					}
					L0040AF10(); // executed
					_t107 = E00450080(_t175, 0, 1, _t251, _t252, _t269);
					_t232 =  *0x458c3c; // 0x45dffc
					 *_t232 = _t107;
					E0040739C( &_v52,  *0x45f084);
					_t110 =  *0x458c3c; // 0x45dffc
					_t193 =  *0x45efec; // 0x0, executed
					E0044FF4C( *_t110, _t175, _t193, _v52, _t251, _t252, _t264); // executed
					_t235 = 0;
					 *[fs:eax] = _t235;
					_t114 =  *0x458c3c; // 0x45dffc
					E00404E1C( *_t114); // executed
					L0040AF18(); // executed
					E00406658(0x45f084);
					_t119 =  *0x458994; // 0x45e004
					_t236 =  *0x458934; // 0x457000
					 *_t236 =  *_t119;
					E00404E1C( *0x45f07c);
					_t125 =  *((intOrPtr*)( *((intOrPtr*)( *0x45f088)) + 0x14))(E00456BDB) - 1;
					if(_t125 >= 0) {
						_v24 = _t125 + 1;
						 *0x45f08c = 0;
						do {
							 *((intOrPtr*)( *((intOrPtr*)( *0x45f088)) + 0xc))(0x456cac,  *0x45f090);
							_push(_v56);
							E00407584(0x45f094,  *((intOrPtr*)( *0x45f088)), 3, _t251, _t252);
							if(E004197E4( *0x45f094, 1) != 0) {
								_push(_t254);
								_push(0x456b9d);
								_push( *[fs:eax]);
								 *[fs:eax] = _t255;
								E0041987C( *0x45f094);
								_pop(_t241);
								 *[fs:eax] = _t241;
							}
							 *0x45f08c =  &( *0x45f08c->i);
							_t35 =  &_v24;
							 *_t35 = _v24 - 1;
						} while ( *_t35 != 0);
					}
					E00404E1C( *0x45f088);
					E00404E1C( *0x45f080);
					return E00404E1C( *0x45f078);
				}
			}

0x0045678c
0x0045678c
0x0045678c
0x0045678d
0x0045678f
0x00456794
0x00456794
0x00456796
0x00456798
0x00456798
0x0045679b
0x0045679c
0x0045679d
0x0045679e
0x004567a4
0x004567ab
0x004567ac
0x004567b1
0x004567b4
0x004567b9
0x004567be
0x004567c5
0x004567cb
0x004567cc
0x004567d1
0x004567d4
0x004567de
0x004567f2
0x004567f9
0x004567fc
0x00456819
0x00456bdb
0x00456bdd
0x00456be0
0x00456be3
0x00456beb
0x00456bf3
0x00456c05
0x0045681f
0x0045682b
0x00456835
0x0045683e
0x0045684f
0x00456860
0x00456871
0x00456881
0x0045688f
0x004568a4
0x004568c2
0x004568d6
0x004568e5
0x004568ed
0x00456902
0x00456912
0x00456926
0x0045692e
0x00456936
0x0045693b
0x00456948
0x0045694d
0x00456954
0x00456959
0x00456959
0x00456967
0x00456973
0x00456973
0x00456988
0x00456996
0x00456998
0x004569a8
0x004569b5
0x004569b8
0x004569bf
0x004569c2
0x004569cc
0x004569d1
0x004569de
0x004569f1
0x00456a01
0x00456a12
0x00456a14
0x00456a23
0x00456a30
0x00456a37
0x00456a3a
0x00456a49
0x00456a4f
0x00456a4f
0x00456a4f
0x004569cc
0x00456a58
0x00456a62
0x00456a6e
0x00456a84
0x00456a94
0x00456a94
0x00456a9b
0x00456aa9
0x00456aae
0x00456ab4
0x00456abf
0x00456ac7
0x00456ace
0x00456ad4
0x00456adb
0x00456ade
0x00456ae6
0x00456aed
0x00456af2
0x00456afc
0x00456b01
0x00456b08
0x00456b0e
0x00456b15
0x00456b24
0x00456b27
0x00456b2e
0x00456b31
0x00456b3b
0x00456b56
0x00456b59
0x00456b66
0x00456b79
0x00456b7d
0x00456b7e
0x00456b83
0x00456b86
0x00456b8e
0x00456b95
0x00456b98
0x00456b98
0x00456ba7
0x00456bad
0x00456bad
0x00456bad
0x00456b3b
0x00456bb7
0x00456bc1
0x00456bd0
0x00456bd0

Strings

ScriptCryptor, xrefs: 0045684A
@;C, xrefs: 00456867
RC_SCRIPT, xrefs: 004567D7
E, xrefs: 00456915
DATASECTION, xrefs: 004568F8
SCRIPT, xrefs: 0045689A
RESOURCES, xrefs: 0045697E

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID:
String ID: @;C$DATASECTION$RC_SCRIPT$RESOURCES$SCRIPT$ScriptCryptor$E
API String ID: 0-2664652100
Opcode ID: 2d750c1a77a12e1201c25858602e52bdfd2979582e60773e9754ce4ea13ca4a4
Instruction ID: da2bf4732cbb172941c49c2c10c94de97c893611fe876b108c48ffb1cd4c56f4
Opcode Fuzzy Hash: 2d750c1a77a12e1201c25858602e52bdfd2979582e60773e9754ce4ea13ca4a4
Instruction Fuzzy Hash: E6C13E74601600CFD700EF65E891A5A77F1EB49716B55807AFC04EB3A3DA39EC09CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00403394, Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00403394(void* __eax, signed int __edi, void* __ebp) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				signed int __ebx;
				void* _t58;
				signed int _t61;
				int _t65;
				signed int _t67;
				void _t70;
				int _t71;
				signed int _t78;
				void* _t79;
				signed int _t81;
				intOrPtr _t82;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				signed int _t92;
				void* _t96;
				signed int _t99;
				void* _t103;
				intOrPtr _t104;
				void* _t106;
				void* _t108;
				signed int _t113;
				void* _t115;
				void* _t116;

				_t56 = __eax;
				_t89 =  *(__eax - 4);
				_t78 =  *0x459059; // 0x1
				if((_t89 & 0x00000007) != 0) {
					__eflags = _t89 & 0x00000005;
					if((_t89 & 0x00000005) != 0) {
						_pop(_t78);
						__eflags = _t89 & 0x00000003;
						if((_t89 & 0x00000003) == 0) {
							_push(_t78);
							_push(__edi);
							_t116 = _t115 + 0xffffffdc;
							_t103 = __eax - 0x10;
							E00402D70();
							_t58 = _t103;
							 *_t116 =  *_t58;
							_v48 =  *((intOrPtr*)(_t58 + 4));
							_t92 =  *(_t58 + 0xc);
							if((_t92 & 0x00000008) != 0) {
								_t79 = _t103;
								_t113 = _t92 & 0xfffffff0;
								_t99 = 0;
								__eflags = 0;
								while(1) {
									VirtualQuery(_t79,  &_v44, 0x1c);
									_t61 = VirtualFree(_t79, 0, 0x8000);
									__eflags = _t61;
									if(_t61 == 0) {
										_t99 = _t99 | 0xffffffff;
										goto L10;
									}
									_t104 = _v44.RegionSize;
									__eflags = _t113 - _t104;
									if(_t113 > _t104) {
										_t113 = _t113 - _t104;
										_t79 = _t79 + _t104;
										continue;
									}
									goto L10;
								}
							} else {
								_t65 = VirtualFree(_t103, 0, 0x8000); // executed
								if(_t65 == 0) {
									_t99 = __edi | 0xffffffff;
								} else {
									_t99 = 0;
								}
							}
							L10:
							if(_t99 == 0) {
								 *_v48 =  *_t116;
								 *( *_t116 + 4) = _v48;
							}
							 *0x45baf8 = 0;
							return _t99;
						} else {
							return 0xffffffff;
						}
					} else {
						goto L31;
					}
				} else {
					__eflags = __bl;
					__ebx =  *__edx;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L14;
							}
							asm("pause");
							__eflags =  *0x459909;
							if(__eflags != 0) {
								continue;
							} else {
								Sleep(0);
								__edx = __edx;
								__ecx = __ecx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__eflags != 0) {
									Sleep(0xa);
									__edx = __edx;
									__ecx = __ecx;
									continue;
								}
							}
							goto L14;
						}
					}
					L14:
					_t14 = __edx + 0x14;
					 *_t14 =  *(__edx + 0x14) - 1;
					__eflags =  *_t14;
					__eax =  *(__edx + 0x10);
					if( *_t14 == 0) {
						__eflags = __eax;
						if(__eax == 0) {
							L20:
							 *(__ebx + 0x14) = __eax;
						} else {
							__eax =  *(__edx + 0xc);
							__ecx =  *(__edx + 8);
							 *(__eax + 8) = __ecx;
							 *(__ecx + 0xc) = __eax;
							__eax = 0;
							__eflags =  *((intOrPtr*)(__ebx + 0x18)) - __edx;
							if( *((intOrPtr*)(__ebx + 0x18)) == __edx) {
								goto L20;
							}
						}
						 *__ebx = __al;
						__eax = __edx;
						__edx =  *(__edx - 4);
						__bl =  *0x459059; // 0x1
						L31:
						__eflags = _t78;
						_t81 = _t89 & 0xfffffff0;
						_push(_t101);
						_t106 = _t56;
						if(__eflags != 0) {
							while(1) {
								_t67 = 0x100;
								asm("lock cmpxchg [0x459a68], ah");
								if(__eflags == 0) {
									goto L32;
								}
								asm("pause");
								__eflags =  *0x459909;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									_t67 = 0x100;
									asm("lock cmpxchg [0x459a68], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L32;
							}
						}
						L32:
						__eflags = (_t106 - 4)[_t81] & 0x00000001;
						_t87 = (_t106 - 4)[_t81];
						if(((_t106 - 4)[_t81] & 0x00000001) != 0) {
							_t67 = _t81 + _t106;
							_t88 = _t87 & 0xfffffff0;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00402BEC(_t67);
							}
						} else {
							_t88 = _t87 | 0x00000008;
							__eflags = _t88;
							(_t106 - 4)[_t81] = _t88;
						}
						__eflags =  *(_t106 - 4) & 0x00000008;
						if(( *(_t106 - 4) & 0x00000008) != 0) {
							_t88 =  *(_t106 - 8);
							_t106 = _t106 - _t88;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00402BEC(_t106);
							}
						}
						__eflags = _t81 - 0x13ffe0;
						if(_t81 == 0x13ffe0) {
							__eflags =  *0x459a70 - 0x13ffe0;
							if( *0x459a70 != 0x13ffe0) {
								_t82 = _t106 + 0x13ffe0;
								E00402C8C(_t67);
								 *((intOrPtr*)(_t82 - 4)) = 2;
								 *0x459a70 = 0x13ffe0;
								 *0x459a6c = _t82;
								 *0x459a68 = 0;
								__eflags = 0;
								return 0;
							} else {
								_t108 = _t106 - 0x10;
								_t70 =  *_t108;
								_t96 =  *(_t108 + 4);
								 *(_t70 + 4) = _t96;
								 *_t96 = _t70;
								 *0x459a68 = 0;
								_t71 = VirtualFree(_t108, 0, 0x8000);
								__eflags = _t71 - 1;
								asm("sbb eax, eax");
								return _t71;
							}
						} else {
							 *(_t106 - 4) = _t81 + 3;
							 *(_t106 - 8 + _t81) = _t81;
							E00402C2C(_t106, _t88, _t81);
							 *0x459a68 = 0;
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = __eax;
						 *(__edx + 0x10) = __ecx;
						 *(__ecx - 4) = __eax;
						if(__eflags == 0) {
							__ecx =  *(__ebx + 8);
							 *(__edx + 0xc) = __ebx;
							 *(__edx + 8) = __ecx;
							 *(__ecx + 0xc) = __edx;
							 *(__ebx + 8) = __edx;
							 *__ebx = 0;
							__eax = 0;
							__eflags = 0;
							_pop(__ebx);
							return 0;
						} else {
							__eax = 0;
							__eflags = 0;
							 *__ebx = __al;
							_pop(__ebx);
							return 0;
						}
					}
				}
			}

0x00403394
0x00403394
0x0040339d
0x004033a3
0x0040348c
0x0040348f
0x0040357c
0x0040357d
0x00403580
0x00402e1c
0x00402e1e
0x00402e20
0x00402e25
0x00402e28
0x00402e2d
0x00402e31
0x00402e37
0x00402e3b
0x00402e41
0x00402e5d
0x00402e61
0x00402e64
0x00402e64
0x00402e66
0x00402e6e
0x00402e7b
0x00402e80
0x00402e82
0x00402e84
0x00402e87
0x00402e87
0x00402e89
0x00402e8d
0x00402e8f
0x00402e91
0x00402e93
0x00000000
0x00402e93
0x00000000
0x00402e8f
0x00402e43
0x00402e4b
0x00402e52
0x00402e58
0x00402e54
0x00402e54
0x00402e54
0x00402e52
0x00402e97
0x00402e99
0x00402ea2
0x00402eab
0x00402eab
0x00402eae
0x00402ebe
0x00403586
0x0040358b
0x0040358b
0x00000000
0x00000000
0x00000000
0x004033a9
0x004033a9
0x004033ab
0x004033ad
0x00403410
0x00403410
0x00403415
0x00403419
0x00000000
0x00000000
0x0040341b
0x0040341d
0x00403424
0x00000000
0x00403426
0x0040342a
0x0040342f
0x00403430
0x00403431
0x00403436
0x0040343a
0x00403444
0x00403449
0x0040344a
0x00000000
0x0040344a
0x0040343a
0x00000000
0x00403424
0x00403410
0x004033af
0x004033af
0x004033af
0x004033af
0x004033b3
0x004033b6
0x004033e4
0x004033e6
0x004033fb
0x004033fb
0x004033e8
0x004033e8
0x004033eb
0x004033ee
0x004033f1
0x004033f4
0x004033f6
0x004033f9
0x00000000
0x00000000
0x004033f9
0x004033fe
0x00403400
0x00403402
0x00403405
0x00403495
0x00403498
0x0040349a
0x0040349c
0x0040349d
0x0040349f
0x00403450
0x00403450
0x00403455
0x0040345d
0x00000000
0x00000000
0x0040345f
0x00403461
0x00403468
0x00000000
0x0040346a
0x0040346c
0x00403471
0x00403476
0x0040347e
0x00403482
0x00000000
0x00403482
0x0040347e
0x00000000
0x00403468
0x00403450
0x004034a1
0x004034a1
0x004034a9
0x004034ad
0x004034e4
0x004034e7
0x004034ea
0x004034ec
0x004034f2
0x004034f4
0x004034f4
0x004034af
0x004034af
0x004034af
0x004034b2
0x004034b2
0x004034b6
0x004034ba
0x004034fc
0x004034ff
0x00403501
0x00403503
0x00403509
0x0040350d
0x0040350d
0x00403509
0x004034bc
0x004034c2
0x00403514
0x0040351e
0x0040354c
0x00403552
0x00403557
0x0040355e
0x00403568
0x0040356e
0x00403575
0x00403579
0x00403520
0x00403520
0x00403523
0x00403525
0x00403528
0x0040352b
0x0040352d
0x0040353c
0x00403541
0x00403544
0x00403548
0x00403548
0x004034c4
0x004034c7
0x004034ca
0x004034d2
0x004034d7
0x004034de
0x004034e2
0x004034e2
0x004033b8
0x004033b8
0x004033ba
0x004033c0
0x004033c3
0x004033cc
0x004033cf
0x004033d2
0x004033d5
0x004033d8
0x004033db
0x004033de
0x004033de
0x004033e0
0x004033e1
0x004033c5
0x004033c5
0x004033c5
0x004033c7
0x004033c9
0x004033ca
0x004033ca
0x004033c3
0x004033b6

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00403004), ref: 0040342A
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00403004), ref: 00403444

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1f2cec3eac059ec38d5e17fb2b22deeea1f6f599f6dd72b35cc95fa5b72d0dc4
Instruction ID: 66123f26551aabb46aa94c06002db9d6505f91c33f21a60575db6f87d8aa7c3c
Opcode Fuzzy Hash: 1f2cec3eac059ec38d5e17fb2b22deeea1f6f599f6dd72b35cc95fa5b72d0dc4
Instruction Fuzzy Hash: 707120716043108FE712CF29CD88B16BBD8AB85315F1882BFE844AB3D2D6B8CD45C799

Uniqueness

Uniqueness Score: -1.00%

Function 00403010, Relevance: 9.0, APIs: 7, Instructions: 298
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00403010(signed int __eax) {
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* _t96;
				void** _t99;
				signed int _t104;
				signed int _t109;
				signed int _t110;
				intOrPtr* _t114;
				void* _t116;
				void* _t121;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				unsigned int _t141;
				signed int _t142;
				void* _t144;
				void* _t147;
				intOrPtr _t148;
				signed int _t150;
				long _t156;
				intOrPtr _t159;
				signed int _t162;

				_t129 =  *0x459059; // 0x1
				if(__eax > 0xa2c) {
					__eflags = __eax - 0x40a2c;
					if(__eax > 0x40a2c) {
						_pop(_t120);
						__eflags = __eax;
						if(__eax >= 0) {
							_push(_t120);
							_t162 = __eax;
							_t156 = __eax + 0x00010010 - 0x00000001 + 0x00000004 & 0xffff0000;
							_t96 = VirtualAlloc(0, _t156, 0x101000, 4); // executed
							_t121 = _t96;
							if(_t121 != 0) {
								_t147 = _t121;
								 *((intOrPtr*)(_t147 + 8)) = _t162;
								 *(_t147 + 0xc) = _t156 | 0x00000004;
								E00402D70();
								_t99 =  *0x45bb00; // 0x45bafc
								 *_t147 = 0x45bafc;
								 *0x45bb00 = _t121;
								 *(_t147 + 4) = _t99;
								 *_t99 = _t121;
								 *0x45baf8 = 0;
								_t121 = _t121 + 0x10;
							}
							return _t121;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t125 = (__eax + 0x000000d3 & 0xffffff00) + 0x30;
						__eflags = _t129;
						if(__eflags != 0) {
							while(1) {
								asm("lock cmpxchg [0x459a68], ah");
								if(__eflags == 0) {
									goto L42;
								}
								asm("pause");
								__eflags =  *0x459909;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									asm("lock cmpxchg [0x459a68], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L42;
							}
						}
						L42:
						_t141 = _t125 - 0xb30;
						_t142 = _t141 >> 0xd;
						_t131 = _t141 >> 8;
						_t104 = 0xffffffff << _t131 &  *(0x459a78 + _t142 * 4);
						__eflags = 0xffffffff;
						if(0xffffffff == 0) {
							_t132 = _t142;
							__eflags = 0xfffffffe << _t132 &  *0x459a74;
							if((0xfffffffe << _t132 &  *0x459a74) == 0) {
								_t133 =  *0x459a70; // 0x0
								_t134 = _t133 - _t125;
								__eflags = _t134;
								if(_t134 < 0) {
									_t109 = E00402CF8(_t125);
								} else {
									_t110 =  *0x459a6c; // 0x23c7000
									_t109 = _t110 - _t125;
									 *0x459a6c = _t109;
									 *0x459a70 = _t134;
									 *(_t109 - 4) = _t125 | 0x00000002;
								}
								 *0x459a68 = 0;
								return _t109;
							} else {
								asm("bsf edx, eax");
								asm("bsf ecx, eax");
								_t135 = _t132 | _t142 << 0x00000005;
								goto L50;
							}
						} else {
							asm("bsf eax, eax");
							_t135 = _t131 & 0xffffffe0 | _t104;
							L50:
							_push(_t152);
							_push(_t145);
							_t148 = 0x459af8 + _t135 * 8;
							_t159 =  *((intOrPtr*)(_t148 + 4));
							_t114 =  *((intOrPtr*)(_t159 + 4));
							 *((intOrPtr*)(_t148 + 4)) = _t114;
							 *_t114 = _t148;
							__eflags = _t148 - _t114;
							if(_t148 == _t114) {
								asm("rol eax, cl");
								_t80 = 0x459a78 + _t142 * 4;
								 *_t80 =  *(0x459a78 + _t142 * 4) & 0xfffffffe;
								__eflags =  *_t80;
								if( *_t80 == 0) {
									asm("btr [0x459a74], edx");
								}
							}
							_t150 = 0xfffffff0 &  *(_t159 - 4);
							_t144 = 0xfffffff0 - _t125;
							__eflags = 0xfffffff0;
							if(0xfffffff0 == 0) {
								_t89 =  &((_t159 - 4)[0xfffffffffffffffc]);
								 *_t89 =  *(_t159 - 4 + _t150) & 0x000000f7;
								__eflags =  *_t89;
							} else {
								_t116 = _t125 + _t159;
								 *((intOrPtr*)(_t116 - 4)) = 0xfffffffffffffff3;
								 *(0xfffffff0 + _t116 - 8) = 0xfffffff0;
								__eflags = 0xfffffff0 - 0xb30;
								if(0xfffffff0 >= 0xb30) {
									E00402C2C(_t116, 0xfffffffffffffff3, _t144);
								}
							}
							 *(_t159 - 4) = _t125 + 2;
							 *0x459a68 = 0;
							return _t159;
						}
					}
				} else {
					__eflags = __cl;
					__eax =  *(__edx + 0x459910) & 0x000000ff;
					__ebx = 0x457070 + ( *(__edx + 0x459910) & 0x000000ff) * 8;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L5;
							}
							__ebx = __ebx + 0x20;
							__eflags = __ebx;
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__ebx != 0) {
								__ebx = __ebx + 0x20;
								__eflags = __ebx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__ebx != 0) {
									__ebx = __ebx - 0x40;
									asm("pause");
									__eflags =  *0x459909;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [ebx], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
								}
							}
							goto L5;
						}
					}
					L5:
					__edx =  *(__ebx + 8);
					__eax =  *(__edx + 0x10);
					__ecx = 0xfffffff8;
					__eflags = __edx - __ebx;
					if(__edx == __ebx) {
						__edx =  *(__ebx + 0x18);
						__ecx =  *(__ebx + 2) & 0x0000ffff;
						__ecx = ( *(__ebx + 2) & 0x0000ffff) + __eax;
						__eflags = __eax -  *(__ebx + 0x14);
						if(__eax >  *(__ebx + 0x14)) {
							_push(__esi);
							_push(__edi);
							__eflags =  *0x459059;
							if(__eflags != 0) {
								while(1) {
									__eax = 0x100;
									asm("lock cmpxchg [0x459a68], ah");
									if(__eflags == 0) {
										goto L22;
									}
									asm("pause");
									__eflags =  *0x459909;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [0x459a68], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
									goto L22;
								}
							}
							L22:
							 *(__ebx + 1) =  *(__ebx + 1) &  *0x459a74;
							__eflags =  *(__ebx + 1) &  *0x459a74;
							if(( *(__ebx + 1) &  *0x459a74) == 0) {
								__ecx =  *(__ebx + 4) & 0x0000ffff;
								__edi =  *0x459a70; // 0x0
								__eflags = __edi - ( *(__ebx + 4) & 0x0000ffff);
								if(__edi < ( *(__ebx + 4) & 0x0000ffff)) {
									__eax =  *(__ebx + 6) & 0x0000ffff;
									__edi = __eax;
									__eax = E00402CF8(__eax);
									__esi = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										goto L35;
									} else {
										 *0x459a68 = __al;
										 *__ebx = __al;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										return __eax;
									}
								} else {
									__esi =  *0x459a6c; // 0x23c7000
									__ecx =  *(__ebx + 6) & 0x0000ffff;
									__edx = __ecx + 0xb30;
									__eflags = __edi - __ecx + 0xb30;
									if(__edi >= __ecx + 0xb30) {
										__edi = __ecx;
									}
									__esi = __esi - __edi;
									 *0x459a70 =  *0x459a70 - __edi;
									 *0x459a6c = __esi;
									goto L35;
								}
							} else {
								asm("bsf eax, esi");
								__esi = __eax * 8;
								__ecx =  *(0x459a78 + __eax * 4);
								asm("bsf ecx, ecx");
								__ecx =  *(0x459a78 + __eax * 4) + __eax * 8 * 4;
								__edi = 0x459af8 + ( *(0x459a78 + __eax * 4) + __eax * 8 * 4) * 8;
								__esi =  *(__edi + 4);
								__edx =  *(__esi + 4);
								 *(__edi + 4) = __edx;
								 *__edx = __edi;
								__eflags = __edi - __edx;
								if(__edi == __edx) {
									__edx = 0xfffffffe;
									asm("rol edx, cl");
									_t38 = 0x459a78 + __eax * 4;
									 *_t38 =  *(0x459a78 + __eax * 4) & 0xfffffffe;
									__eflags =  *_t38;
									if( *_t38 == 0) {
										asm("btr [0x459a74], eax");
									}
								}
								__edi = 0xfffffff0;
								__edi = 0xfffffff0 &  *(__esi - 4);
								__eflags = 0xfffffff0 - 0x10a60;
								if(0xfffffff0 < 0x10a60) {
									_t52 =  &((__esi - 4)[0xfffffffffffffffc]);
									 *_t52 = (__esi - 4)[0xfffffffffffffffc] & 0x000000f7;
									__eflags =  *_t52;
								} else {
									__edx = __edi;
									__edi =  *(__ebx + 6) & 0x0000ffff;
									__edx = __edx - __edi;
									__eax = __edi + __esi;
									__ecx = __edx + 3;
									 *(__eax - 4) = __ecx;
									 *(__edx + __eax - 8) = __edx;
									__eax = E00402C2C(__eax, __ecx, __edx);
								}
								L35:
								_t56 = __edi + 6; // 0x6
								__ecx = _t56;
								 *(__esi - 4) = _t56;
								__eax = 0;
								 *0x459a68 = __al;
								 *__esi = __ebx;
								 *((intOrPtr*)(__esi + 0x10)) = 0;
								 *((intOrPtr*)(__esi + 0x14)) = 1;
								 *(__ebx + 0x18) = __esi;
								_t61 = __esi + 0x20; // 0x23c7020
								__eax = _t61;
								__ecx =  *(__ebx + 2) & 0x0000ffff;
								__edx = __ecx + __eax;
								 *(__ebx + 0x10) = __ecx + __eax;
								__edi = __edi + __esi;
								__edi = __edi - __ecx;
								__eflags = __edi;
								 *(__ebx + 0x14) = __edi;
								 *__ebx = 0;
								 *(__eax - 4) = __esi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
						} else {
							_t19 = __edx + 0x14;
							 *_t19 =  *(__edx + 0x14) + 1;
							__eflags =  *_t19;
							 *(__ebx + 0x10) = __ecx;
							 *__ebx = 0;
							 *(__eax - 4) = __edx;
							_pop(__ebx);
							return __eax;
						}
					} else {
						 *(__edx + 0x14) =  *(__edx + 0x14) + 1;
						__ecx = 0xfffffff8 &  *(__eax - 4);
						__eflags = 0xfffffff8;
						 *(__edx + 0x10) = 0xfffffff8 &  *(__eax - 4);
						 *(__eax - 4) = __edx;
						if(0xfffffff8 == 0) {
							__ecx =  *(__edx + 8);
							 *(__ecx + 0xc) = __ebx;
							 *(__ebx + 8) = __ecx;
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						} else {
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x0040301c
0x00403022
0x00403270
0x00403275
0x00403388
0x00403389
0x0040338b
0x00402db8
0x00402dbc
0x00402dc8
0x00402dd8
0x00402ddd
0x00402de1
0x00402de3
0x00402de5
0x00402deb
0x00402dee
0x00402df3
0x00402df8
0x00402dfe
0x00402e04
0x00402e07
0x00402e09
0x00402e10
0x00402e10
0x00402e19
0x00403391
0x00403391
0x00403393
0x00403393
0x0040327b
0x00403287
0x0040328a
0x0040328c
0x00403234
0x00403239
0x00403241
0x00000000
0x00000000
0x00403243
0x00403245
0x0040324c
0x00000000
0x0040324e
0x00403250
0x0040325a
0x00403262
0x00403266
0x00000000
0x00403266
0x00403262
0x00000000
0x0040324c
0x00403234
0x0040328e
0x0040328e
0x00403296
0x00403299
0x004032a3
0x004032a3
0x004032aa
0x004032bd
0x004032c1
0x004032c7
0x004032e0
0x004032e6
0x004032e6
0x004032e8
0x00403306
0x004032ea
0x004032ea
0x004032ef
0x004032f1
0x004032f6
0x004032ff
0x004032ff
0x0040330b
0x00403313
0x004032c9
0x004032c9
0x004032d3
0x004032db
0x00000000
0x004032db
0x004032ac
0x004032af
0x004032b2
0x00403314
0x00403314
0x00403315
0x00403316
0x0040331d
0x00403320
0x00403323
0x00403326
0x00403328
0x0040332a
0x00403331
0x00403333
0x00403333
0x00403333
0x0040333a
0x0040333c
0x0040333c
0x0040333a
0x00403348
0x0040334d
0x0040334d
0x0040334f
0x00403370
0x00403370
0x00403370
0x00403351
0x00403351
0x00403357
0x0040335a
0x0040335e
0x00403364
0x00403366
0x00403366
0x00403364
0x00403378
0x0040337b
0x00403387
0x00403387
0x004032aa
0x00403028
0x00403028
0x0040302a
0x00403031
0x00403038
0x00403090
0x00403090
0x00403095
0x00403099
0x00000000
0x00000000
0x0040309b
0x0040309b
0x0040309e
0x004030a3
0x004030a7
0x004030a9
0x004030a9
0x004030ac
0x004030b1
0x004030b5
0x004030b7
0x004030ba
0x004030bc
0x004030c3
0x00000000
0x004030c5
0x004030c7
0x004030cc
0x004030d1
0x004030d5
0x004030dd
0x00000000
0x004030dd
0x004030d5
0x004030c3
0x004030b5
0x00000000
0x004030a7
0x00403090
0x0040303a
0x0040303a
0x0040303d
0x00403040
0x00403045
0x00403047
0x00403060
0x00403063
0x00403067
0x00403069
0x0040306c
0x004030e4
0x004030e5
0x004030e6
0x004030ed
0x004030ef
0x004030ef
0x004030f4
0x004030fc
0x00000000
0x00000000
0x004030fe
0x00403100
0x00403107
0x00000000
0x00403109
0x0040310b
0x00403110
0x00403115
0x0040311d
0x00403121
0x00000000
0x00403121
0x0040311d
0x00000000
0x00403107
0x004030ef
0x00403128
0x0040312c
0x0040312c
0x00403132
0x004031a4
0x004031a8
0x004031ae
0x004031b0
0x004031d8
0x004031dc
0x004031de
0x004031e3
0x004031e5
0x004031e7
0x00000000
0x004031e9
0x004031e9
0x004031ee
0x004031f0
0x004031f1
0x004031f2
0x004031f3
0x004031f3
0x004031b2
0x004031b2
0x004031b8
0x004031bc
0x004031c2
0x004031c4
0x004031c6
0x004031c6
0x004031c8
0x004031ca
0x004031d0
0x00000000
0x004031d0
0x00403134
0x00403134
0x00403137
0x0040313e
0x00403145
0x00403148
0x0040314b
0x00403152
0x00403155
0x00403158
0x0040315b
0x0040315d
0x0040315f
0x00403161
0x00403166
0x00403168
0x00403168
0x00403168
0x0040316f
0x00403171
0x00403171
0x0040316f
0x00403178
0x0040317d
0x00403180
0x00403186
0x004031f4
0x004031f4
0x004031f4
0x00403188
0x00403188
0x0040318a
0x0040318e
0x00403190
0x00403193
0x00403196
0x00403199
0x0040319d
0x0040319d
0x004031f9
0x004031f9
0x004031f9
0x004031fc
0x004031ff
0x00403201
0x00403206
0x00403208
0x0040320b
0x00403212
0x00403215
0x00403215
0x00403218
0x0040321c
0x0040321f
0x00403222
0x00403224
0x00403224
0x00403226
0x00403229
0x0040322c
0x0040322f
0x00403230
0x00403231
0x00403232
0x00403232
0x0040306e
0x0040306e
0x0040306e
0x0040306e
0x00403072
0x00403075
0x00403078
0x0040307b
0x0040307c
0x0040307c
0x00403049
0x00403049
0x0040304d
0x0040304d
0x00403050
0x00403053
0x00403056
0x00403080
0x00403083
0x00403086
0x00403089
0x0040308c
0x0040308d
0x00403058
0x00403058
0x0040305b
0x0040305c
0x0040305c
0x00403056
0x00403047

APIs

Sleep.KERNEL32(00000000), ref: 004030C7
Sleep.KERNEL32(0000000A,00000000), ref: 004030DD
Sleep.KERNEL32(00000000), ref: 0040310B
Sleep.KERNEL32(0000000A,00000000), ref: 00403121

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d4a1879d51360948af9aa405287b6672021a5bf810b19b6d4c1fb1baa3647e1a
Instruction ID: d98f8fd7fed65b52ccd6165105823790a6dcfbab5471963bb93e231b63962651
Opcode Fuzzy Hash: d4a1879d51360948af9aa405287b6672021a5bf810b19b6d4c1fb1baa3647e1a
Instruction Fuzzy Hash: 0FC144726013808BDB15CF29D884356BFE9AB85312F1882BFD4459B3D6C778EE41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0044444C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0044444C(intOrPtr _a4, short _a6, intOrPtr _a8) {
				struct _WNDCLASSW _v44;
				struct HINSTANCE__* _t6;
				WCHAR* _t8;
				struct HINSTANCE__* _t9;
				int _t10;
				void* _t11;
				struct HINSTANCE__* _t13;
				struct HWND__* _t15;
				long _t17;
				struct HINSTANCE__* _t19;
				WCHAR* _t20;
				struct HWND__* _t22;
				WCHAR* _t24;

				_t6 =  *0x45bc50; // 0x400000
				 *0x458840 = _t6;
				_t8 =  *0x458854; // 0x444430
				_t9 =  *0x45bc50; // 0x400000
				_t10 = GetClassInfoW(_t9, _t8,  &_v44);
				asm("sbb eax, eax");
				_t11 = _t10 + 1;
				if(_t11 == 0 || L0040AA80 != _v44.lpfnWndProc) {
					if(_t11 != 0) {
						_t19 =  *0x45bc50; // 0x400000
						_t20 =  *0x458854; // 0x444430
						UnregisterClassW(_t20, _t19);
					}
					RegisterClassW(0x458830);
				}
				_t13 =  *0x45bc50; // 0x400000
				_t24 =  *0x458854; // 0x444430
				_t15 = E0040AAF8(0x80, _t24, 0, _t13, 0, 0, 0, 0, 0, 0, 0x80000000); // executed
				_t22 = _t15;
				if(_a6 != 0) {
					_t17 = E004442B4(_a4, _a8); // executed
					SetWindowLongW(_t22, 0xfffffffc, _t17);
				}
				return _t22;
			}

0x00444453
0x00444458
0x00444461
0x00444467
0x0044446d
0x00444475
0x00444477
0x0044447a
0x00444488
0x0044448a
0x00444490
0x00444496
0x00444496
0x004444a0
0x004444a0
0x004444b6
0x004444c3
0x004444ce
0x004444d3
0x004444da
0x004444e2
0x004444eb
0x004444eb
0x004444f6

APIs

GetClassInfoW.USER32 ref: 0044446D
UnregisterClassW.USER32 ref: 00444496
RegisterClassW.USER32 ref: 004444A0
SetWindowLongW.USER32 ref: 004444EB

Strings

0DD, xrefs: 00444461, 00444490, 004444C3

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID: 0DD
API String ID: 4025006896-1049506570
Opcode ID: d8ecce0a5b3cee223f6d5bc638e3f90d975df0148a145ef17585369a2c7aad77
Instruction ID: f78ca04a3f9cf15320f82936c720150d7e845f1326e6f316e572b90f539a189f
Opcode Fuzzy Hash: d8ecce0a5b3cee223f6d5bc638e3f90d975df0148a145ef17585369a2c7aad77
Instruction Fuzzy Hash: 6C013C713003046BDB41EBA89D81F5A3398E748315F14852AF905E73D2DE39E8148BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004197E4, Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004197E4(void* __eax, void* __edx) {
				signed char _t14;
				void* _t21;
				void* _t28;
				long _t29;
				WCHAR* _t32;
				void* _t33;

				_t28 = __edx;
				_t33 = __eax;
				_t32 = E004072B8(__eax);
				_t14 = GetFileAttributesW(_t32); // executed
				if(_t14 == 0xffffffff) {
					_t29 = GetLastError();
					if(_t29 == 2 || _t29 == 3 || _t29 == 0x7b || E004197A4(_t33) == 0) {
						return 0;
					} else {
						return 1;
					}
				}
				if((_t14 & 0x00000004) == 0) {
					return _t14 & 0xffffff00 | (_t14 & 0x00000010) == 0x00000000;
				}
				if(_t28 != 0) {
					if((_t14 & 0x00000010) == 0) {
						_t21 = CreateFileW(_t32, 0x80000000, 1, 0, 3, 0, 0);
						if(_t21 == 0xffffffff) {
							return GetLastError() & 0xffffff00 | _t22 == 0x00000020;
						}
						CloseHandle(_t21);
						return 1;
					}
					return 0;
				}
				return 1;
			}

0x004197e7
0x004197e9
0x004197f2
0x004197f5
0x004197fd
0x00419853
0x00419858
0x00000000
0x00419873
0x00000000
0x00419873
0x00419858
0x00419802
0x00000000
0x00419849
0x00419806
0x0041980e
0x00419824
0x0041982c
0x00000000
0x00419842
0x0041982f
0x00000000
0x00419834
0x00000000
0x00419810
0x00000000

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,00000001,00456B77,?,?,?,?,?,00000005,00000000,00000000), ref: 004197F5
GetLastError.KERNEL32(00000000,?,?,00000001,00456B77,?,?,?,?,?,00000005,00000000,00000000), ref: 0041984E

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 0961293aac829a09c744bb1d1d6ce2a28834ecfe27f73861925a3899034ead3e
Instruction ID: aa62d41874482af7cac3a54218987dab8cf47ad0a2e002d4286c9f84e9386501
Opcode Fuzzy Hash: 0961293aac829a09c744bb1d1d6ce2a28834ecfe27f73861925a3899034ead3e
Instruction Fuzzy Hash: F401713527434065EA29347A0DA67FA02484F477E4F280927FA66AB2E1D55DCCC3517F

Uniqueness

Uniqueness Score: -1.00%

Function 0041987C, Relevance: 7.5, APIs: 5, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0041987C(void* __eax) {
				signed char _t10;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t17;
				WCHAR* _t18;

				_t17 = __eax;
				_t18 = E004072B8(__eax);
				DeleteFileW(_t18); // executed
				asm("sbb ebx, ebx");
				_t15 = _t14 + 1;
				if(_t15 == 0) {
					_t16 = GetLastError();
					_t10 = GetFileAttributesW(_t18);
					if(_t10 == 0xffffffff || (_t10 & 0x00000004) == 0 || (_t10 & 0x00000010) == 0) {
						SetLastError(_t16);
					} else {
						RemoveDirectoryW(E004072B8(_t17));
						asm("sbb ebx, ebx");
						_t15 = _t15 + 1;
					}
				}
				return _t15;
			}

0x00419880
0x00419889
0x0041988c
0x00419894
0x00419896
0x00419899
0x004198a0
0x004198a3
0x004198ab
0x004198cc
0x004198b6
0x004198be
0x004198c6
0x004198c8
0x004198c8
0x004198ab
0x004198d7

APIs

DeleteFileW.KERNEL32(00000000,?,?,?,00000001,00456B93,00000000,00456B9D,?,?,?,?,?,?,00000005,00000000), ref: 0041988C
GetLastError.KERNEL32(00000000,?,?,?,00000001,00456B93,00000000,00456B9D,?,?,?,?,?,?,00000005,00000000), ref: 0041989B
GetFileAttributesW.KERNEL32(00000000,00000000,?,?,?,00000001,00456B93,00000000,00456B9D,?,?,?,?,?,?,00000005), ref: 004198A3
RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,?,00000001,00456B93,00000000,00456B9D,?,?), ref: 004198BE
SetLastError.KERNEL32(00000000,00000000,00000000,?,?,?,00000001,00456B93,00000000,00456B9D,?,?), ref: 004198CC

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: ErrorFileLast$AttributesDeleteDirectoryRemove
String ID:
API String ID: 2814369299-0
Opcode ID: 7edf0bb6498fe919875a87294f414c142e504f36b0f4114243fb2f02f6fb051c
Instruction ID: 8f8c5d12d987dc115decf03ac0d156be032c75e9b397dfa583784c1be4d1e460
Opcode Fuzzy Hash: 7edf0bb6498fe919875a87294f414c142e504f36b0f4114243fb2f02f6fb051c
Instruction Fuzzy Hash: 58F08C6225070019D520357A0895ABF224C9A437ADB140B3BF945F32D2DA2E9C9A92AF

Uniqueness

Uniqueness Score: -1.00%

Function 00406458, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00406458() {
				void* _t14;
				int _t21;
				void* _t33;
				void* _t47;
				struct HINSTANCE__* _t54;
				void* _t58;

				if( *0x457004 != 0) {
					E0040632C();
					E004063C0(_t47);
					 *0x457004 = 0;
				}
				if( *0x45bb4c != 0 && GetCurrentThreadId() ==  *0x45bb74) {
					E004060C8(0x45bb48);
					E00406394(0x45bb48);
				}
				if( *0x0045BB40 != 0 ||  *0x459054 == 0) {
					L8:
					if( *((char*)(0x45bb40)) == 2 &&  *0x457000 == 0) {
						 *0x0045BB24 = 0;
					}
					_t14 = E00404528();
					_t45 = _t14;
					if(_t14 == 0) {
						L13:
						E004060F0();
						if( *((char*)(0x45bb40)) <= 1 ||  *0x457000 != 0) {
							_t57 =  *0x0045BB28;
							if( *0x0045BB28 != 0) {
								E004098C8(_t57);
								_t7 =  *((intOrPtr*)(0x45bb28)) + 0x10; // 0x400000
								_t54 =  *_t7;
								_t9 =  *((intOrPtr*)(0x45bb28)) + 4; // 0x400000
								if(_t54 !=  *_t9 && _t54 != 0) {
									FreeLibrary(_t54);
								}
							}
						}
						E004060C8(0x45bb18);
						if( *((char*)(0x45bb40)) == 1) {
							 *0x0045BB3C();
						}
						if( *((char*)(0x45bb40)) != 0) {
							E00406394(0x45bb18);
						}
						if( *0x45bb18 == 0) {
							if( *0x459034 != 0) {
								 *0x459034();
							}
							_t21 =  *0x457000; // 0x0
							ExitProcess(_t21); // executed
						}
						memcpy(0x45bb18,  *0x45bb18, 0xc << 2);
						_t58 = _t58 + 0xc;
						0x45bb18 = 0x45bb18;
						goto L8;
					} else {
						do {
							E00404E1C(_t45);
							_t33 = E00404528();
							_t45 = _t33;
						} while (_t33 != 0);
						goto L13;
					}
				} else {
					do {
						 *0x459054 = 0;
						 *((intOrPtr*)( *0x459054))();
					} while ( *0x459054 != 0);
					L8:
					while(1) {
					}
				}
			}

0x0040646d
0x0040646f
0x00406474
0x0040647b
0x0040647b
0x00406487
0x0040649b
0x004064a5
0x004064a5
0x004064ae
0x004064c4
0x004064c8
0x004064d5
0x004064d5
0x004064d8
0x004064dd
0x004064e1
0x004064f5
0x004064f5
0x004064fe
0x00406509
0x0040650e
0x00406512
0x0040651a
0x0040651a
0x00406520
0x00406523
0x0040652a
0x0040652a
0x00406523
0x0040650e
0x00406531
0x0040653a
0x0040653c
0x0040653c
0x00406543
0x00406547
0x00406547
0x0040654f
0x00406558
0x0040655a
0x0040655a
0x00406560
0x00406566
0x00406566
0x00406577
0x00406577
0x00406579
0x00000000
0x004064e3
0x004064e3
0x004064e5
0x004064ea
0x004064ef
0x004064f1
0x00000000
0x004064e3
0x004064b5
0x004064b5
0x004064bb
0x004064bd
0x004064bf
0x00000000
0x004064c4
0x00000000
0x004064c4

APIs

GetCurrentThreadId.KERNEL32 ref: 00406489
FreeLibrary.KERNEL32(00400000,?,00000000,?,?,0040658E,00404573,004045BA,?,00000000,004045D3,?,?,?,?,00000000), ref: 0040652A
ExitProcess.KERNEL32(00000000,?,00000000,?,?,0040658E,00404573,004045BA,?,00000000,004045D3,?,?,?,?,00000000), ref: 00406566

Part of subcall function 004063C0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000,?,?,0040658E,00404573,004045BA,?,00000000), ref: 004063F9
Part of subcall function 004063C0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000,?,?,0040658E,00404573,004045BA,?), ref: 004063FF
Part of subcall function 004063C0: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000,?), ref: 0040641A
Part of subcall function 004063C0: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000), ref: 00406420

Strings

MZP, xrefs: 00406529

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: fb754d57819c9cb00645cab0706fd786c362fe670dabd00338881b3b256af971
Instruction ID: a93aaad58f025c11ca6d37a442adf43a44a5d6204dd4cd686539ed1561de1c6e
Opcode Fuzzy Hash: fb754d57819c9cb00645cab0706fd786c362fe670dabd00338881b3b256af971
Instruction Fuzzy Hash: B531AE70A003019BD731AB79A84831B76E0AB05329F06093FE506A37D7D7BCE8A8C75D

Uniqueness

Uniqueness Score: -1.00%

Function 00406450, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00406450() {
				intOrPtr* _t14;
				void* _t17;
				int _t24;
				void* _t36;
				void* _t51;
				struct HINSTANCE__* _t59;
				void* _t65;

				 *((intOrPtr*)(_t14 +  *_t14)) =  *((intOrPtr*)(_t14 +  *_t14)) + _t14 +  *_t14;
				if( *0x457004 != 0) {
					E0040632C();
					E004063C0(_t51);
					 *0x457004 = 0;
				}
				if( *0x45bb4c != 0 && GetCurrentThreadId() ==  *0x45bb74) {
					E004060C8(0x45bb48);
					E00406394(0x45bb48);
				}
				if( *0x0045BB40 != 0 ||  *0x459054 == 0) {
					L9:
					if( *((char*)(0x45bb40)) == 2 &&  *0x457000 == 0) {
						 *0x0045BB24 = 0;
					}
					_t17 = E00404528();
					_t49 = _t17;
					if(_t17 == 0) {
						L14:
						E004060F0();
						if( *((char*)(0x45bb40)) <= 1 ||  *0x457000 != 0) {
							_t64 =  *0x0045BB28;
							if( *0x0045BB28 != 0) {
								E004098C8(_t64);
								_t7 =  *((intOrPtr*)(0x45bb28)) + 0x10; // 0x400000
								_t59 =  *_t7;
								_t9 =  *((intOrPtr*)(0x45bb28)) + 4; // 0x400000
								if(_t59 !=  *_t9 && _t59 != 0) {
									FreeLibrary(_t59);
								}
							}
						}
						E004060C8(0x45bb18);
						if( *((char*)(0x45bb40)) == 1) {
							 *0x0045BB3C();
						}
						if( *((char*)(0x45bb40)) != 0) {
							E00406394(0x45bb18);
						}
						if( *0x45bb18 == 0) {
							if( *0x459034 != 0) {
								 *0x459034();
							}
							_t24 =  *0x457000; // 0x0
							ExitProcess(_t24); // executed
						}
						memcpy(0x45bb18,  *0x45bb18, 0xc << 2);
						_t65 = _t65 + 0xc;
						0x45bb18 = 0x45bb18;
						goto L9;
					} else {
						do {
							E00404E1C(_t49);
							_t36 = E00404528();
							_t49 = _t36;
						} while (_t36 != 0);
						goto L14;
					}
				} else {
					do {
						 *0x459054 = 0;
						 *((intOrPtr*)( *0x459054))();
					} while ( *0x459054 != 0);
					L9:
					while(1) {
					}
				}
			}

0x00406452
0x0040646d
0x0040646f
0x00406474
0x0040647b
0x0040647b
0x00406487
0x0040649b
0x004064a5
0x004064a5
0x004064ae
0x004064c4
0x004064c8
0x004064d5
0x004064d5
0x004064d8
0x004064dd
0x004064e1
0x004064f5
0x004064f5
0x004064fe
0x00406509
0x0040650e
0x00406512
0x0040651a
0x0040651a
0x00406520
0x00406523
0x0040652a
0x0040652a
0x00406523
0x0040650e
0x00406531
0x0040653a
0x0040653c
0x0040653c
0x00406543
0x00406547
0x00406547
0x0040654f
0x00406558
0x0040655a
0x0040655a
0x00406560
0x00406566
0x00406566
0x00406577
0x00406577
0x00406579
0x00000000
0x004064e3
0x004064e3
0x004064e5
0x004064ea
0x004064ef
0x004064f1
0x00000000
0x004064e3
0x004064b5
0x004064b5
0x004064bb
0x004064bd
0x004064bf
0x00000000
0x004064c4
0x00000000
0x004064c4

APIs

GetCurrentThreadId.KERNEL32 ref: 00406489
FreeLibrary.KERNEL32(00400000,?,00000000,?,?,0040658E,00404573,004045BA,?,00000000,004045D3,?,?,?,?,00000000), ref: 0040652A
ExitProcess.KERNEL32(00000000,?,00000000,?,?,0040658E,00404573,004045BA,?,00000000,004045D3,?,?,?,?,00000000), ref: 00406566

Part of subcall function 004063C0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000,?,?,0040658E,00404573,004045BA,?,00000000), ref: 004063F9
Part of subcall function 004063C0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000,?,?,0040658E,00404573,004045BA,?), ref: 004063FF
Part of subcall function 004063C0: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000,?), ref: 0040641A
Part of subcall function 004063C0: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000), ref: 00406420

Strings

MZP, xrefs: 00406529

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: dec44cb456ebba250873fe7d8b642dc8f4059ba9680ba78a678b0ee7370c882a
Instruction ID: d353af26a11dc108d646f0739d3c66120641e06764e28ce13d63044cf6413c24
Opcode Fuzzy Hash: dec44cb456ebba250873fe7d8b642dc8f4059ba9680ba78a678b0ee7370c882a
Instruction Fuzzy Hash: FA318F70A003419BD731AB79A84831A77E0AB05329F06493FE546A77D7D7BCE8A8C71D

Uniqueness

Uniqueness Score: -1.00%

Function 00404368, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404368() {
				intOrPtr _t13;
				intOrPtr* _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;
				void* _t26;
				void* _t28;
				void* _t31;

				_t28 =  *0x00459A5C;
				while(_t28 != 0x459a58) {
					_t2 = _t28 + 4; // 0x459a58
					VirtualFree(_t28, 0, 0x8000); // executed
					_t28 =  *_t2;
				}
				_t25 = 0x37;
				_t13 = 0x457070;
				do {
					 *((intOrPtr*)(_t13 + 0xc)) = _t13;
					 *((intOrPtr*)(_t13 + 8)) = _t13;
					 *((intOrPtr*)(_t13 + 0x10)) = 1;
					 *((intOrPtr*)(_t13 + 0x14)) = 0;
					_t13 = _t13 + 0x20;
					_t25 = _t25 - 1;
				} while (_t25 != 0);
				 *0x459a58 = 0x459a58;
				 *0x00459A5C = 0x459a58;
				_t26 = 0x400;
				_t23 = 0x459af8;
				do {
					_t14 = _t23;
					 *_t14 = _t14;
					_t8 = _t14 + 4; // 0x459af8
					 *_t8 = _t14;
					_t23 = _t23 + 8;
					_t26 = _t26 - 1;
				} while (_t26 != 0);
				 *0x459a74 = 0;
				E004049AC(0x459a78, 0x80);
				_t18 = 0;
				 *0x459a70 = 0;
				_t31 =  *0x0045BB00;
				while(_t31 != 0x45bafc) {
					_t10 = _t31 + 4; // 0x45bafc
					_t18 = VirtualFree(_t31, 0, 0x8000);
					_t31 =  *_t10;
				}
				 *0x45bafc = 0x45bafc;
				 *0x0045BB00 = 0x45bafc;
				return _t18;
			}

0x00404376
0x0040438d
0x0040437b
0x00404386
0x0040438b
0x0040438b
0x00404391
0x00404396
0x0040439b
0x0040439d
0x004043a2
0x004043a5
0x004043ae
0x004043b1
0x004043b4
0x004043b4
0x004043b7
0x004043b9
0x004043bc
0x004043c1
0x004043c6
0x004043c6
0x004043c8
0x004043ca
0x004043ca
0x004043cd
0x004043d0
0x004043d0
0x004043d5
0x004043e6
0x004043eb
0x004043ed
0x004043f2
0x00404409
0x004043f7
0x00404402
0x00404407
0x00404407
0x0040440d
0x0040440f
0x00404416

APIs

VirtualFree.KERNEL32(00459A58,00000000,00008000,?,?,?,?,00404468,0040A004,00000000,0040A030), ref: 00404386
VirtualFree.KERNEL32(0045BAFC,00000000,00008000,00459A58,00000000,00008000,?,?,?,?,00404468,0040A004,00000000,0040A030), ref: 00404402

Strings

ppE, xrefs: 00404396

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID: ppE
API String ID: 1263568516-2184805803
Opcode ID: 5cdf38ba39f976144d6f7f019973d6728aaf33aa9870bfa14787ad1a1d45003d
Instruction ID: 10aa2548ee9bc9a06b63812ac6b8bfea252c66b3b98f8c12bdde64b062849a02
Opcode Fuzzy Hash: 5cdf38ba39f976144d6f7f019973d6728aaf33aa9870bfa14787ad1a1d45003d
Instruction Fuzzy Hash: 45119DB17002008BC7648F189881B1AB6E0E784715F11C47FEA4AEB3C2D778EC028BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406810, Relevance: 4.5, APIs: 3, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00406810(signed char __eax, void* __ecx, void* __edx) {
				intOrPtr _v8;
				signed char _v13;
				void* _t5;
				void* _t11;

				if(__ecx == 0) {
					_t11 =  *__eax;
					if(_t11 != 0) {
						 *__eax = 0;
						_push(__eax);
						L004028B4(); // executed
						_t5 = _t11;
						return _t5;
					}
					return __eax;
				} else {
					_push(__eax);
					_push(__ecx);
					L004028A4(); // executed
					__edx = __edx;
					if(__eax == 0) {
						_push(__ecx);
						_v13 = __eax;
						return E00404574(_v13 & 0x000000ff, _v8);
					} else {
						_push( *__edx);
						 *__edx = __eax;
						L004028B4();
						return __eax;
					}
				}
			}

0x00406812
0x004066a0
0x004066a4
0x004066a6
0x004066ac
0x004066ae
0x004066b3
0x00000000
0x004066b3
0x004066b4
0x00406818
0x00406818
0x00406819
0x0040681b
0x00406822
0x00406823
0x004045c3
0x004045c4
0x004045d5
0x00406829
0x00406829
0x0040682b
0x0040682d
0x00406832
0x00406832
0x00406823

APIs

SysFreeString.OLEAUT32(00000000), ref: 004066AE
SysAllocStringLen.OLEAUT32(00000000,?), ref: 0040681B
SysFreeString.OLEAUT32(?), ref: 0040682D

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: db766332ce9f273ec9987cf776c4382f70e4ddd3d45879878e2049e4727fe115
Instruction ID: 2642ebc01637dafa1d7c2b7ed876b8f14acb0351700065ee9e71307833d511a8
Opcode Fuzzy Hash: db766332ce9f273ec9987cf776c4382f70e4ddd3d45879878e2049e4727fe115
Instruction Fuzzy Hash: D3E0C2FD102201ADFF093F218D05B372368AF91700B24897FB801BA2C2EA7EC811552C

Uniqueness

Uniqueness Score: -1.00%

Function 00450080, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00450080(void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, void* __fp0) {
				char _v5;
				char _v8;
				char _v12;
				char _v28;
				char _v44;
				char _v60;
				void* _t27;
				void* _t71;
				intOrPtr _t73;
				intOrPtr _t74;
				char _t78;
				intOrPtr _t91;
				intOrPtr _t92;
				void* _t93;
				intOrPtr _t97;
				intOrPtr _t98;
				void* _t105;

				_t105 = __fp0;
				_t94 = __esi;
				_t93 = __edi;
				_t78 = __edx;
				_t97 = _t98;
				_t73 = 6;
				do {
					_push(0);
					_push(0);
					_t73 = _t73 - 1;
				} while (_t73 != 0);
				_push(_t73);
				_t1 =  &_v8;
				_t74 =  *_t1;
				 *_t1 = _t73;
				_push(__esi);
				_t103 = __edx;
				if(__edx != 0) {
					_t98 = _t98 + 0xfffffff0;
					_t27 = E0040538C(_t27, _t97);
				}
				_v5 = _t78;
				_t71 = _t27;
				_push(_t97);
				_push(0x4501dc);
				_push( *[fs:eax]);
				 *[fs:eax] = _t98;
				E00442EE4(_t74, 0);
				E00448BD0(L"Scripting.FileSystemObject", _t71,  &_v12, _t93, _t94, _t103); // executed
				_t6 = _t71 + 0x68; // 0x68
				E004297D4(_t6, _v12);
				_t7 = _t71 + 0x68; // 0x68
				E00423A90( &_v28, _t7, 0x450248, 0);
				_t10 = _t71 + 0x78; // 0x78
				E0042990C(_t10, _t71,  &_v28, _t93, _t94, _t105);
				_t11 = _t71 + 0x68; // 0x68
				E00423A90( &_v44, _t11, 0x450248, 1);
				_t14 = _t71 + 0x88; // 0x88
				E0042990C(_t14, _t71,  &_v44, _t93, _t94, _t105);
				_t15 = _t71 + 0x68; // 0x68
				E00423A90( &_v60, _t15, 0x450248, 2);
				_t18 = _t71 + 0x98; // 0x98
				E0042990C(_t18, _t71,  &_v60, _t93, _t94, _t105);
				 *((intOrPtr*)(_t71 + 0x40)) = E0044A6B4(1);
				 *((intOrPtr*)(_t71 + 0x44)) = E00449CB4(1);
				E00449D5C(0);
				_t21 = _t71 + 0x44; // 0xa0000
				E00449D70( *_t21, 0);
				_t22 = _t71 + 0x44; // 0xa0000
				E00449D94( *_t22, E0044FC94, _t71);
				 *((intOrPtr*)(_t71 + 0x50)) = E0044AE3C(1);
				 *((intOrPtr*)(_t71 + 0x4c)) = E0044AD04(1);
				 *0x45e000 = CreateEventW(0, 0, 0, 0);
				_pop(_t91);
				 *[fs:eax] = _t91;
				_push(E004501E3);
				_t92 =  *0x401290; // 0x401294
				E00407A34( &_v60, 3, _t92);
				return E00409938( &_v12);
			}

0x00450080
0x00450080
0x00450080
0x00450080
0x00450081
0x00450084
0x00450089
0x00450089
0x0045008b
0x0045008d
0x0045008d
0x00450090
0x00450091
0x00450091
0x00450091
0x00450095
0x00450096
0x00450098
0x0045009a
0x0045009d
0x0045009d
0x004500a2
0x004500a5
0x004500a9
0x004500aa
0x004500af
0x004500b2
0x004500b9
0x004500c6
0x004500ce
0x004500d1
0x004500dd
0x004500e5
0x004500f0
0x004500f3
0x004500ff
0x00450107
0x00450112
0x00450118
0x00450124
0x0045012c
0x00450137
0x0045013d
0x0045014e
0x0045015f
0x00450166
0x0045016b
0x00450170
0x0045017b
0x0045017e
0x0045018f
0x0045019e
0x004501ae
0x004501b5
0x004501b8
0x004501bb
0x004501c3
0x004501ce
0x004501db

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,0044FC94,0044FB68), ref: 004501A9

Strings

Scripting.FileSystemObject, xrefs: 004500C1

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CreateEvent
String ID: Scripting.FileSystemObject
API String ID: 2692171526-2434688496
Opcode ID: de67e5983d79fa7573055ca2543268dc0fb5d0574171572c42a9ebcb01e43e7c
Instruction ID: 0ab13f544ed766fe1b184997f31bd472f195ab01593ceabb986f56eac18b521e
Opcode Fuzzy Hash: de67e5983d79fa7573055ca2543268dc0fb5d0574171572c42a9ebcb01e43e7c
Instruction Fuzzy Hash: BC419A75A402086BDB00FF65DC82F9E37B9EB04708F40447BF9049B297E679AD49C759

Uniqueness

Uniqueness Score: -1.00%

Function 0044C424, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0044C424(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				short _v532;
				struct HINSTANCE__* _t11;
				intOrPtr* _t23;
				intOrPtr _t30;
				void* _t36;
				void* _t38;

				_t38 = __eflags;
				_v8 = 0;
				_t23 = __eax;
				_push(_t36);
				_push(0x44c499);
				_push( *[fs:eax]);
				 *[fs:eax] = _t36 + 0xfffffdf0;
				_t11 =  *0x45bc50; // 0x400000
				E004067E0(_t23, GetModuleFileNameW(_t11,  &_v532, 0x106),  &_v532, _t38);
				E0044C2B0( *_t23, _t23,  &_v8, __edi, __esi); // executed
				if(_v8 != 0) {
					E00406A38(_t23, _v8);
				}
				_pop(_t30);
				 *[fs:eax] = _t30;
				_push(0x44c4a0);
				return E00406658( &_v8);
			}

0x0044c424
0x0044c430
0x0044c433
0x0044c437
0x0044c438
0x0044c43d
0x0044c440
0x0044c44f
0x0044c464
0x0044c46e
0x0044c477
0x0044c47e
0x0044c47e
0x0044c485
0x0044c488
0x0044c48b
0x0044c498

APIs

GetModuleFileNameW.KERNEL32(MZP,?,00000106,00000000,0044C499), ref: 0044C455

Part of subcall function 0044C2B0: GetLongPathNameW.KERNELBASE(00000000,00000000,00000104), ref: 0044C316

Strings

MZP, xrefs: 0044C454

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Name$FileLongModulePath
String ID: MZP
API String ID: 3672691952-2889622443
Opcode ID: 528d1efe4b0c3648162eaacf6b725be459861dedf602f8dd525d78cb03bfc481
Instruction ID: 1830416ca980862735ecbad21ad03917ea3d1541390be3cecf581fe64c89e466
Opcode Fuzzy Hash: 528d1efe4b0c3648162eaacf6b725be459861dedf602f8dd525d78cb03bfc481
Instruction Fuzzy Hash: FEF0A971600308ABD711EFA5CD9299DB3F9EB48304F5584BAF404D3291EBB89E148A58

Uniqueness

Uniqueness Score: -1.00%

Function 004095E0, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E004095E0(intOrPtr __eax, void* __ebx, signed int* __ecx, signed int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _t37;
				signed short _t39;
				signed short _t42;
				signed int _t59;
				intOrPtr _t72;
				void* _t79;
				signed int* _t81;
				intOrPtr _t84;

				_t79 = __edi;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t81 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E0040673C(_v8);
				E0040673C(_v12);
				_push(_t84);
				_push(0x4096ed);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E00406658(__ecx);
				E00406A80( &_v20, _v12);
				_t37 = _v12;
				if(_t37 != 0) {
					_t37 =  *(_t37 - 4);
				}
				_t59 = _t37;
				if(_t59 < 1) {
					L6:
					_t39 = E00409328(_v8, _t59,  &_v16, _t81); // executed
					_t89 = _v16;
					if(_v16 == 0) {
						L00402834();
						E00408CD4(_t39, _t59,  &_v24, _t79, _t81);
						_t42 = E00409448(_v20, _t59, _t81, _v24, _t79, _t81, __eflags); // executed
						__eflags =  *_t81;
						if( *_t81 == 0) {
							__eflags =  *0x45bb84;
							if( *0x45bb84 == 0) {
								L0040283C();
								E00408CD4(_t42, _t59,  &_v28, _t79, _t81);
								E00409448(_v20, _t59, _t81, _v28, _t79, _t81, __eflags);
							}
						}
						__eflags =  *_t81;
						if(__eflags == 0) {
							E00409514(_v20, _t59, _t81, __eflags); // executed
						}
					} else {
						E00409448(_v20, _t59, _t81, _v16, _t79, _t81, _t89);
					}
					_pop(_t72);
					 *[fs:eax] = _t72;
					_push(E004096F4);
					return E004066B8( &_v28, 6);
				} else {
					while( *((short*)(_v12 + _t59 * 2 - 2)) != 0x2e) {
						_t59 = _t59 - 1;
						__eflags = _t59;
						if(_t59 != 0) {
							continue;
						}
						goto L6;
					}
					E0040766C(_v12, _t59, 1,  &_v20);
					goto L6;
				}
			}

0x004095e0
0x004095e3
0x004095e5
0x004095e7
0x004095e9
0x004095eb
0x004095ed
0x004095ef
0x004095f0
0x004095f1
0x004095f3
0x004095f6
0x004095fc
0x00409604
0x0040960b
0x0040960c
0x00409611
0x00409614
0x00409619
0x00409624
0x00409629
0x0040962e
0x00409633
0x00409633
0x00409635
0x0040963a
0x00409661
0x00409667
0x0040966c
0x00409670
0x00409681
0x00409689
0x00409696
0x0040969b
0x0040969e
0x004096a0
0x004096a7
0x004096a9
0x004096b1
0x004096be
0x004096be
0x004096a7
0x004096c3
0x004096c6
0x004096cd
0x004096cd
0x00409672
0x0040967a
0x0040967a
0x004096d4
0x004096d7
0x004096da
0x004096ec
0x0040963c
0x0040963c
0x0040965c
0x0040965d
0x0040965f
0x00000000
0x00000000
0x00000000
0x0040965f
0x00409655
0x00000000
0x00409655

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,004096ED,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00409776,00000000,?,00000105), ref: 00409681
GetSystemDefaultUILanguage.KERNEL32(00000000,004096ED,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00409776,00000000,?,00000105), ref: 004096A9

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 6ba0054865e58355b2eea97109376d2aa861e19a8b7537488c1daa753bdf125b
Instruction ID: 42ebf1e3cc6dcf26d29af582ba43da463ddc2d2e573697f932f33c4290274d02
Opcode Fuzzy Hash: 6ba0054865e58355b2eea97109376d2aa861e19a8b7537488c1daa753bdf125b
Instruction Fuzzy Hash: AE315270A042099FDB10EB99C892AAEB7B5EF44308F51497BE401B33D2DB79AD41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004096FC, Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096FC(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				short _v530;
				char _v536;
				char _v540;
				void* _t44;
				intOrPtr _t45;
				void* _t49;
				void* _t52;

				_v536 = 0;
				_v540 = 0;
				_v8 = 0;
				_t49 = __eax;
				_push(_t52);
				_push(0x4097b6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t52 + 0xfffffde8;
				GetModuleFileNameW(0,  &_v530, 0x105);
				E00407310( &_v536, _t49);
				_push(_v536);
				E0040734C( &_v540, 0x105,  &_v530);
				_pop(_t44); // executed
				E004095E0(_v540, 0,  &_v8, _t44, __edi, _t49); // executed
				if(_v8 != 0) {
					LoadLibraryExW(E004072B8(_v8), 0, 2);
				}
				_pop(_t45);
				 *[fs:eax] = _t45;
				_push(E004097BD);
				E004066B8( &_v540, 2);
				return E00406658( &_v8);
			}

0x00409709
0x0040970f
0x00409715
0x00409718
0x0040971c
0x0040971d
0x00409722
0x00409725
0x00409738
0x00409745
0x00409750
0x00409762
0x00409770
0x00409771
0x0040977a
0x00409789
0x0040978e
0x00409792
0x00409795
0x00409798
0x004097a8
0x004097b5

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004097B6,?,?,00000000), ref: 00409738
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004097B6,?,?,00000000), ref: 00409789

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 5166978d0c5f05ac38765cac7b362ead30ae45786ff0bcea0a08f45877b0b9c3
Instruction ID: e60c8658266e1a27dc7f5ea87d3cd7fb21265d5796a0d569f42016b7ea9c892e
Opcode Fuzzy Hash: 5166978d0c5f05ac38765cac7b362ead30ae45786ff0bcea0a08f45877b0b9c3
Instruction Fuzzy Hash: 0A116D71A4421C9ADB14EE61CC86BDEB3A8DB08304F5144BBE508A32C1DA785E808AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00420640, Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E00420640(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x4206b2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x420694);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_v12 = LoadLibraryW(E004072B8(_t12));
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(0x42069b);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

0x00420641
0x00420643
0x00420647
0x0042064a
0x0042064f
0x00420654
0x00420655
0x0042065a
0x0042065d
0x00420660
0x00420665
0x00420666
0x0042066b
0x0042066e
0x0042067e
0x00420683
0x00420686
0x00420689
0x0042068e
0x00420690
0x00420693

APIs

SetErrorMode.KERNEL32 ref: 0042064A
LoadLibraryW.KERNEL32(00000000,00000000,00420694,?,00000000,004206B2), ref: 00420679

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 5ca7b46530dd9215fbd2eb68cd4adec72eac62847d82a3fe0e8f106b2a3a9c97
Instruction ID: 309c7d9f6b8318d75b087537756fcf0a4ccf38c35ef8f4b5dbcdf766dac486e4
Opcode Fuzzy Hash: 5ca7b46530dd9215fbd2eb68cd4adec72eac62847d82a3fe0e8f106b2a3a9c97
Instruction Fuzzy Hash: 7CF089707147047FDB115F769C5281A76ECD74EB047D348B5F814A2A91E53C58208569

Uniqueness

Uniqueness Score: -1.00%

Function 00406AAC, Relevance: 3.0, APIs: 2, Instructions: 25
memoryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406AAC(signed char __eax, void* __edx) {
				intOrPtr _v12;
				signed char _v17;

				_t5 = __eax;
				if( *__eax == __edx) {
					L9:
					return _t5;
				} else {
					if(__edx == 0) {
						L3:
						__edx =  *__eax;
						if(__edx != 0) {
							 *__eax = 0;
							_push(__eax);
							L004028B4(); // executed
							__eax = __edx;
							return __eax;
						}
						return __eax;
					} else {
						__ecx =  *(__edx - 4);
						__ecx =  *(__edx - 4) >> 1;
						if(__ecx == 0) {
							goto L3;
						} else {
							_push(__ecx);
							_push(__edx);
							_push(__eax); // executed
							L004028AC(); // executed
							if(__eax == 0) {
								_v17 = __eax;
								return E00404574(_v17 & 0x000000ff, _v12);
							} else {
								goto L9;
							}
						}
					}
				}
			}

0x00406aac
0x00406aae
0x00406ad3
0x00406ad3
0x00406ab0
0x00406ab2
0x004066a0
0x004066a0
0x004066a4
0x004066a6
0x004066ac
0x004066ae
0x004066b3
0x00000000
0x004066b3
0x004066b4
0x00406ab8
0x00406ab8
0x00406abb
0x00406abd
0x00000000
0x00406ac3
0x00406ac3
0x00406ac4
0x00406ac5
0x00406ac6
0x00406acd
0x004045c4
0x004045d5
0x00000000
0x00000000
0x00000000
0x00406acd
0x00406abd
0x00406ab2

APIs

SysFreeString.OLEAUT32(00000000), ref: 004066AE
SysReAllocStringLen.OLEAUT32(?,?,00000000), ref: 00406AC6

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: fbb5440a405564b1febbbc9c76abef2419cfa5aec32665bdebadc9f204d94c53
Instruction ID: d96fdb27bd1c77e601416639931913681c1f52c112c957c7a82c24250a1c41fc
Opcode Fuzzy Hash: fbb5440a405564b1febbbc9c76abef2419cfa5aec32665bdebadc9f204d94c53
Instruction Fuzzy Hash: 32E086B8100101AEEE146E15891573332699BD1700B6ECA7F64037B3C5EA7E9C10CA6C

Uniqueness

Uniqueness Score: -1.00%

Function 00448BD0, Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 00448990: CLSIDFromProgID.OLE32(00000000,?,00000000,004489DD,?,?,?,00000000,?,00448C0A,00000000,00448C33,?,00000000,00448CA5), ref: 004489BD

CoCreateInstance.OLE32(?,00000000,00000005,00448CB4,00000000,00000000,00448C33,?,00000000,00448CA5,?,?,?,0044FB68), ref: 00448C1F

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 9731af81e054f6454e1c1f04a5a95415d00590e4286a04fab8ef8a7e585b457d
Instruction ID: b9daa7b3555414ee3cb6f2a20e583f4b7be5158efbeae5a2658dde894f92c329
Opcode Fuzzy Hash: 9731af81e054f6454e1c1f04a5a95415d00590e4286a04fab8ef8a7e585b457d
Instruction Fuzzy Hash: 4101F771208B046EF705EF61DC53A6E77ACE749700F61483EF900E2680EE385910C479

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAF8, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 0040AB37

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 893f983764a3cc64349f01b41a8bd47decfa517091847523070a1a10c671aacf
Instruction ID: 0e9b3bbd3876f280457851ff45a5bc0c264aa060def781ed6bc042dc26fb0187
Opcode Fuzzy Hash: 893f983764a3cc64349f01b41a8bd47decfa517091847523070a1a10c671aacf
Instruction Fuzzy Hash: F3F07FB6600158AF9B84DE9DDD81E9B77ECEB8C664B05412ABA08E3241D674ED108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0044CDC8, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0044C424: GetModuleFileNameW.KERNEL32(MZP,?,00000106,00000000,0044C499), ref: 0044C455

Part of subcall function 0044C508: LoadTypeLibEx.OLEAUT32(00000000,00000002,00000000), ref: 0044C53E

InterlockedExchange.KERNEL32(00000000,?), ref: 0044CE04

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: ExchangeFileInterlockedLoadModuleNameType
String ID:
API String ID: 2952622022-0
Opcode ID: dce050dca76b9641de69783cd2729fe9c765bf0158edea4f7d86ce9f7d4fae44
Instruction ID: 4c979b793f5cd67335d079554131f2a4b35528bd2b7daeccac37a0b7c77109e9
Opcode Fuzzy Hash: dce050dca76b9641de69783cd2729fe9c765bf0158edea4f7d86ce9f7d4fae44
Instruction Fuzzy Hash: 56F04431501248AFEB50EF52CC92B9DB7E8EB04714F6544B6E504A7551D7786E04CA94

Uniqueness

Uniqueness Score: -1.00%

Function 0044C508, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

LoadTypeLibEx.OLEAUT32(00000000,00000002,00000000), ref: 0044C53E

Part of subcall function 004066A0: SysFreeString.OLEAUT32(00000000), ref: 004066AE

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FreeLoadStringType
String ID:
API String ID: 1535477946-0
Opcode ID: ead050abda8437752e4abc7fdf852a3732b875513417b9d3c48024a6f41cf680
Instruction ID: dcbe22b312051902b627a34b7e3c20d38e3fd46bd02eac93b6afdef2bcb78b50
Opcode Fuzzy Hash: ead050abda8437752e4abc7fdf852a3732b875513417b9d3c48024a6f41cf680
Instruction Fuzzy Hash: 8CF0A0717047087BE711EB668C43A6D73DCDB48B18FA1487AB900E2682DA7CAE10946A

Uniqueness

Uniqueness Score: -1.00%

Function 00418934, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000400,00000001,00000000,0044FB68,00000000,?,?,?,00000001,00000000,0041951A,00000000,0041954A,?,?,0044FBE0), ref: 0041896B

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 96742ad55efcbeea9274bc45fdfe921c839fa205ecd8e5ebb7d96b6198e24fb1
Instruction ID: 91a36842b454e0dda9006ea28d2feaafa38ae5742450e61239df231b6e527677
Opcode Fuzzy Hash: 96742ad55efcbeea9274bc45fdfe921c839fa205ecd8e5ebb7d96b6198e24fb1
Instruction Fuzzy Hash: 3EE092B3B0132927E52064AE5C81E77A64C8B85765B05027EFE04B7245C955AC0141B5

Uniqueness

Uniqueness Score: -1.00%

Function 004196A8, Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,?,?,004336F8,0043D155,00000000,0043D23C,?,?,004336F8), ref: 004196F1

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 874151b45f31b1497d68f1e3f0381d5f648aa1c67bb36e0ea27544d7203e4480
Instruction ID: bacbed10faa9c712f3c82f561271e4f885ecadc4ebf0ad3707ebc717ea8259ec
Opcode Fuzzy Hash: 874151b45f31b1497d68f1e3f0381d5f648aa1c67bb36e0ea27544d7203e4480
Instruction Fuzzy Hash: 10E0D8A3B0051426F22069AD9C91F57524C8741775F060236FF50EB2D2C858DC0082E9

Uniqueness

Uniqueness Score: -1.00%

Function 00448990, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,004489DD,?,?,?,00000000,?,00448C0A,00000000,00448C33,?,00000000,00448CA5), ref: 004489BD

Part of subcall function 004066A0: SysFreeString.OLEAUT32(00000000), ref: 004066AE

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: c040f8ddf73383cfb45d10cbde4b339751bb433e0ee7519d9c788b154b0594a9
Instruction ID: d24566f821b531a7c0f657e5094b622ab27b0a39e32ee872925123c8968e9668
Opcode Fuzzy Hash: c040f8ddf73383cfb45d10cbde4b339751bb433e0ee7519d9c788b154b0594a9
Instruction Fuzzy Hash: B4E0E5B16046047FE700EB72CC43D6E77DCDB49714B61087BF900A2681D93CAD10946D

Uniqueness

Uniqueness Score: -1.00%

Function 004084B8, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 004084D6

Part of subcall function 004096FC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004097B6,?,?,00000000), ref: 00409738
Part of subcall function 004096FC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004097B6,?,?,00000000), ref: 00409789

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 726082db263f3aef730a60029177e3f16da6ba7c0bbeca0ef25bfe12156f950d
Instruction ID: 84a50274850c95b4fc87c18cfcdc9180fa5da4c171fbecd4e53eb16d17106fab
Opcode Fuzzy Hash: 726082db263f3aef730a60029177e3f16da6ba7c0bbeca0ef25bfe12156f950d
Instruction Fuzzy Hash: 34E06DB1A003108BCF10DE5CC9C5A4333D8AB08714F00496AAC54DF387E775DD1087E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(?,00000000), ref: 0040676A

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 5f293853e579235df59ddffc3cbd8cfeaf861dff443e9f7eaa5e4097a6389a0d
Instruction ID: 7c190c308cff0dc503c60dfeb07588169fff2f6a40eec2b029ac594f9979db96
Opcode Fuzzy Hash: 5f293853e579235df59ddffc3cbd8cfeaf861dff443e9f7eaa5e4097a6389a0d
Instruction Fuzzy Hash: 4AD023F41001025EE7044E2C854093B73655FD1300314C37E60036F2C0EB39C402D724

Uniqueness

Uniqueness Score: -1.00%

Function 004066A0, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 004066AE

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: a96d3c20b4833c09fa3b6750171d0cb23c67ce649bde5ef5ce66f0d82a468a31
Instruction ID: c502c5c1cef0633c5af99a67c5ba2c6b5651eed214efe9880cf31f798dc04ea7
Opcode Fuzzy Hash: a96d3c20b4833c09fa3b6750171d0cb23c67ce649bde5ef5ce66f0d82a468a31
Instruction Fuzzy Hash: 16B092F91012009EFA15AB118851B23327AABD1710F39C9AEA800AA29ADB7998409668

Uniqueness

Uniqueness Score: -1.00%

Function 004442B4, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00449B38,00000000,?,004444E7,0044FB68,?,00000000,00400000,00000000,00000000,00000000), ref: 004442D2

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 68a60080fb768f31ebd65d5cb418667255a1d9fa2e291803da4fd291a68f6701
Instruction ID: 77fa880584012e28bc63f315bc8d7d1e79ded3dccadb1c75ade54c8151365eee
Opcode Fuzzy Hash: 68a60080fb768f31ebd65d5cb418667255a1d9fa2e291803da4fd291a68f6701
Instruction Fuzzy Hash: BA119E346003058FD310DF59D880B46F7E4EF88394F10C53AE9599B389D374E8048BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402E1A, Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00402E4B
VirtualQuery.KERNEL32(?,?,0000001C), ref: 00402E6E
VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00402E7B

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Virtual$Free$Query
String ID:
API String ID: 778034434-0
Opcode ID: 46db51c03f94f0b55a5d5ed18350963a882af4d12aac357629f417569eeef35f
Instruction ID: e79334c6d38df843aeded41591f3acccd51a3776b8de312ccba62099ce4a3d8c
Opcode Fuzzy Hash: 46db51c03f94f0b55a5d5ed18350963a882af4d12aac357629f417569eeef35f
Instruction Fuzzy Hash: 64F08B303006109BC310DB1ACA48B17B7E1EFC4750F15817AE888973E0D374DC028796

Uniqueness

Uniqueness Score: -1.00%

Function 004443CC, Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,00444C16), ref: 0044440C

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a277b6ede2e4e1ccaaad787190262fb7e493dece75c6f6604c5528a647473398
Instruction ID: 3a62e856c490924b10446b7761548bf5b5c7c55fb8365b70514fbf882d0671d3
Opcode Fuzzy Hash: a277b6ede2e4e1ccaaad787190262fb7e493dece75c6f6604c5528a647473398
Instruction Fuzzy Hash: 33F0E972B403214BE3306FD6BCC0B27B285AFC4B56F10003AAE055BB56C5689C06436C

Uniqueness

Uniqueness Score: -1.00%

Function 00402CF8, Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,0040330B), ref: 00402D0E

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: df224ea6630a00a52af4ea486a655afc24b4455ea9b2b2d91d9e6f7d0e8df90f
Instruction ID: 93498578c0424601ab996eb324d49ed78f060ddd2facf5658391812f14bd015b
Opcode Fuzzy Hash: df224ea6630a00a52af4ea486a655afc24b4455ea9b2b2d91d9e6f7d0e8df90f
Instruction Fuzzy Hash: 90F04FF1B013808BEF599F798E453057AE5A789305F10813EE909DB7DAE7748C068B14

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408E18, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 151
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00408E18(WCHAR* __eax, int __edx) {
				WCHAR* _v8;
				int _v12;
				WCHAR* _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				short _v1134;
				signed int _t50;
				signed int _t51;
				signed int _t56;
				signed int _t57;
				signed int _t101;
				signed int _t102;
				intOrPtr* _t103;
				WCHAR* _t110;
				struct HINSTANCE__* _t111;
				WCHAR* _t113;
				short* _t114;
				void* _t115;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t111 = GetModuleHandleW(L"kernel32.dll");
				if(_t111 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t113 =  &(_v8[2]);
						goto L10;
					} else {
						if(_v8[1] == 0x5c) {
							_t114 = E00408DF4( &(_v8[2]));
							if( *_t114 != 0) {
								_t14 = _t114 + 2; // 0x2
								_t113 = E00408DF4(_t14);
								if( *_t113 != 0) {
									L10:
									_t101 = _t113 - _v8;
									_t102 = _t101 >> 1;
									if(_t101 < 0) {
										asm("adc ebx, 0x0");
									}
									lstrcpynW( &_v1134, _v8, _t102 + 1);
									while( *_t113 != 0) {
										_t110 = E00408DF4( &(_t113[1]));
										_t50 = _t110 - _t113;
										_t51 = _t50 >> 1;
										if(_t50 < 0) {
											asm("adc eax, 0x0");
										}
										if(_t51 + _t102 + 1 <= 0x105) {
											_t56 = _t110 - _t113;
											_t57 = _t56 >> 1;
											if(_t56 < 0) {
												asm("adc eax, 0x0");
											}
											lstrcpynW( &_v1134 + _t102 + _t102, _t113, _t57 + 1);
											_v20 = FindFirstFileW( &_v1134,  &_v612);
											if(_v20 != 0xffffffff) {
												FindClose(_v20);
												if(lstrlenW( &(_v612.cFileName)) + _t102 + 1 + 1 <= 0x105) {
													 *((short*)(_t115 + _t102 * 2 - 0x46a)) = 0x5c;
													lstrcpynW( &(( &_v1134 + _t102 + _t102)[1]),  &(_v612.cFileName), 0x105 - _t102 - 1);
													_t102 = _t102 + lstrlenW( &(_v612.cFileName)) + 1;
													_t113 = _t110;
													continue;
												}
											}
										}
										goto L23;
									}
									lstrcpynW(_v8,  &_v1134, _v12);
								}
							}
						}
					}
				} else {
					_t103 = GetProcAddress(_t111, "GetLongPathNameW");
					if(_t103 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v1134);
						_push(_v8);
						if( *_t103() == 0) {
							goto L4;
						} else {
							lstrcpynW(_v8,  &_v1134, _v12);
						}
					}
				}
				L23:
				return _v16;
			}

0x00408e24
0x00408e27
0x00408e2d
0x00408e3a
0x00408e3e
0x00408e80
0x00408e87
0x00408ec7
0x00000000
0x00408e89
0x00408e91
0x00408ea2
0x00408ea8
0x00408eae
0x00408eb6
0x00408ebc
0x00408eca
0x00408ecc
0x00408ecf
0x00408ed1
0x00408ed3
0x00408ed3
0x00408ee5
0x00408fb4
0x00408ef7
0x00408efb
0x00408efd
0x00408eff
0x00408f01
0x00408f01
0x00408f0c
0x00408f14
0x00408f16
0x00408f18
0x00408f1a
0x00408f1a
0x00408f2d
0x00408f45
0x00408f4c
0x00408f56
0x00408f72
0x00408f74
0x00408f9e
0x00408fb0
0x00408fb2
0x00000000
0x00408fb2
0x00408f72
0x00408f4c
0x00000000
0x00408f0c
0x00408fcd
0x00408fcd
0x00408ebc
0x00408ea8
0x00408e91
0x00408e40
0x00408e4b
0x00408e4f
0x00000000
0x00408e51
0x00408e51
0x00408e5c
0x00408e60
0x00408e65
0x00000000
0x00408e67
0x00408e76
0x00408e76
0x00408e65
0x00408e4f
0x00408fd2
0x00408fdb

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,?), ref: 00408E35
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 00408E46
lstrcpynW.KERNEL32(?,?,?), ref: 00408E76
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,00000000,?,?), ref: 00408EE5
lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,00000000,?,?), ref: 00408F2D
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,00000000,?,?), ref: 00408F40
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,00000000,?,?), ref: 00408F56
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,00000000,?,?), ref: 00408F62
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,00000000,?), ref: 00408F9E
lstrlenW.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,00000000), ref: 00408FAA
lstrcpynW.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 00408FCD

Strings

GetLongPathNameW, xrefs: 00408E40
\, xrefs: 00408F74
kernel32.dll, xrefs: 00408E30

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 3245196872-3908791685
Opcode ID: 6fc662dbf38172c3357a5624cd4637a0eaa083cf6f2ddcde574d068a31360b0c
Instruction ID: c2c30a56847bddfd7ab489ca50c73ff6f6231bf7b6b259a2dc63f07ee1febca5
Opcode Fuzzy Hash: 6fc662dbf38172c3357a5624cd4637a0eaa083cf6f2ddcde574d068a31360b0c
Instruction Fuzzy Hash: 0F518872D006199BDB10EAA8CD85ADF73B9AF04310F1445BEE544F72C1EB78EE448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0043D5F0, Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0043D5F0(void* __eax, struct HINSTANCE__* __edx, WCHAR* _a8) {
				WCHAR* _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				void* _t23;
				WCHAR* _t24;
				void* _t25;
				struct HRSRC__* _t29;
				void* _t30;
				struct HINSTANCE__* _t31;
				void* _t32;

				_v8 = _t24;
				_t31 = __edx;
				_t23 = __eax;
				_t29 = FindResourceW(__edx, _v8, _a8);
				 *(_t23 + 0x10) = _t29;
				if(_t29 == 0) {
					E0043D550(_t23, _t24, _t29, _t31, _t32);
					_pop(_t24);
				}
				_t5 = _t23 + 0x10; // 0x43d68c
				_t30 = LoadResource(_t31,  *_t5);
				 *(_t23 + 0x14) = _t30;
				if(_t30 == 0) {
					E0043D550(_t23, _t24, _t30, _t31, _t32);
				}
				_t7 = _t23 + 0x10; // 0x43d68c
				_push(SizeofResource(_t31,  *_t7));
				_t8 = _t23 + 0x14; // 0x43cd40
				_t18 = LockResource( *_t8);
				_pop(_t25);
				return E0043D29C(_t23, _t25, _t18);
			}

0x0043d5f7
0x0043d5fa
0x0043d5fc
0x0043d60c
0x0043d60e
0x0043d613
0x0043d616
0x0043d61b
0x0043d61b
0x0043d61c
0x0043d626
0x0043d628
0x0043d62d
0x0043d630
0x0043d635
0x0043d636
0x0043d640
0x0043d641
0x0043d645
0x0043d64e
0x0043d659

APIs

FindResourceW.KERNEL32(00400000,?,?,00433D98,00400000,00000001,00000000,?,0043D532,00000000,?,?,?,00000001,?,004567F2), ref: 0043D607
LoadResource.KERNEL32(00400000,0043D68C,00400000,?,?,00433D98,00400000,00000001,00000000,?,0043D532,00000000,?,?,?,00000001), ref: 0043D621
SizeofResource.KERNEL32(00400000,0043D68C,00400000,0043D68C,00400000,?,?,00433D98,00400000,00000001,00000000,?,0043D532,00000000,?), ref: 0043D63B
LockResource.KERNEL32(0043CD40,00000000,00400000,0043D68C,00400000,0043D68C,00400000,?,?,00433D98,00400000,00000001,00000000,?,0043D532,00000000), ref: 0043D645

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 21bff3148a18287d3aedc3b092e0fefbb2716f759b33f6cfee4408a0480238ba
Instruction ID: 5c6506a372c44ba7d4ae1c09265ccc7c3082bd2654578311fad079b234c7f6c5
Opcode Fuzzy Hash: 21bff3148a18287d3aedc3b092e0fefbb2716f759b33f6cfee4408a0480238ba
Instruction Fuzzy Hash: AFF04BB3A002046F8745EE5DA881D5B77ECAE9C264B10006BF918D7246DA38DD2187B9

Uniqueness

Uniqueness Score: -1.00%

Function 004089BC, Relevance: 4.6, APIs: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E004089BC(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				short _v182;
				short _v352;
				char _v356;
				char _v360;
				char _v364;
				int _t58;
				signed int _t61;
				intOrPtr _t70;
				signed short _t80;
				void* _t83;
				void* _t85;
				void* _t86;

				_t77 = __edi;
				_push(__edi);
				_v356 = 0;
				_v360 = 0;
				_v364 = 0;
				_v8 = __edx;
				_t80 = __eax;
				_push(_t83);
				_push(0x408b21);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83 + 0xfffffe98;
				E00406658(_v8);
				_t85 = _t80 -  *0x4579f8; // 0x404
				if(_t85 >= 0) {
					_t86 = _t80 -  *0x457bf8; // 0x7c68
					if(_t86 <= 0) {
						_t77 = 0x40;
						_v12 = 0;
						if(0x40 >= _v12) {
							do {
								_t61 = _t77 + _v12 >> 1;
								if(_t80 >=  *((intOrPtr*)(0x4579f8 + _t61 * 8))) {
									__eflags = _t80 -  *((intOrPtr*)(0x4579f8 + _t61 * 8));
									if(__eflags <= 0) {
										E004088CC( *((intOrPtr*)(0x4579fc + _t61 * 8)), _t61, _v8, _t77, _t80, __eflags);
									} else {
										_v12 = _t61 + 1;
										goto L8;
									}
								} else {
									_t77 = _t61 - 1;
									goto L8;
								}
								goto L9;
								L8:
							} while (_t77 >= _v12);
						}
					}
				}
				L9:
				if( *_v8 == 0 && IsValidLocale(_t80 & 0x0000ffff, 2) != 0) {
					_t58 = _t80 & 0x0000ffff;
					GetLocaleInfoW(_t58, 0x59,  &_v182, 0x55);
					GetLocaleInfoW(_t58, 0x5a,  &_v352, 0x55);
					E0040734C( &_v356, 0x55,  &_v182);
					_push(_v356);
					_push(0x408b3c);
					E0040734C( &_v360, 0x55,  &_v352);
					_push(_v360);
					_push(E00408B4C);
					E0040734C( &_v364, 0x55,  &_v182);
					_push(_v364);
					E00407584(_v8, _t58, 5, _t77, _t80);
				}
				_pop(_t70);
				 *[fs:eax] = _t70;
				_push(E00408B28);
				return E004066B8( &_v364, 3);
			}

0x004089bc
0x004089c7
0x004089ca
0x004089d0
0x004089d6
0x004089dc
0x004089df
0x004089e3
0x004089e4
0x004089e9
0x004089ec
0x004089f2
0x004089f7
0x004089fe
0x00408a00
0x00408a07
0x00408a09
0x00408a10
0x00408a16
0x00408a18
0x00408a1d
0x00408a27
0x00408a2e
0x00408a36
0x00408a48
0x00408a38
0x00408a39
0x00000000
0x00408a39
0x00408a29
0x00408a2b
0x00000000
0x00408a2b
0x00000000
0x00408a4f
0x00408a4f
0x00408a18
0x00408a16
0x00408a07
0x00408a54
0x00408a5a
0x00408a7e
0x00408a82
0x00408a93
0x00408aa9
0x00408aae
0x00408ab4
0x00408aca
0x00408acf
0x00408ad5
0x00408aeb
0x00408af0
0x00408afe
0x00408afe
0x00408b05
0x00408b08
0x00408b0b
0x00408b20

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,00408B21,?,00000000,?,00000000), ref: 00408A66
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,00408B21,?,00000000,?,00000000), ref: 00408A82
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,00408B21,?,00000000,?,00000000), ref: 00408A93

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 22d8cb12e7d1f52442a32d621a72acb218c697269971090c3e0ead149c1e2666
Instruction ID: 31816f5ccf34b3f7f43ecd365d394b29b5cc4e2708a66eaf846b7fd251117c9b
Opcode Fuzzy Hash: 22d8cb12e7d1f52442a32d621a72acb218c697269971090c3e0ead149c1e2666
Instruction Fuzzy Hash: 4831C471A046089BDF21EB54DD81BDF77B9EB48701F1105BFA548732D1DA386E84CE19

Uniqueness

Uniqueness Score: -1.00%

Function 00451718, Relevance: 3.8, Strings: 3, Instructions: 93
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00451718(void* __edx, void* __fp0) {
				intOrPtr _t12;
				intOrPtr _t14;
				intOrPtr _t16;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t28;
				void* _t41;

				E0045165C();
				 *0x45e0e4 = E00404484(0x2000);
				 *0x45e0ec = E00404484(0x7f6);
				 *0x45e0f0 = E00404484(0x7f6);
				 *0x45e308 = E00404484(0x2000);
				 *0x45e30c = E00404484(0x1fe);
				_t12 =  *0x45e0e4; // 0x0
				E004049AC(_t12, 0x2000);
				_t14 =  *0x45e0ec; // 0x0
				E004049AC(_t14, 0x7f6);
				_t16 =  *0x45e0f0; // 0x0
				E004049AC(_t16, 0x7f6);
				_t18 =  *0x45e308; // 0x0
				E004049AC(_t18, 0x2000);
				_t20 =  *0x45e30c; // 0x0
				E004049AC(_t20, 0x1fe);
				 *0x45efe4 = 0;
				 *0x45e0d8 = 0;
				 *0x45e0da = 0;
				 *0x45e0dc = 0;
				 *0x45e0de = 0;
				 *0x45e0e0 = 0;
				 *0x45e0e8 = 0;
				E004049AC(0x45e0f4, 0x200);
				E004049AC(0x45e2f4, 0x13);
				 *0x45e310 = 0;
				 *0x45e314 = E00404484(0x3fe);
				_t28 =  *0x45e314; // 0x0
				E004049AC(_t28, 0x3fe);
				E004049AC(0x45e318, 0x22);
				 *0x45e33a = 0;
				E004049AC(0x45e33c, 0x7f6);
				E004049AC(0x45eb32, 0x36);
				E004049AC(0x45eb68, 0x4a);
				E004049AC(0x45ebb2, 0x3fc);
				_t41 = E004049AC(0x45efae, 0x26);
				 *0x45efd4 = 0;
				 *0x45efd6 = 0;
				 *0x45efd8 = 0;
				 *0x45efda = 0;
				 *0x45efdc = 0;
				 *0x45efde = 0;
				 *0x45efe0 = 0;
				 *0x45efe2 = 0;
				return _t41;
			}

0x00451718
0x00451727
0x00451736
0x00451745
0x00451754
0x00451763
0x00451768
0x00451774
0x00451779
0x00451785
0x0045178a
0x00451796
0x0045179b
0x004517a7
0x004517ac
0x004517b8
0x004517bd
0x004517c6
0x004517cf
0x004517d8
0x004517e1
0x004517ea
0x004517f3
0x00451808
0x00451819
0x0045181e
0x00451831
0x00451836
0x00451842
0x00451853
0x00451858
0x0045186d
0x0045187e
0x0045188f
0x004518a0
0x004518b1
0x004518b6
0x004518bf
0x004518c8
0x004518d1
0x004518da
0x004518e3
0x004518ec
0x004518f5
0x004518fe

Strings

2E, xrefs: 00451872
hE, xrefs: 00451883
<E, xrefs: 00451861

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID:
String ID: 2E$<E$hE
API String ID: 0-925739447
Opcode ID: 152aebfc650d6525299d6768cf576a3b77aa4014acd52c5b80e87ccc96b29c26
Instruction ID: 1a1a3f1a65cadfddee93f524ab4eabfac3b1f91d0ff0c3955709e5308388c631
Opcode Fuzzy Hash: 152aebfc650d6525299d6768cf576a3b77aa4014acd52c5b80e87ccc96b29c26
Instruction Fuzzy Hash: DC31BAA061431156E74CAB6AE45632B3291EBC830AF10903EF5069B2E3DB7DCA55879E

Uniqueness

Uniqueness Score: -1.00%

Function 0044F3E4, Relevance: 3.1, APIs: 2, Instructions: 127COMMON

Download Yara Rule

APIs

CreateBindCtx.OLE32(00000000,00000000), ref: 0044F461
MkParseDisplayNameEx.URLMON(?,00000000,?,00000000), ref: 0044F485

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: BindCreateDisplayNameParse
String ID:
API String ID: 3124428456-0
Opcode ID: 7feb372e847c9447aacf95262d0fa698a7a73ae3358fed42abc39ebb35e8538e
Instruction ID: 8c1ec592f10d06e07d34161727b25623b9214c2fa973a7c44177970975884378
Opcode Fuzzy Hash: 7feb372e847c9447aacf95262d0fa698a7a73ae3358fed42abc39ebb35e8538e
Instruction Fuzzy Hash: F04133B5A001099FDB00EF65D8819DE77B9FF49314B11847AF900E7362DB38ED058BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004197A4, Relevance: 3.0, APIs: 2, Instructions: 23
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004197A4(void* __eax) {
				struct _WIN32_FIND_DATAW _v596;
				void* _t11;

				_t11 = FindFirstFileW(E004072B8(__eax),  &_v596);
				if(_t11 == 0xffffffff) {
					return 0;
				}
				return FindClose(_t11) & 0xffffff00 | (_v596.dwFileAttributes & 0x00000010) == 0x00000000;
			}

0x004197bf
0x004197c7
0x00000000
0x004197db
0x00000000

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,?,0041986B,00000000,?,?,00000001,00456B77,?,?,?,?,?,00000005), ref: 004197BF
FindClose.KERNEL32(00000000,00000000,?,00000000,?,0041986B,00000000,?,?,00000001,00456B77,?), ref: 004197CA

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 53e43887202254b3bf8cb9bd86dd50929c27cfafd8bbb6f4203e87b3af68803a
Instruction ID: 959c51b3cb224053326e4c2c471bdd2b26c4cd2e226f9682ffbba4c953fc5917
Opcode Fuzzy Hash: 53e43887202254b3bf8cb9bd86dd50929c27cfafd8bbb6f4203e87b3af68803a
Instruction Fuzzy Hash: 54E0CD3151430C12C71065B90CC969B73DC1F04325F040BBB7C2CE39D2E63CDA9000AE

Uniqueness

Uniqueness Score: -1.00%

Function 00412816, Relevance: 2.9, Instructions: 2860COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917cd42067991ceb7ce0fe5197c38df47a8433928eda23641d915da347d54371
Instruction ID: f53cef29b3aa282c71d659f99581e5043bd25f9f26fffa6d725693162d2b965a
Opcode Fuzzy Hash: 917cd42067991ceb7ce0fe5197c38df47a8433928eda23641d915da347d54371
Instruction Fuzzy Hash: 1A33868AA4E7C10FE303477099656906F719F6726AF2F45EB80D9CF1E3E55C894AC322

Uniqueness

Uniqueness Score: -1.00%

Function 00419CF4, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 00419D15

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: a69c900bfaa10d319b25d7fecb6ce37beb017d01010d022262c651b2690b1e48
Instruction ID: e30747e21c124f3c142110857c1895219b73afd6567c45531432e4abb2213a1a
Opcode Fuzzy Hash: a69c900bfaa10d319b25d7fecb6ce37beb017d01010d022262c651b2690b1e48
Instruction Fuzzy Hash: 791100B5E00209AFDB00CF99C881DAFB7F9EFC8304B14C569A404E7250E6319E418B90

Uniqueness

Uniqueness Score: -1.00%

Function 0041D5D8, Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041D5F6

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9ef8582702aae24bf13ebae2876fb876fe12c1a796aaa81127c0adba4e8c8569
Instruction ID: fd2140c7687814ae6b0221584b385d61656bdf661b8b30dbf6f9ace9821c5ade
Opcode Fuzzy Hash: 9ef8582702aae24bf13ebae2876fb876fe12c1a796aaa81127c0adba4e8c8569
Instruction Fuzzy Hash: CBE0D872B0031817D310A5598C86AFBB25C978C300F40427FBD09D7383EEB89D6547E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041F038, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,0045633A,00000000,00456365), ref: 0041F046

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: a446ad9ae7d2fe1b57c3ac30641f15db2d576487ccf306fa7b1a676f181d4b1b
Instruction ID: f86d1593c8c6e4621ec5c9e600b7dc7e122a183f3d3b6ca447a9c75ee01ed4e2
Opcode Fuzzy Hash: a446ad9ae7d2fe1b57c3ac30641f15db2d576487ccf306fa7b1a676f181d4b1b
Instruction Fuzzy Hash: 5DF01D789083019FC344DF18E8426557BE5FB48302F40887EE884C73A2E379DC488F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042053C, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00420360,00000002,?,?,00420635,0041DA85,?,00000000,0041DAC6,?,?,?,00000000,00000000), ref: 00420569

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 3b6fe942ed2a50db71fef99ae923f1066459b3562a9b8e81c4df99462c997cc2
Instruction ID: 1042387f0491a04feb4764da1a7d4e86217ffd090032093bff069d6c25d1c88c
Opcode Fuzzy Hash: 3b6fe942ed2a50db71fef99ae923f1066459b3562a9b8e81c4df99462c997cc2
Instruction Fuzzy Hash: 10E0DF52700A2097C220F7AA1883B9A76819F44BA4F088137BD08AB3C3D93E0C5006EE

Uniqueness

Uniqueness Score: -1.00%

Function 0041D624, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,0041D70C,?,00000001,00000000,0041D91B), ref: 0041D637

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1977669524f6f83aa256ded4ba7b5450e58b0d4d915b8112ae6e0bce1eabc79c
Instruction ID: 10cf7c9bab5d796c398816fe4608beb8514a77b696b4b27a4cb81f12bf1d6eed
Opcode Fuzzy Hash: 1977669524f6f83aa256ded4ba7b5450e58b0d4d915b8112ae6e0bce1eabc79c
Instruction Fuzzy Hash: A2D05EE63092206AE210915BAD85DBB56DCCBC5761F14443BBA4CC6242E228CC46D376

Uniqueness

Uniqueness Score: -1.00%

Function 0042037C, Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000400,00000000,00420420,?,00000000,00420503,?,?,?,00000000,00000000,?,00420376), ref: 00420397

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5789e8b2d34f9f8cc052b0ee65c417b388c9476a9a84c8fff50f75aa152dcbdb
Instruction ID: cc37a42323eb48dfaaf225ad5dec4c030b410a541396a3624dbd941186b5d962
Opcode Fuzzy Hash: 5789e8b2d34f9f8cc052b0ee65c417b388c9476a9a84c8fff50f75aa152dcbdb
Instruction Fuzzy Hash: 79D0A7E1F2420013F60462959C42B2631889F84704F10403C7B84973C0EE7C781992BF

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB80, Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0041BB84

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 10ee40279e76053cc7b342670719d24015b48e5c33f121a09ee5c115de8b3f36
Instruction ID: 0faca3ef6f0ece7c1252b17d6fe5b453a7d1bc479e6f60a4f22e90b814ab1887
Opcode Fuzzy Hash: 10ee40279e76053cc7b342670719d24015b48e5c33f121a09ee5c115de8b3f36
Instruction Fuzzy Hash: 61A0120080482001C54073190C0313431405800720FC84B5578F8502D1F92D01318097

Uniqueness

Uniqueness Score: -1.00%

Function 00407E34, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction ID: 06eb546eeaeab13a44efd80395d03707096c3a97053ba3a813aaad898d98d5b1
Opcode Fuzzy Hash: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction Fuzzy Hash: F201C432B053110B870CDD3ECD9852ABAC3ABD8910F09C63E9589D76C8DD318C1AC286

Uniqueness

Uniqueness Score: -1.00%

Function 00404CA8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0e43f82692c6785844f3e70bb209c8b319b1924ab6e756aa91dc1deac9637f
Instruction ID: 0d0a1de50f84049ba1db36b0cc2a5815bbe2a70d1702ee3e31d84e551ae84beb
Opcode Fuzzy Hash: ae0e43f82692c6785844f3e70bb209c8b319b1924ab6e756aa91dc1deac9637f
Instruction Fuzzy Hash: 8DD012EE23A10656F776C06D68A0B631547E7C0315F26CC3BE502E6FC0D17ECCA0A118

Uniqueness

Uniqueness Score: -1.00%

Function 00421FA0, Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00421FA0() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleW(L"oleaut32.dll");
				 *0x45df00 = E00421F74("VariantChangeTypeEx", E00421AB8, _t91);
				 *0x45df04 = E00421F74("VarNeg", E00421B00, _t91);
				 *0x45df08 = E00421F74("VarNot", E00421B00, _t91);
				 *0x45df0c = E00421F74("VarAdd", E00421B0C, _t91);
				 *0x45df10 = E00421F74("VarSub", E00421B0C, _t91);
				 *0x45df14 = E00421F74("VarMul", E00421B0C, _t91);
				 *0x45df18 = E00421F74("VarDiv", E00421B0C, _t91);
				 *0x45df1c = E00421F74("VarIdiv", E00421B0C, _t91);
				 *0x45df20 = E00421F74("VarMod", E00421B0C, _t91);
				 *0x45df24 = E00421F74("VarAnd", E00421B0C, _t91);
				 *0x45df28 = E00421F74("VarOr", E00421B0C, _t91);
				 *0x45df2c = E00421F74("VarXor", E00421B0C, _t91);
				 *0x45df30 = E00421F74("VarCmp", E00421B18, _t91);
				 *0x45df34 = E00421F74("VarI4FromStr", E00421B24, _t91);
				 *0x45df38 = E00421F74("VarR4FromStr", E00421B90, _t91);
				 *0x45df3c = E00421F74("VarR8FromStr", E00421C00, _t91);
				 *0x45df40 = E00421F74("VarDateFromStr", E00421C70, _t91);
				 *0x45df44 = E00421F74("VarCyFromStr", E00421CE0, _t91);
				 *0x45df48 = E00421F74("VarBoolFromStr", E00421D50, _t91);
				 *0x45df4c = E00421F74("VarBstrFromCy", E00421DD0, _t91);
				 *0x45df50 = E00421F74("VarBstrFromDate", E00421E58, _t91);
				_t46 = E00421F74("VarBstrFromBool", E00421EE0, _t91);
				 *0x45df54 = _t46;
				return _t46;
			}

0x00421fae
0x00421fc2
0x00421fd8
0x00421fee
0x00422004
0x0042201a
0x00422030
0x00422046
0x0042205c
0x00422072
0x00422088
0x0042209e
0x004220b4
0x004220ca
0x004220e0
0x004220f6
0x0042210c
0x00422122
0x00422138
0x0042214e
0x00422164
0x0042217a
0x0042218a
0x00422190
0x00422197

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 00421FA9

Part of subcall function 00421F74: GetProcAddress.KERNEL32(00000000), ref: 00421F8D

Strings

VarSub, xrefs: 0042200F
VarI4FromStr, xrefs: 004220D5
VarBstrFromDate, xrefs: 0042216F
VarAnd, xrefs: 0042207D
VarMul, xrefs: 00422025
VarIdiv, xrefs: 00422051
VarDateFromStr, xrefs: 00422117
VarR8FromStr, xrefs: 00422101
VarBstrFromCy, xrefs: 00422159
VarDiv, xrefs: 0042203B
VarBoolFromStr, xrefs: 00422143
VariantChangeTypeEx, xrefs: 00421FB7
VarNot, xrefs: 00421FE3
VarBstrFromBool, xrefs: 00422185
VarNeg, xrefs: 00421FCD
oleaut32.dll, xrefs: 00421FA4
VarCyFromStr, xrefs: 0042212D
VarOr, xrefs: 00422093
VarMod, xrefs: 00422067
VarAdd, xrefs: 00421FF9
VarR4FromStr, xrefs: 004220EB
VarXor, xrefs: 004220A9
VarCmp, xrefs: 004220BF

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 9f368a8b1535f46e80897168a8ee1d046f32eb549a4dc20980ad3daa11e2e0f9
Instruction ID: 40e5a962484a58f9322c094e994643a36cc7ffb4c4ca6f455a0de5ddf045b3d9
Opcode Fuzzy Hash: 9f368a8b1535f46e80897168a8ee1d046f32eb549a4dc20980ad3daa11e2e0f9
Instruction Fuzzy Hash: DD415D22F083246B13146B6E7A0142637D8DBA43167E1C2BBF415CB276DF7CB942862E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A194, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0040A194(void* __eflags, intOrPtr _a4, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				long _v16;
				void* _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				struct HINSTANCE__** _v48;
				CHAR* _v52;
				void _v56;
				long _v60;
				_Unknown_base(*)()* _v64;
				struct HINSTANCE__* _v68;
				CHAR* _v72;
				signed int _v76;
				CHAR* _v80;
				intOrPtr* _v84;
				void* _v88;
				void _v92;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				long _t113;
				intOrPtr* _t119;
				void* _t124;
				void _t126;
				long _t128;
				struct HINSTANCE__* _t142;
				long _t166;
				signed int* _t190;
				_Unknown_base(*)()* _t191;
				void* _t194;
				intOrPtr _t196;

				_push(_a4);
				memcpy( &_v56, 0x457c30, 8 << 2);
				_pop(_t194);
				_v56 =  *0x457c30;
				_v52 = E0040A644( *0x00457C34);
				_v48 = E0040A654( *0x00457C38);
				_v44 = E0040A664( *0x00457C3C);
				_v40 = E0040A674( *0x00457C40);
				_v36 = E0040A674( *0x00457C44);
				_v32 = E0040A674( *0x00457C48);
				_v28 =  *0x00457C4C;
				memcpy( &_v92, 0x457c50, 9 << 2);
				_t196 = _t194;
				_v88 = 0x457c50;
				_v84 = _a8;
				_v80 = _v52;
				if((_v56 & 0x00000001) == 0) {
					_t166 =  *0x457c74; // 0x0
					_v8 = _t166;
					_v8 =  &_v92;
					RaiseException(0xc06d0057, 0, 1,  &_v8);
					return 0;
				}
				_t104 = _a8 - _v44;
				_t142 =  *_v48;
				if(_t104 < 0) {
					_t104 = _t104 + 3;
				}
				_v12 = _t104 >> 2;
				_t106 = _v12;
				_t190 = (_t106 << 2) + _v40;
				_t108 = (_t106 & 0xffffff00 | (_t190[0] & 0x00000080) == 0x00000000) & 0x00000001;
				_v76 = _t108;
				if(_t108 == 0) {
					_v72 =  *_t190 & 0x0000ffff;
				} else {
					_v72 = E0040A684( *_t190) + 2;
				}
				_t191 = 0;
				if( *0x45bc58 == 0) {
					L10:
					if(_t142 != 0) {
						L25:
						_v68 = _t142;
						if( *0x45bc58 != 0) {
							_t191 =  *0x45bc58(2,  &_v92);
						}
						if(_t191 != 0) {
							L36:
							if(_t191 == 0) {
								_v60 = GetLastError();
								if( *0x45bc5c != 0) {
									_t191 =  *0x45bc5c(4,  &_v92);
								}
								if(_t191 == 0) {
									_t113 =  *0x457c7c; // 0x0
									_v24 = _t113;
									_v24 =  &_v92;
									RaiseException(0xc06d007f, 0, 1,  &_v24);
									_t191 = _v64;
								}
							}
							goto L41;
						} else {
							if( *((intOrPtr*)(_t196 + 0x14)) == 0 ||  *((intOrPtr*)(_t196 + 0x1c)) == 0) {
								L35:
								_t191 = GetProcAddress(_t142, _v72);
								goto L36;
							} else {
								_t119 =  *((intOrPtr*)(_t142 + 0x3c)) + _t142;
								if( *_t119 != 0x4550 ||  *((intOrPtr*)(_t119 + 8)) != _v28 || (( *(_t119 + 0x34) & 0xffffff00 |  *(_t119 + 0x34) == _t142) & 0x00000001) == 0) {
									goto L35;
								} else {
									_t191 =  *((intOrPtr*)(_v36 + _v12 * 4));
									if(_t191 == 0) {
										goto L35;
									}
									L41:
									 *_a8 = _t191;
									goto L42;
								}
							}
						}
					}
					if( *0x45bc58 != 0) {
						_t142 =  *0x45bc58(1,  &_v92);
					}
					if(_t142 == 0) {
						_t142 = LoadLibraryA(_v80);
					}
					if(_t142 != 0) {
						L20:
						if(_t142 == E0040A03C(_v48, _t142)) {
							FreeLibrary(_t142);
						} else {
							if( *((intOrPtr*)(_t196 + 0x18)) != 0) {
								_t124 = LocalAlloc(0x40, 8);
								_v20 = _t124;
								if(_t124 != 0) {
									 *((intOrPtr*)(_v20 + 4)) = _t196;
									_t126 =  *0x457c2c; // 0x0
									 *_v20 = _t126;
									 *0x457c2c = _v20;
								}
							}
						}
						goto L25;
					} else {
						_v60 = GetLastError();
						if( *0x45bc5c != 0) {
							_t142 =  *0x45bc5c(3,  &_v92);
						}
						if(_t142 != 0) {
							goto L20;
						} else {
							_t128 =  *0x457c78; // 0x0
							_v16 = _t128;
							_v16 =  &_v92;
							RaiseException(0xc06d007e, 0, 1,  &_v16);
							return _v64;
						}
					}
				} else {
					_t191 =  *0x45bc58(0,  &_v92);
					if(_t191 == 0) {
						goto L10;
					} else {
						L42:
						if( *0x45bc58 != 0) {
							_v60 = 0;
							_v68 = _t142;
							_v64 = _t191;
							 *0x45bc58(5,  &_v92);
						}
						return _t191;
					}
				}
			}

0x0040a1a8
0x0040a1ae
0x0040a1b0
0x0040a1b3
0x0040a1c0
0x0040a1cd
0x0040a1da
0x0040a1e7
0x0040a1f4
0x0040a201
0x0040a20a
0x0040a218
0x0040a21a
0x0040a21b
0x0040a221
0x0040a227
0x0040a22e
0x0040a230
0x0040a236
0x0040a23c
0x0040a24c
0x00000000
0x0040a251
0x0040a25e
0x0040a263
0x0040a265
0x0040a267
0x0040a267
0x0040a26d
0x0040a270
0x0040a278
0x0040a282
0x0040a285
0x0040a28a
0x0040a2a5
0x0040a28c
0x0040a298
0x0040a298
0x0040a2a8
0x0040a2b1
0x0040a2ca
0x0040a2cc
0x0040a38e
0x0040a38e
0x0040a398
0x0040a3a6
0x0040a3a6
0x0040a3aa
0x0040a3f7
0x0040a3f9
0x0040a400
0x0040a40a
0x0040a418
0x0040a418
0x0040a41c
0x0040a41e
0x0040a423
0x0040a429
0x0040a439
0x0040a43e
0x0040a43e
0x0040a41c
0x00000000
0x0040a3ac
0x0040a3b0
0x0040a3eb
0x0040a3f5
0x00000000
0x0040a3b8
0x0040a3bb
0x0040a3c3
0x00000000
0x0040a3dc
0x0040a3e2
0x0040a3e7
0x00000000
0x00000000
0x0040a441
0x0040a444
0x00000000
0x0040a444
0x0040a3c3
0x0040a3b0
0x0040a3aa
0x0040a2d9
0x0040a2e7
0x0040a2e7
0x0040a2eb
0x0040a2f6
0x0040a2f6
0x0040a2fa
0x0040a347
0x0040a353
0x0040a389
0x0040a355
0x0040a359
0x0040a35f
0x0040a364
0x0040a369
0x0040a370
0x0040a376
0x0040a37b
0x0040a380
0x0040a380
0x0040a369
0x0040a359
0x00000000
0x0040a2fc
0x0040a301
0x0040a30b
0x0040a319
0x0040a319
0x0040a31d
0x00000000
0x0040a31f
0x0040a31f
0x0040a324
0x0040a32a
0x0040a33a
0x00000000
0x0040a33f
0x0040a31d
0x0040a2b3
0x0040a2bf
0x0040a2c3
0x00000000
0x0040a2c5
0x0040a446
0x0040a44d
0x0040a451
0x0040a454
0x0040a457
0x0040a460
0x0040a460
0x00000000
0x0040a466
0x0040a2c3

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040A24C

Strings

0|E, xrefs: 0040A1A9
P|E, xrefs: 0040A20E

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID: 0|E$P|E
API String ID: 3997070919-523040147
Opcode ID: 5954d4bcf07b1a336b95c84aead8cf2607c592cb666f8b93fa4553561189e641
Instruction ID: c93129aa7cf0baa7b76bd6b573931db69f35b4f2a5d5d66544aeadbdaaabdbf8
Opcode Fuzzy Hash: 5954d4bcf07b1a336b95c84aead8cf2607c592cb666f8b93fa4553561189e641
Instruction Fuzzy Hash: 5DA16A75A003099BDB11DFA8D884BAEB7B5EB48310F14813EE905B73C1DB78A954CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408CD4, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 76
stringCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E00408CD4(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v8;
				void* _t17;
				signed short _t27;
				intOrPtr _t32;
				intOrPtr* _t41;
				intOrPtr _t44;

				_t39 = __edi;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t41 = __edx;
				_t27 = __eax;
				_push(_t44);
				_push(0x408dd7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t44;
				EnterCriticalSection(0x45bb88);
				if(_t27 !=  *0x45bba0) {
					LeaveCriticalSection(0x45bb88);
					E00406658(_t41);
					if(IsValidLocale(_t27 & 0x0000ffff, 2) != 0) {
						if( *0x45bb84 == 0) {
							_t17 = E004089BC(_t27, _t27, _t41, __edi, _t41);
							L0040283C();
							if(_t27 != _t17) {
								if( *_t41 != 0) {
									_t17 = E004074A4(_t41, E00408DF0);
								}
								L0040283C();
								E004089BC(_t17, _t27,  &_v8, _t39, _t41);
								E004074A4(_t41, _v8);
							}
						} else {
							E00408BB8(_t27, _t41);
						}
					}
					EnterCriticalSection(0x45bb88);
					 *0x45bba0 = _t27;
					lstrcpynW("en-US,en,", E004072B8( *_t41), 0xaa);
					LeaveCriticalSection(0x45bb88);
				} else {
					E0040734C(_t41, 0x55, 0x45bba2);
					LeaveCriticalSection(0x45bb88);
				}
				_pop(_t32);
				 *[fs:eax] = _t32;
				_push(E00408DDE);
				return E00406658( &_v8);
			}

0x00408cd4
0x00408cd7
0x00408cd9
0x00408cda
0x00408cdb
0x00408cdd
0x00408ce1
0x00408ce2
0x00408ce7
0x00408cea
0x00408cf2
0x00408cfe
0x00408d25
0x00408d2c
0x00408d3e
0x00408d47
0x00408d58
0x00408d5d
0x00408d65
0x00408d6a
0x00408d73
0x00408d73
0x00408d78
0x00408d80
0x00408d8a
0x00408d8a
0x00408d49
0x00408d4d
0x00408d4d
0x00408d47
0x00408d94
0x00408d99
0x00408db2
0x00408dbc
0x00408d00
0x00408d0c
0x00408d16
0x00408d16
0x00408dc3
0x00408dc6
0x00408dc9
0x00408dd6

APIs

EnterCriticalSection.KERNEL32(0045BB88,00000000,00408DD7,?,?,?,00000000,?,0040968E,00000000,004096ED,?,?,00000000,00000000,00000000), ref: 00408CF2
LeaveCriticalSection.KERNEL32(0045BB88,0045BB88,00000000,00408DD7,?,?,?,00000000,?,0040968E,00000000,004096ED,?,?,00000000,00000000), ref: 00408D16
LeaveCriticalSection.KERNEL32(0045BB88,0045BB88,00000000,00408DD7,?,?,?,00000000,?,0040968E,00000000,004096ED,?,?,00000000,00000000), ref: 00408D25
IsValidLocale.KERNEL32(00000000,00000002,0045BB88,0045BB88,00000000,00408DD7,?,?,?,00000000,?,0040968E,00000000,004096ED), ref: 00408D37
EnterCriticalSection.KERNEL32(0045BB88,00000000,00000002,0045BB88,0045BB88,00000000,00408DD7,?,?,?,00000000,?,0040968E,00000000,004096ED), ref: 00408D94
lstrcpynW.KERNEL32(en-US,en,,00000000,000000AA,0045BB88,00000000,00000002,0045BB88,0045BB88,00000000,00408DD7,?,?,?,00000000,?,0040968E), ref: 00408DB2
LeaveCriticalSection.KERNEL32(0045BB88,en-US,en,,00000000,000000AA,0045BB88,00000000,00000002,0045BB88,0045BB88,00000000,00408DD7,?,?,?,00000000), ref: 00408DBC

Strings

en-US,en,, xrefs: 00408D02, 00408DAD

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValidlstrcpyn
String ID: en-US,en,
API String ID: 1058953229-3579323720
Opcode ID: c90a6f4bf5471e2db4ad462926f1109f64fb3b94faa9531e5b3c785343bc0c4a
Instruction ID: 4bb9a4b5a2d9a9df3f6fa1c1ca5a960aafda3b99239787928e5e36d2f6294bf0
Opcode Fuzzy Hash: c90a6f4bf5471e2db4ad462926f1109f64fb3b94faa9531e5b3c785343bc0c4a
Instruction Fuzzy Hash: 3521A124B403546BD61077AA8E1763A3258DF90719F60413FB880B36C7CFFCAC0482AE

Uniqueness

Uniqueness Score: -1.00%

Function 00403DFC, Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 285
windowCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00403DFC(void* __eax, void* __fp0) {
				void* _v8;
				char _v110600;
				char _v112644;
				char _v112645;
				signed int _v112652;
				char _v112653;
				char _v112654;
				char _v112660;
				intOrPtr _v112664;
				intOrPtr _v112668;
				intOrPtr _v112672;
				signed short* _v112676;
				void* _v112680;
				char _v129064;
				char _v131113;
				char _v161832;
				void* _t74;
				int _t80;
				intOrPtr _t83;
				intOrPtr _t94;
				CHAR* _t98;
				intOrPtr _t100;
				void* _t112;
				intOrPtr _t113;
				intOrPtr _t119;
				intOrPtr _t124;
				void* _t134;
				intOrPtr _t135;
				intOrPtr _t139;
				signed int _t149;
				int _t154;
				intOrPtr _t155;
				char* _t157;
				char* _t158;
				char* _t159;
				char* _t160;
				char* _t161;
				char* _t162;
				char* _t164;
				char* _t165;
				char* _t170;
				char* _t171;
				intOrPtr _t203;
				void* _t205;
				void* _t206;
				intOrPtr* _t209;
				void* _t211;
				void* _t212;
				signed int _t217;
				void* _t220;
				void* _t221;
				void* _t234;

				_push(__eax);
				_t74 = 0x27;
				goto L1;
				L12:
				while(_t203 != 0x459a58) {
					_t80 = E004038FC(_t203);
					_t154 = _t80;
					__eflags = _t154;
					if(_t154 == 0) {
						L11:
						_t20 = _t203 + 4; // 0x459a58
						_t203 =  *_t20;
						continue;
					} else {
						goto L4;
					}
					do {
						L4:
						_t217 =  *(_t154 - 4);
						__eflags = _t217 & 0x00000001;
						if((_t217 & 0x00000001) == 0) {
							__eflags = _t217 & 0x00000004;
							if(__eflags == 0) {
								__eflags = _v112652 - 0x1000;
								if(_v112652 < 0x1000) {
									_v112664 = (_t217 & 0xfffffff0) - 4;
									_t149 = E00403BE8(_t154);
									__eflags = _t149;
									if(_t149 == 0) {
										_v112645 = 0;
										 *((intOrPtr*)(_t220 + _v112652 * 4 - 0x1f824)) = _v112664;
										_t18 =  &_v112652;
										 *_t18 = _v112652 + 1;
										__eflags =  *_t18;
									}
								}
							} else {
								E00403C40(_t154, __eflags, _t220);
							}
						}
						_t80 = E004038D8(_t154);
						_t154 = _t80;
						__eflags = _t154;
					} while (_t154 != 0);
					goto L11;
				}
				_t155 =  *0x45bb00; // 0x45bafc
				while(_t155 != 0x45bafc && _v112652 < 0x1000) {
					_t80 = E00403BE8(_t155 + 0x10);
					__eflags = _t80;
					if(_t80 == 0) {
						_v112645 = 0;
						_t22 = _t155 + 0xc; // 0x0
						_t80 = _v112652;
						 *((intOrPtr*)(_t220 + _t80 * 4 - 0x1f824)) = ( *_t22 & 0xfffffff0) - 0xfffffffffffffff4;
						_t27 =  &_v112652;
						 *_t27 = _v112652 + 1;
						__eflags =  *_t27;
					}
					_t29 = _t155 + 4; // 0x45bafc
					_t155 =  *_t29;
				}
				if(_v112645 != 0) {
					L54:
					return _t80;
				}
				_v112653 = 0;
				_v112668 = 0;
				_t83 =  *0x45704c; // 0x402980
				_t157 = E004039C8(E00406B68(_t83),  &_v161832);
				_v112660 = 0x37;
				_v112676 = 0x457072;
				_v112680 =  &_v110600;
				do {
					_v112672 = ( *_v112676 & 0x0000ffff) - 4;
					_v112654 = 0;
					_t205 = 0xff;
					_t209 = _v112680;
					while(_t157 <=  &_v131113) {
						if( *_t209 > 0) {
							if(_v112653 == 0) {
								_t139 =  *0x457050; // 0x4029ac
								_t157 = E004039C8(E00406B68(_t139), _t157);
								_v112653 = 1;
							}
							if(_v112654 != 0) {
								 *_t157 = 0x2c;
								_t162 = _t157 + 1;
								 *_t162 = 0x20;
								_t163 = _t162 + 1;
								__eflags = _t162 + 1;
							} else {
								 *_t157 = 0xd;
								 *((char*)(_t157 + 1)) = 0xa;
								_t170 = E00403978(_v112668 + 1, _t157 + 2);
								 *_t170 = 0x20;
								_t171 = _t170 + 1;
								 *_t171 = 0x2d;
								 *((char*)(_t171 + 1)) = 0x20;
								_t134 = E00403978(_v112672, _t171 + 2);
								_t135 =  *0x457058; // 0x402a14
								_t163 = E004039C8(E00406B68(_t135), _t134);
								_v112654 = 1;
							}
							_t112 = _t205 - 1;
							_t234 = _t112;
							if(_t234 < 0) {
								_t113 =  *0x45705c; // 0x402a20
								_t164 = E004039C8(E00406B68(_t113), _t163);
							} else {
								if(_t234 == 0) {
									_t119 =  *0x457060; // 0x402a28
									_t164 = E004039C8(E00406B68(_t119), _t163);
								} else {
									if(_t112 == 1) {
										_t124 =  *0x457064; // 0x402a34
										_t164 = E004039C8(E00406B68(_t124), _t163);
									} else {
										_t164 = E004039E0( *((intOrPtr*)(_t209 - 4)), _t163);
									}
								}
							}
							 *_t164 = 0x20;
							_t165 = _t164 + 1;
							 *_t165 = 0x78;
							 *((char*)(_t165 + 1)) = 0x20;
							_t157 = E00403978( *_t209, _t165 + 2);
						}
						_t205 = _t205 - 1;
						_t209 = _t209 - 8;
						if(_t205 != 0xffffffff) {
							continue;
						} else {
							goto L39;
						}
					}
					L39:
					if(_v112654 != 0 ||  *0x459a56 == 0 || (_v112672 + 0x00000004 & 0x0000000f) == 0) {
						_v112668 = _v112672;
					}
					_v112680 = _v112680 + 0x800;
					_v112676 =  &(_v112676[0x10]);
					_t61 =  &_v112660;
					 *_t61 = _v112660 - 1;
				} while ( *_t61 != 0);
				if(_v112652 <= 0) {
					L53:
					_t94 =  *0x457068; // 0x402a44
					E004039C8(E00406B68(_t94), _t157);
					_t98 =  *0x45706c; // 0x402a48
					_t80 = MessageBoxA(0,  &_v161832, _t98, 0x2010);
					goto L54;
				}
				if(_v112653 != 0) {
					 *_t157 = 0xd;
					_t159 = _t157 + 1;
					 *_t159 = 0xa;
					_t160 = _t159 + 1;
					 *_t160 = 0xd;
					_t161 = _t160 + 1;
					 *_t161 = 0xa;
					_t157 = _t161 + 1;
				}
				_t100 =  *0x457054; // 0x4029d4
				_t157 = E004039C8(E00406B68(_t100), _t157);
				_t211 = _v112652 - 1;
				if(_t211 >= 0) {
					_t212 = _t211 + 1;
					_t206 = 0;
					_v112680 =  &_v129064;
					L49:
					L49:
					if(_t206 != 0) {
						 *_t157 = 0x2c;
						_t158 = _t157 + 1;
						 *_t158 = 0x20;
						_t157 = _t158 + 1;
					}
					_t157 = E00403978( *_v112680, _t157);
					if(_t157 >  &_v131113) {
						goto L53;
					}
					_t206 = _t206 + 1;
					_v112680 = _v112680 + 4;
					_t212 = _t212 - 1;
					if(_t212 != 0) {
						goto L49;
					}
				}
				L1:
				_t221 = _t221 + 0xfffff004;
				_push(_t74);
				_t74 = _t74 - 1;
				if(_t74 != 0) {
					goto L1;
				} else {
					E004049AC( &_v112644, 0x1b800);
					E004049AC( &_v129064, 0x4000);
					_t80 = 0;
					_v112652 = 0;
					_v112645 = 1;
					_t203 =  *0x459a5c; // 0x459a58
					goto L12;
				}
			}

0x00403dff
0x00403e00
0x00403e00
0x00000000
0x00403edb
0x00403e5b
0x00403e60
0x00403e62
0x00403e64
0x00403ed8
0x00403ed8
0x00403ed8
0x00000000
0x00000000
0x00000000
0x00000000
0x00403e66
0x00403e66
0x00403e6b
0x00403e6d
0x00403e73
0x00403e75
0x00403e7b
0x00403e88
0x00403e92
0x00403e9a
0x00403ea2
0x00403ea7
0x00403ea9
0x00403eab
0x00403ebe
0x00403ec5
0x00403ec5
0x00403ec5
0x00403ec5
0x00403ea9
0x00403e7d
0x00403e80
0x00403e85
0x00403e7b
0x00403ecd
0x00403ed2
0x00403ed4
0x00403ed4
0x00000000
0x00403e66
0x00403ee7
0x00403f26
0x00403ef4
0x00403ef9
0x00403efb
0x00403efd
0x00403f04
0x00403f10
0x00403f16
0x00403f1d
0x00403f1d
0x00403f1d
0x00403f1d
0x00403f23
0x00403f23
0x00403f23
0x00403f41
0x004041f5
0x004041fb
0x004041fb
0x00403f47
0x00403f50
0x00403f56
0x00403f72
0x00403f74
0x00403f7e
0x00403f8e
0x00403f94
0x00403fa0
0x00403fa6
0x00403fad
0x00403fb8
0x00403fba
0x00403fcb
0x00403fd8
0x00403fda
0x00403ff2
0x00403ff4
0x00403ff4
0x00404002
0x0040405a
0x0040405d
0x0040405e
0x00404061
0x00404061
0x00404004
0x00404004
0x00404008
0x0040401a
0x0040401c
0x0040401f
0x00404020
0x00404024
0x00404030
0x00404037
0x0040404f
0x00404051
0x00404051
0x00404064
0x00404064
0x00404067
0x00404070
0x00404088
0x00404069
0x00404069
0x0040408c
0x004040a4
0x0040406b
0x0040406c
0x004040a8
0x004040c0
0x0040406e
0x004040ce
0x004040ce
0x0040406c
0x00404069
0x004040d0
0x004040d3
0x004040d4
0x004040d8
0x004040e5
0x004040e5
0x004040e7
0x004040e8
0x004040ee
0x00000000
0x00000000
0x00000000
0x00000000
0x004040ee
0x004040f4
0x004040fb
0x00404119
0x00404119
0x0040411f
0x00404129
0x00404130
0x00404130
0x00404130
0x00404143
0x004041c4
0x004041c4
0x004041d7
0x004041e1
0x004041f0
0x00000000
0x004041f0
0x0040414c
0x0040414e
0x00404151
0x00404152
0x00404155
0x00404156
0x00404159
0x0040415a
0x0040415d
0x0040415d
0x0040415e
0x00404176
0x0040417e
0x00404181
0x00404183
0x00404184
0x0040418c
0x00000000
0x00404192
0x00404194
0x00404196
0x00404199
0x0040419a
0x0040419d
0x0040419d
0x004041ad
0x004041b7
0x00000000
0x00000000
0x004041b9
0x004041ba
0x004041c1
0x004041c2
0x00000000
0x00000000
0x004041c2
0x00403e05
0x00403e05
0x00403e0b
0x00403e0c
0x00403e0d
0x00000000
0x00403e0f
0x00403e28
0x00403e3a
0x00403e3f
0x00403e41
0x00403e47
0x00403e4e
0x00000000
0x00403e4e

APIs

MessageBoxA.USER32 ref: 004041F0

Strings

rpE, xrefs: 00403F7E
7, xrefs: 00403F74
H*@, xrefs: 004041E1
D*@, xrefs: 004041C4, 004041D2
, xrefs: 00404129
(*@, xrefs: 0040408C, 0040409A
4*@, xrefs: 004040A8, 004040B6
*@, xrefs: 00404070, 0040407E

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Message
String ID: $ *@$(*@$4*@$7$D*@$H*@$rpE
API String ID: 2030045667-3765007398
Opcode ID: c1b89ad8b1cb0265aed2f80cef4b13710795bec722ea45bc6ca04962a9cec31f
Instruction ID: 0678694b72a95103bfda41ccff67a1229dbd03a6b63b6794ed8c28a7fd55e14e
Opcode Fuzzy Hash: c1b89ad8b1cb0265aed2f80cef4b13710795bec722ea45bc6ca04962a9cec31f
Instruction Fuzzy Hash: 33B1B370A042548BDB20AB2DDC84B997BF8AB49705F0441F6E549FB3C2CB789E85CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041D650, Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 210
threadCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0041D650(int __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				int _t54;
				void* _t116;
				void* _t123;
				void* _t146;
				void* _t147;
				intOrPtr _t197;
				signed short _t205;
				int _t207;
				intOrPtr _t209;
				intOrPtr _t210;

				_t204 = __edi;
				_t209 = _t210;
				_t147 = 7;
				do {
					_push(0);
					_push(0);
					_t147 = _t147 - 1;
				} while (_t147 != 0);
				_push(__edi);
				_t146 = __edx;
				_t207 = __eax;
				_push(_t209);
				_push(0x41d91b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t210;
				_t54 = IsValidLocale(__eax, 1);
				_t212 = _t54;
				if(_t54 == 0) {
					_t207 = GetThreadLocale();
				}
				E0041DB08(_t207, _t146, _t146, _t204, _t207);
				E0041DBC4(_t207, _t146, _t146, _t204, _t207);
				E0041D5D8(_t207, 0, 0x14,  &_v20);
				E00406A38(_t146, _v20);
				E0041D5D8(_t207, 0x41d938, 0x1b,  &_v24);
				 *((char*)(_t146 + 4)) = E004193D8(0x41d938, 0, _t212);
				E0041D5D8(_t207, 0x41d938, 0x1c,  &_v28);
				 *((char*)(_t146 + 0xc2)) = E004193D8(0x41d938, 0, _t212);
				 *((short*)(_t146 + 0xbc)) = E0041D624(_t207, 0x2c, 0xf);
				 *((short*)(_t146 + 0xbe)) = E0041D624(_t207, 0x2e, 0xe);
				E0041D5D8(_t207, 0x41d938, 0x19,  &_v32);
				 *((char*)(_t146 + 5)) = E004193D8(0x41d938, 0, _t212);
				_t205 = E0041D624(_t207, 0x2f, 0x1d);
				 *(_t146 + 6) = _t205;
				_push(_t205);
				E0041DCD4(_t207, _t146, L"m/d/yy", 0x1f, _t205, _t207, _t212,  &_v36);
				E00406A38(_t146 + 0xc, _v36);
				_push( *(_t146 + 6) & 0x0000ffff);
				E0041DCD4(_t207, _t146, L"mmmm d, yyyy", 0x20, _t205, _t207, _t212,  &_v40);
				E00406A38(_t146 + 0x10, _v40);
				 *((short*)(_t146 + 8)) = E0041D624(_t207, 0x3a, 0x1e);
				E0041D5D8(_t207, 0x41d98c, 0x28,  &_v44);
				E00406A38(_t146 + 0x14, _v44);
				E0041D5D8(_t207, 0x41d9a0, 0x29,  &_v48);
				E00406A38(_t146 + 0x18, _v48);
				E00406658( &_v12);
				E00406658( &_v16);
				E0041D5D8(_t207, 0x41d938, 0x25,  &_v52);
				_t116 = E004193D8(0x41d938, 0, _t212);
				_t213 = _t116;
				if(_t116 != 0) {
					E00406A80( &_v8, 0x41d9c4);
				} else {
					E00406A80( &_v8, 0x41d9b4);
				}
				E0041D5D8(_t207, 0x41d938, 0x23,  &_v56);
				_t123 = E004193D8(0x41d938, 0, _t213);
				_t214 = _t123;
				if(_t123 == 0) {
					E0041D5D8(_t207, 0x41d938, 0x1005,  &_v60);
					if(E004193D8(0x41d938, 0, _t214) != 0) {
						E00406A80( &_v12, L"AMPM ");
					} else {
						E00406A80( &_v16, L" AMPM");
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E00407584(_t146 + 0x1c, _t146, 4, _t205, _t207);
				_push(_v12);
				_push(_v8);
				_push(L":mm:ss");
				_push(_v16);
				E00407584(_t146 + 0x20, _t146, 4, _t205, _t207);
				 *((short*)(_t146 + 0xa)) = E0041D624(_t207, 0x2c, 0xc);
				 *((short*)(_t146 + 0xc0)) = 0x32;
				_pop(_t197);
				 *[fs:eax] = _t197;
				_push(0x41d922);
				return E004066B8( &_v60, 0xe);
			}

0x0041d650
0x0041d651
0x0041d653
0x0041d658
0x0041d658
0x0041d65a
0x0041d65c
0x0041d65c
0x0041d661
0x0041d662
0x0041d664
0x0041d668
0x0041d669
0x0041d66e
0x0041d671
0x0041d677
0x0041d67c
0x0041d67e
0x0041d685
0x0041d685
0x0041d68b
0x0041d694
0x0041d6a6
0x0041d6b0
0x0041d6c5
0x0041d6d4
0x0041d6e7
0x0041d6f6
0x0041d70c
0x0041d723
0x0041d73a
0x0041d749
0x0041d75c
0x0041d75e
0x0041d762
0x0041d773
0x0041d77e
0x0041d787
0x0041d798
0x0041d7a3
0x0041d7b8
0x0041d7cc
0x0041d7d7
0x0041d7ec
0x0041d7f7
0x0041d7ff
0x0041d807
0x0041d81c
0x0041d826
0x0041d82b
0x0041d82d
0x0041d846
0x0041d82f
0x0041d837
0x0041d837
0x0041d85b
0x0041d865
0x0041d86a
0x0041d86c
0x0041d87e
0x0041d88f
0x0041d8a8
0x0041d891
0x0041d899
0x0041d899
0x0041d88f
0x0041d8ad
0x0041d8b0
0x0041d8b3
0x0041d8b8
0x0041d8c3
0x0041d8c8
0x0041d8cb
0x0041d8ce
0x0041d8d3
0x0041d8de
0x0041d8f3
0x0041d8f7
0x0041d902
0x0041d905
0x0041d908
0x0041d91a

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,0041D91B,?,?,?,?,00000000,00000000), ref: 0041D677
GetThreadLocale.KERNEL32(?,00000001,00000000,0041D91B,?,?,?,?,00000000,00000000), ref: 0041D680

Part of subcall function 0041D624: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,0041D70C,?,00000001,00000000,0041D91B), ref: 0041D637

Part of subcall function 0041D5D8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041D5F6

Strings

m/d/yy, xrefs: 0041D767
:mm:ss, xrefs: 0041D8CE
AMPM , xrefs: 0041D8A3
mmmm d, yyyy, xrefs: 0041D78C
AMPM, xrefs: 0041D894
2, xrefs: 0041D8F7
:mm, xrefs: 0041D8B3

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 8c10872fa2866d7b944067105b44def863acfa2919ce0bfe04c86eb51bfe3d54
Instruction ID: aab801c9097ddfa8edf027946ed711a791b944e9f705da724640f11c4718f36c
Opcode Fuzzy Hash: 8c10872fa2866d7b944067105b44def863acfa2919ce0bfe04c86eb51bfe3d54
Instruction Fuzzy Hash: 9B7140B0B001589BDB01FBA5C851ADE77AADF49304F50807BF505BB286DB3CDE868769

Uniqueness

Uniqueness Score: -1.00%

Function 0041E30C, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0041E30C(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char* _v8;
				long _v12;
				short _v140;
				short _v2188;
				void* _t15;
				char* _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t30;
				long _t48;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t61;
				void* _t64;

				_push(__ebx);
				_push(__esi);
				_v8 = 0;
				_push(_t64);
				_push(0x41e431);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t64 + 0xfffff778;
				_t61 = E0041E114(_t15, __ebx,  &_v2188, __edx, __edi, __esi, 0x400);
				_t17 =  *0x458bac; // 0x459058
				if( *_t17 == 0) {
					_t19 =  *0x4589d0; // 0x40b070
					_t11 = _t19 + 4; // 0xffe7
					_t21 =  *0x45bc50; // 0x400000
					LoadStringW(E00408500(_t21),  *_t11,  &_v140, 0x40);
					MessageBoxW(0,  &_v2188,  &_v140, 0x2010);
				} else {
					_t30 =  *0x458a14; // 0x459340
					E004045D8(E00404948(_t30));
					_t48 = WideCharToMultiByte(1, 0,  &_v2188, _t61, 0, 0, 0, 0);
					_push(_t48);
					E0040843C();
					WideCharToMultiByte(1, 0,  &_v2188, _t61, _v8, _t48, 0, 0);
					WriteFile(GetStdHandle(0xfffffff4), _v8, _t48,  &_v12, 0);
					WriteFile(GetStdHandle(0xfffffff4), 0x41e44c, 2,  &_v12, 0);
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x41e438);
				_t57 =  *0x41e2dc; // 0x41e2e0
				return E00408448( &_v8, _t57);
			}

0x0041e315
0x0041e316
0x0041e319
0x0041e31e
0x0041e31f
0x0041e324
0x0041e327
0x0041e33a
0x0041e33c
0x0041e344
0x0041e3e2
0x0041e3e7
0x0041e3eb
0x0041e3f6
0x0041e410
0x0041e34a
0x0041e34a
0x0041e354
0x0041e372
0x0041e374
0x0041e383
0x0041e3a0
0x0041e3b8
0x0041e3d2
0x0041e3d2
0x0041e417
0x0041e41a
0x0041e41d
0x0041e425
0x0041e430

APIs

Part of subcall function 0041E114: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041E2C0), ref: 0041E147
Part of subcall function 0041E114: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041E16B
Part of subcall function 0041E114: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041E186
Part of subcall function 0041E114: LoadStringW.USER32(00000000,0000FFE6,?,00000100), ref: 0041E221

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,0041E431), ref: 0041E36D
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041E3A0
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041E3B2
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041E3B8
GetStdHandle.KERNEL32(000000F4,0041E44C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041E3CC
WriteFile.KERNEL32(00000000,000000F4,0041E44C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 0041E3D2
LoadStringW.USER32(00000000,0000FFE7,?,00000040), ref: 0041E3F6
MessageBoxW.USER32(00000000,?,?,00002010), ref: 0041E410

Strings

A, xrefs: 0041E37D, 0041E425

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: A
API String ID: 135118572-2078354741
Opcode ID: 7ac45a3acab51d75a2f2dadbbea233182d042c34b14c6a342813a07329c7e551
Instruction ID: 55599a1ca590ccb82f33507a8a68a28fb6003423f3e15d682d30780ee5212ca2
Opcode Fuzzy Hash: 7ac45a3acab51d75a2f2dadbbea233182d042c34b14c6a342813a07329c7e551
Instruction Fuzzy Hash: 533161B5640204BEE714E765DD43FDA73ACEB04704FA0407ABA04F61D2DE78AE508B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004063C0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004063C0(void* __ecx) {
				long _v4;
				int _t3;
				void* _t9;

				if( *0x459058 == 0) {
					if( *0x45702e == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x459344 == 0xd7b2 &&  *0x45934c > 0) {
						 *0x45935c();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1d,  &_v4, 0);
					_t9 = E00406ED0(0x406454);
					return WriteFile(GetStdHandle(0xfffffff5), _t9, 2,  &_v4, 0);
				}
			}

0x004063c8
0x0040642e
0x0040643e
0x0040643e
0x00406444
0x004063ca
0x004063d3
0x004063e3
0x004063e3
0x004063ff
0x00406412
0x00406426
0x00406426

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000,?,?,0040658E,00404573,004045BA,?,00000000), ref: 004063F9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000,?,?,0040658E,00404573,004045BA,?), ref: 004063FF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000,?), ref: 0040641A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406479,?,00000000), ref: 00406420
MessageBoxA.USER32 ref: 0040643E

Strings

Error, xrefs: 00406432
Runtime error at 00000000, xrefs: 004063F2, 00406437

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 926b46c2746af87e23741f57702d42cf87552e5eecc647b7072c8877725d79e4
Instruction ID: cc4caa9ed4b409790b6e207eb6143654c82f8d025714f3564ebbcf6fb706f27d
Opcode Fuzzy Hash: 926b46c2746af87e23741f57702d42cf87552e5eecc647b7072c8877725d79e4
Instruction Fuzzy Hash: ADF062A1644340F8FA2073A5AE4FF5A268C4744F1AF25453FB915B50D3D6FC8984973E

Uniqueness

Uniqueness Score: -1.00%

Function 0040358C, Relevance: 10.9, APIs: 7, Instructions: 407
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040358C(signed int __eax, intOrPtr __edx, void* __edi) {
				signed int __ebx;
				void* __esi;
				signed int _t69;
				signed int _t78;
				signed int _t93;
				long _t94;
				void* _t100;
				signed int _t102;
				signed int _t109;
				signed int _t115;
				signed int _t123;
				signed int _t129;
				void* _t131;
				signed int _t140;
				unsigned int _t148;
				signed int _t150;
				long _t152;
				signed int _t156;
				intOrPtr _t161;
				signed int _t166;
				signed int _t170;
				unsigned int _t171;
				intOrPtr _t174;
				intOrPtr _t193;
				signed int _t196;
				signed int _t197;
				signed int _t198;
				void* _t206;
				unsigned int _t208;
				intOrPtr _t214;
				void* _t226;
				intOrPtr _t228;
				void* _t229;
				signed int _t231;
				void* _t233;
				signed int _t234;
				signed int _t235;
				signed int _t239;
				signed int _t242;
				void* _t244;
				intOrPtr* _t245;

				_t176 = __edx;
				_t66 = __eax;
				_t166 =  *(__eax - 4);
				_t218 = __eax;
				if((_t166 & 0x00000007) != 0) {
					__eflags = _t166 & 0x00000005;
					if((_t166 & 0x00000005) != 0) {
						_pop(_t218);
						_pop(_t145);
						__eflags = _t166 & 0x00000003;
						if((_t166 & 0x00000003) == 0) {
							_push(_t145);
							_push(__eax);
							_push(__edi);
							_push(_t226);
							_t245 = _t244 + 0xffffffe0;
							_t219 = __edx;
							_t203 = __eax;
							_t69 =  *(__eax - 4);
							_t148 = (0xfffffff0 & _t69) - 0x14;
							if(0xfffffff0 >= __edx) {
								__eflags = __edx - _t148 >> 1;
								if(__edx < _t148 >> 1) {
									_t150 = E00403010(__edx);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t219 - 0x40a2c;
										if(_t219 > 0x40a2c) {
											_t78 = _t203 - 0x10;
											__eflags = _t78;
											 *((intOrPtr*)(_t78 + 8)) = _t219;
										}
										E00402BD0(_t203, _t219, _t150);
										E00403394(_t203, _t203, _t226);
									}
								} else {
									_t150 = __eax;
									 *((intOrPtr*)(__eax - 0x10 + 8)) = __edx;
								}
							} else {
								if(0xfffffff0 <= __edx) {
									_t228 = __edx;
								} else {
									_t228 = 0xbadb9d;
								}
								 *_t245 = _t203 - 0x10 + (_t69 & 0xfffffff0);
								VirtualQuery( *(_t245 + 8), _t245 + 8, 0x1c);
								if( *((intOrPtr*)(_t245 + 0x14)) != 0x10000) {
									L12:
									_t150 = E00403010(_t228);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t228 - 0x40a2c;
										if(_t228 > 0x40a2c) {
											_t93 = _t150 - 0x10;
											__eflags = _t93;
											 *((intOrPtr*)(_t93 + 8)) = _t219;
										}
										E00402BA0(_t203,  *((intOrPtr*)(_t203 - 0x10 + 8)), _t150);
										E00403394(_t203, _t203, _t228);
									}
								} else {
									 *(_t245 + 0x10) =  *(_t245 + 0x10) & 0xffff0000;
									_t94 =  *(_t245 + 0x10);
									if(_t219 - _t148 >= _t94) {
										goto L12;
									} else {
										_t152 = _t228 - _t148 + 0x00010000 - 0x00000001 & 0xffff0000;
										if(_t94 < _t152) {
											_t152 = _t94;
										}
										if(VirtualAlloc( *(_t245 + 0xc), _t152, 0x2000, 4) == 0 || VirtualAlloc( *(_t245 + 0xc), _t152, 0x1000, 4) == 0) {
											goto L12;
										} else {
											_t100 = _t203 - 0x10;
											 *((intOrPtr*)(_t100 + 8)) = _t219;
											 *(_t100 + 0xc) = _t152 +  *(_t100 + 0xc) | 0x00000008;
											_t150 = _t203;
										}
									}
								}
							}
							return _t150;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t170 = _t166 & 0xfffffff0;
						_push(__edi);
						_t206 = _t170 + __eax;
						_t171 = _t170 - 4;
						_t156 = _t166 & 0x0000000f;
						__eflags = __edx - _t171;
						_push(_t226);
						if(__edx > _t171) {
							_t102 =  *(_t206 - 4);
							__eflags = _t102 & 0x00000001;
							if((_t102 & 0x00000001) == 0) {
								L75:
								asm("adc edi, 0xffffffff");
								_t229 = ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176;
								_t208 = _t171;
								_t109 = E00403010(((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176);
								_t193 = _t176;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L73;
								} else {
									__eflags = _t229 - 0x40a2c;
									if(_t229 > 0x40a2c) {
										 *((intOrPtr*)(_t109 - 8)) = _t193;
									}
									_t231 = _t109;
									E00402BA0(_t218, _t208, _t109);
									E00403394(_t218, _t208, _t231);
									return _t231;
								}
							} else {
								_t115 = _t102 & 0xfffffff0;
								_t233 = _t171 + _t115;
								__eflags = __edx - _t233;
								if(__edx > _t233) {
									goto L75;
								} else {
									__eflags =  *0x459059;
									if(__eflags == 0) {
										L66:
										__eflags = _t115 - 0xb30;
										if(_t115 >= 0xb30) {
											E00402BEC(_t206);
											_t176 = _t176;
											_t171 = _t171;
										}
										asm("adc edi, 0xffffffff");
										_t123 = (_t176 + ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + 0x000000d3 & 0xffffff00) + 0x30;
										_t196 = _t233 + 4 - _t123;
										__eflags = _t196;
										if(_t196 > 0) {
											 *(_t218 + _t233 - 4) = _t196;
											 *((intOrPtr*)(_t218 - 4 + _t123)) = _t196 + 3;
											_t234 = _t123;
											__eflags = _t196 - 0xb30;
											if(_t196 >= 0xb30) {
												__eflags = _t123 + _t218;
												E00402C2C(_t123 + _t218, _t171, _t196);
											}
										} else {
											 *(_t218 + _t233) =  *(_t218 + _t233) & 0xfffffff7;
											_t234 = _t233 + 4;
										}
										_t235 = _t234 | _t156;
										__eflags = _t235;
										 *(_t218 - 4) = _t235;
										 *0x459a68 = 0;
										_t109 = _t218;
										L73:
										return _t109;
									} else {
										while(1) {
											asm("lock cmpxchg [0x459a68], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x459909;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t176 = _t176;
												_t171 = _t171;
												asm("lock cmpxchg [0x459a68], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t176 = _t176;
													_t171 = _t171;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t218 - 4);
										_t129 =  *(_t206 - 4);
										__eflags = _t129 & 0x00000001;
										if((_t129 & 0x00000001) == 0) {
											L74:
											 *0x459a68 = 0;
											goto L75;
										} else {
											_t115 = _t129 & 0xfffffff0;
											_t233 = _t171 + _t115;
											__eflags = _t176 - _t233;
											if(_t176 > _t233) {
												goto L74;
											} else {
												goto L66;
											}
										}
									}
								}
							}
						} else {
							__eflags = __edx + __edx - _t171;
							if(__edx + __edx < _t171) {
								__eflags = __edx - 0xb2c;
								if(__edx >= 0xb2c) {
									L41:
									_t32 = _t176 + 0xd3; // 0xbff
									_t239 = (_t32 & 0xffffff00) + 0x30;
									_t174 = _t171 + 4 - _t239;
									__eflags =  *0x459059;
									if(__eflags != 0) {
										while(1) {
											asm("lock cmpxchg [0x459a68], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x459909;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t174 = _t174;
												asm("lock cmpxchg [0x459a68], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t174 = _t174;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t218 - 4);
										__eflags = 0xf;
									}
									 *(_t218 - 4) = _t156 | _t239;
									_t161 = _t174;
									_t197 =  *(_t206 - 4);
									__eflags = _t197 & 0x00000001;
									if((_t197 & 0x00000001) != 0) {
										_t131 = _t206;
										_t198 = _t197 & 0xfffffff0;
										_t161 = _t161 + _t198;
										_t206 = _t206 + _t198;
										__eflags = _t198 - 0xb30;
										if(_t198 >= 0xb30) {
											E00402BEC(_t131);
										}
									} else {
										 *(_t206 - 4) = _t197 | 0x00000008;
									}
									 *((intOrPtr*)(_t206 - 8)) = _t161;
									 *((intOrPtr*)(_t218 + _t239 - 4)) = _t161 + 3;
									__eflags = _t161 - 0xb30;
									if(_t161 >= 0xb30) {
										E00402C2C(_t218 + _t239, _t174, _t161);
									}
									 *0x459a68 = 0;
									return _t218;
								} else {
									__eflags = __edx - 0x2cc;
									if(__edx < 0x2cc) {
										_t214 = __edx;
										_t140 = E00403010(__edx);
										__eflags = _t140;
										if(_t140 != 0) {
											_t242 = _t140;
											E00402BD0(_t218, _t214, _t140);
											E00403394(_t218, _t214, _t242);
											_t140 = _t242;
										}
										return _t140;
									} else {
										_t176 = 0xb2c;
										__eflags = _t171 - 0xb2c;
										if(_t171 <= 0xb2c) {
											goto L37;
										} else {
											goto L41;
										}
									}
								}
							} else {
								L37:
								return _t66;
							}
						}
					}
				} else {
					__ebx =  *__ecx;
					__ecx =  *(__ebx + 2) & 0x0000ffff;
					__ecx = ( *(__ebx + 2) & 0x0000ffff) - 4;
					__eflags = __ecx - __edx;
					if(__ecx < __edx) {
						__ecx = __ecx + __ecx + 0x20;
						_push(__edi);
						__edi = __edx;
						__eax = 0;
						__ecx = __ecx - __edx;
						asm("adc eax, 0xffffffff");
						__eax = 0 & __ecx;
						__eax = (0 & __ecx) + __edx;
						__eax = E00403010((0 & __ecx) + __edx);
						__eflags = __eax;
						if(__eax != 0) {
							__eflags = __edi - 0x40a2c;
							if(__edi > 0x40a2c) {
								 *(__eax - 8) = __edi;
							}
							 *(__ebx + 2) & 0x0000ffff = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__eflags = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__edx = __eax;
							__edi = __eax;
							 *((intOrPtr*)(__ebx + 0x1c))() = E00403394(__esi, __edi, __ebp);
							__eax = __edi;
						}
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						return __eax;
					} else {
						__ebx = 0x40 + __edx * 4;
						__eflags = 0x40 + __edx * 4 - __ecx;
						if(0x40 + __edx * 4 < __ecx) {
							__ebx = __edx;
							__eax = __edx;
							__eax = E00403010(__edx);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = __ebx;
								__edx = __eax;
								__ebx = __eax;
								__esi = E00403394(__esi, __edi, __ebp);
								__eax = __ebx;
							}
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						} else {
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x0040358c
0x0040358c
0x0040358c
0x00403594
0x00403596
0x00403624
0x00403627
0x00403894
0x00403895
0x00403896
0x00403899
0x00402ec0
0x00402ec1
0x00402ec2
0x00402ec3
0x00402ec4
0x00402ec7
0x00402ec9
0x00402ed0
0x00402ed9
0x00402ede
0x00402fc7
0x00402fc9
0x00402fdc
0x00402fde
0x00402fe0
0x00402fe2
0x00402fe8
0x00402fec
0x00402fec
0x00402fef
0x00402fef
0x00402ff8
0x00402fff
0x00402fff
0x00402fcb
0x00402fcb
0x00402fd0
0x00402fd0
0x00402ee4
0x00402eed
0x00402ef3
0x00402eef
0x00402eef
0x00402eef
0x00402eff
0x00402f0e
0x00402f1b
0x00402f8d
0x00402f94
0x00402f96
0x00402f98
0x00402f9a
0x00402fa0
0x00402fa4
0x00402fa4
0x00402fa7
0x00402fa7
0x00402fb7
0x00402fbe
0x00402fbe
0x00402f1d
0x00402f1d
0x00402f29
0x00402f2f
0x00000000
0x00402f31
0x00402f42
0x00402f46
0x00402f48
0x00402f48
0x00402f5e
0x00000000
0x00402f76
0x00402f78
0x00402f7b
0x00402f86
0x00402f89
0x00402f89
0x00402f5e
0x00402f2f
0x00402f1b
0x0040300d
0x0040389f
0x0040389f
0x004038a1
0x004038a1
0x0040362d
0x0040362f
0x00403632
0x00403633
0x00403636
0x00403639
0x0040363c
0x0040363e
0x0040363f
0x00403754
0x00403757
0x00403759
0x0040384c
0x00403857
0x0040385e
0x00403860
0x00403863
0x00403868
0x00403869
0x0040386b
0x00000000
0x0040386d
0x0040386d
0x00403873
0x00403875
0x00403875
0x00403878
0x00403880
0x00403887
0x00403892
0x00403892
0x0040375f
0x0040375f
0x00403762
0x00403765
0x00403767
0x00000000
0x0040376d
0x0040376d
0x00403774
0x004037d1
0x004037d1
0x004037d6
0x004037dc
0x004037e1
0x004037e2
0x004037e2
0x004037ee
0x004037ff
0x00403805
0x00403805
0x00403807
0x00403814
0x0040381b
0x0040381f
0x00403821
0x00403827
0x00403829
0x0040382b
0x0040382b
0x00403809
0x00403809
0x0040380d
0x0040380d
0x00403830
0x00403830
0x00403832
0x00403835
0x0040383c
0x0040383e
0x00403842
0x00403776
0x00403776
0x0040377b
0x00403783
0x00000000
0x00000000
0x00403785
0x00403787
0x0040378e
0x00000000
0x00403790
0x00403794
0x00403799
0x0040379a
0x004037a0
0x004037a8
0x004037ae
0x004037b3
0x004037b4
0x00000000
0x004037b4
0x004037a8
0x00000000
0x0040378e
0x004037bd
0x004037c0
0x004037c3
0x004037c5
0x00403845
0x00403845
0x00000000
0x004037c7
0x004037c7
0x004037ca
0x004037cd
0x004037cf
0x00000000
0x00000000
0x00000000
0x00000000
0x004037cf
0x004037c5
0x00403774
0x00403767
0x00403645
0x00403648
0x0040364a
0x00403654
0x0040365a
0x00403671
0x00403671
0x0040367d
0x00403683
0x00403685
0x0040368c
0x0040368e
0x00403693
0x0040369b
0x00000000
0x00000000
0x0040369d
0x0040369f
0x004036a6
0x00000000
0x004036a8
0x004036ab
0x004036b0
0x004036b6
0x004036be
0x004036c3
0x004036c8
0x00000000
0x004036c8
0x004036be
0x00000000
0x004036a6
0x004036d1
0x004036d1
0x004036d1
0x004036d6
0x004036d9
0x004036db
0x004036de
0x004036e1
0x004036ec
0x004036ee
0x004036f1
0x004036f3
0x004036f5
0x004036fb
0x004036fd
0x004036fd
0x004036e3
0x004036e6
0x004036e6
0x00403702
0x00403708
0x0040370c
0x00403712
0x00403719
0x00403719
0x0040371e
0x0040372b
0x0040365c
0x0040365c
0x00403662
0x0040372c
0x00403730
0x00403735
0x00403737
0x00403739
0x00403741
0x00403748
0x0040374d
0x0040374d
0x00403753
0x00403668
0x00403668
0x0040366d
0x0040366f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040366f
0x00403662
0x0040364c
0x0040364c
0x00403650
0x00403650
0x0040364a
0x0040363f
0x0040359c
0x0040359c
0x0040359e
0x004035a2
0x004035a5
0x004035a7
0x004035e0
0x004035e4
0x004035e5
0x004035e7
0x004035e9
0x004035eb
0x004035ee
0x004035f0
0x004035f2
0x004035f7
0x004035f9
0x004035fb
0x00403601
0x00403603
0x00403603
0x0040360a
0x0040360a
0x0040360d
0x0040360f
0x00403618
0x0040361d
0x0040361d
0x0040361f
0x00403620
0x00403621
0x00403622
0x004035a9
0x004035a9
0x004035b0
0x004035b2
0x004035b8
0x004035ba
0x004035bc
0x004035c1
0x004035c3
0x004035c5
0x004035c7
0x004035c9
0x004035d4
0x004035d9
0x004035d9
0x004035db
0x004035dc
0x004035dd
0x004035b4
0x004035b4
0x004035b5
0x004035b6
0x004035b6
0x004035b2
0x004035a7

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012209b30cc801163652af7e4b736ed274403e160edede91c25d6155e4caf54c
Instruction ID: a9e8ad43e41bb6af7581f793d0e86e1b3182607fceafd5322bf430c23f80b29c
Opcode Fuzzy Hash: 012209b30cc801163652af7e4b736ed274403e160edede91c25d6155e4caf54c
Instruction Fuzzy Hash: EFC127A27102014BD714AE7DDD8836EBA899BC4316F18867FF604DB3D6DABCCE458348

Uniqueness

Uniqueness Score: -1.00%

Function 00403DFA, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 207
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00403DFA(void* __eax) {
				void* _v8;
				char _v110600;
				char _v112644;
				char _v112645;
				signed int _v112652;
				char _v112653;
				char _v112654;
				char _v112660;
				intOrPtr _v112664;
				intOrPtr _v112668;
				intOrPtr _v112672;
				signed short* _v112676;
				void* _v112680;
				char _v129064;
				char _v131113;
				char _v161832;
				void* _t74;
				int _t80;
				intOrPtr _t83;
				intOrPtr _t94;
				CHAR* _t98;
				intOrPtr _t100;
				void* _t112;
				intOrPtr _t113;
				intOrPtr _t119;
				intOrPtr _t124;
				void* _t134;
				intOrPtr _t135;
				intOrPtr _t139;
				signed int _t149;
				int _t154;
				intOrPtr _t155;
				char* _t157;
				char* _t158;
				char* _t159;
				char* _t160;
				char* _t161;
				char* _t162;
				char* _t164;
				char* _t165;
				char* _t170;
				char* _t171;
				intOrPtr _t203;
				void* _t205;
				void* _t206;
				intOrPtr* _t209;
				void* _t211;
				void* _t212;
				signed int _t217;
				void* _t221;
				void* _t223;
				void* _t237;

				_t221 = _t223;
				_push(__eax);
				_t74 = 0x27;
				goto L2;
				L13:
				while(_t203 != 0x459a58) {
					_t80 = E004038FC(_t203);
					_t154 = _t80;
					__eflags = _t154;
					if(_t154 == 0) {
						L12:
						_t20 = _t203 + 4; // 0x459a58
						_t203 =  *_t20;
						continue;
					} else {
						goto L5;
					}
					do {
						L5:
						_t217 =  *(_t154 - 4);
						__eflags = _t217 & 0x00000001;
						if((_t217 & 0x00000001) == 0) {
							__eflags = _t217 & 0x00000004;
							if(__eflags == 0) {
								__eflags = _v112652 - 0x1000;
								if(_v112652 < 0x1000) {
									_v112664 = (_t217 & 0xfffffff0) - 4;
									_t149 = E00403BE8(_t154);
									__eflags = _t149;
									if(_t149 == 0) {
										_v112645 = 0;
										 *((intOrPtr*)(_t221 + _v112652 * 4 - 0x1f824)) = _v112664;
										_t18 =  &_v112652;
										 *_t18 = _v112652 + 1;
										__eflags =  *_t18;
									}
								}
							} else {
								E00403C40(_t154, __eflags, _t221);
							}
						}
						_t80 = E004038D8(_t154);
						_t154 = _t80;
						__eflags = _t154;
					} while (_t154 != 0);
					goto L12;
				}
				_t155 =  *0x45bb00; // 0x45bafc
				while(_t155 != 0x45bafc && _v112652 < 0x1000) {
					_t80 = E00403BE8(_t155 + 0x10);
					__eflags = _t80;
					if(_t80 == 0) {
						_v112645 = 0;
						_t22 = _t155 + 0xc; // 0x0
						_t80 = _v112652;
						 *((intOrPtr*)(_t221 + _t80 * 4 - 0x1f824)) = ( *_t22 & 0xfffffff0) - 0xfffffffffffffff4;
						_t27 =  &_v112652;
						 *_t27 = _v112652 + 1;
						__eflags =  *_t27;
					}
					_t29 = _t155 + 4; // 0x45bafc
					_t155 =  *_t29;
				}
				if(_v112645 != 0) {
					L55:
					return _t80;
				}
				_v112653 = 0;
				_v112668 = 0;
				_t83 =  *0x45704c; // 0x402980
				_t157 = E004039C8(E00406B68(_t83),  &_v161832);
				_v112660 = 0x37;
				_v112676 = 0x457072;
				_v112680 =  &_v110600;
				do {
					_v112672 = ( *_v112676 & 0x0000ffff) - 4;
					_v112654 = 0;
					_t205 = 0xff;
					_t209 = _v112680;
					while(_t157 <=  &_v131113) {
						if( *_t209 > 0) {
							if(_v112653 == 0) {
								_t139 =  *0x457050; // 0x4029ac
								_t157 = E004039C8(E00406B68(_t139), _t157);
								_v112653 = 1;
							}
							if(_v112654 != 0) {
								 *_t157 = 0x2c;
								_t162 = _t157 + 1;
								 *_t162 = 0x20;
								_t163 = _t162 + 1;
								__eflags = _t162 + 1;
							} else {
								 *_t157 = 0xd;
								 *((char*)(_t157 + 1)) = 0xa;
								_t170 = E00403978(_v112668 + 1, _t157 + 2);
								 *_t170 = 0x20;
								_t171 = _t170 + 1;
								 *_t171 = 0x2d;
								 *((char*)(_t171 + 1)) = 0x20;
								_t134 = E00403978(_v112672, _t171 + 2);
								_t135 =  *0x457058; // 0x402a14
								_t163 = E004039C8(E00406B68(_t135), _t134);
								_v112654 = 1;
							}
							_t112 = _t205 - 1;
							_t237 = _t112;
							if(_t237 < 0) {
								_t113 =  *0x45705c; // 0x402a20
								_t164 = E004039C8(E00406B68(_t113), _t163);
							} else {
								if(_t237 == 0) {
									_t119 =  *0x457060; // 0x402a28
									_t164 = E004039C8(E00406B68(_t119), _t163);
								} else {
									if(_t112 == 1) {
										_t124 =  *0x457064; // 0x402a34
										_t164 = E004039C8(E00406B68(_t124), _t163);
									} else {
										_t164 = E004039E0( *((intOrPtr*)(_t209 - 4)), _t163);
									}
								}
							}
							 *_t164 = 0x20;
							_t165 = _t164 + 1;
							 *_t165 = 0x78;
							 *((char*)(_t165 + 1)) = 0x20;
							_t157 = E00403978( *_t209, _t165 + 2);
						}
						_t205 = _t205 - 1;
						_t209 = _t209 - 8;
						if(_t205 != 0xffffffff) {
							continue;
						} else {
							goto L40;
						}
					}
					L40:
					if(_v112654 != 0 ||  *0x459a56 == 0 || (_v112672 + 0x00000004 & 0x0000000f) == 0) {
						_v112668 = _v112672;
					}
					_v112680 = _v112680 + 0x800;
					_v112676 =  &(_v112676[0x10]);
					_t61 =  &_v112660;
					 *_t61 = _v112660 - 1;
				} while ( *_t61 != 0);
				if(_v112652 <= 0) {
					L54:
					_t94 =  *0x457068; // 0x402a44
					E004039C8(E00406B68(_t94), _t157);
					_t98 =  *0x45706c; // 0x402a48
					_t80 = MessageBoxA(0,  &_v161832, _t98, 0x2010);
					goto L55;
				}
				if(_v112653 != 0) {
					 *_t157 = 0xd;
					_t159 = _t157 + 1;
					 *_t159 = 0xa;
					_t160 = _t159 + 1;
					 *_t160 = 0xd;
					_t161 = _t160 + 1;
					 *_t161 = 0xa;
					_t157 = _t161 + 1;
				}
				_t100 =  *0x457054; // 0x4029d4
				_t157 = E004039C8(E00406B68(_t100), _t157);
				_t211 = _v112652 - 1;
				if(_t211 >= 0) {
					_t212 = _t211 + 1;
					_t206 = 0;
					_v112680 =  &_v129064;
					L50:
					L50:
					if(_t206 != 0) {
						 *_t157 = 0x2c;
						_t158 = _t157 + 1;
						 *_t158 = 0x20;
						_t157 = _t158 + 1;
					}
					_t157 = E00403978( *_v112680, _t157);
					if(_t157 >  &_v131113) {
						goto L54;
					}
					_t206 = _t206 + 1;
					_v112680 = _v112680 + 4;
					_t212 = _t212 - 1;
					if(_t212 != 0) {
						goto L50;
					}
				}
				L2:
				_t223 = _t223 + 0xfffff004;
				_push(_t74);
				_t74 = _t74 - 1;
				if(_t74 != 0) {
					goto L2;
				} else {
					E004049AC( &_v112644, 0x1b800);
					E004049AC( &_v129064, 0x4000);
					_t80 = 0;
					_v112652 = 0;
					_v112645 = 1;
					_t203 =  *0x459a5c; // 0x459a58
					goto L13;
				}
			}

0x00403dfd
0x00403dff
0x00403e00
0x00403e00
0x00000000
0x00403edb
0x00403e5b
0x00403e60
0x00403e62
0x00403e64
0x00403ed8
0x00403ed8
0x00403ed8
0x00000000
0x00000000
0x00000000
0x00000000
0x00403e66
0x00403e66
0x00403e6b
0x00403e6d
0x00403e73
0x00403e75
0x00403e7b
0x00403e88
0x00403e92
0x00403e9a
0x00403ea2
0x00403ea7
0x00403ea9
0x00403eab
0x00403ebe
0x00403ec5
0x00403ec5
0x00403ec5
0x00403ec5
0x00403ea9
0x00403e7d
0x00403e80
0x00403e85
0x00403e7b
0x00403ecd
0x00403ed2
0x00403ed4
0x00403ed4
0x00000000
0x00403e66
0x00403ee7
0x00403f26
0x00403ef4
0x00403ef9
0x00403efb
0x00403efd
0x00403f04
0x00403f10
0x00403f16
0x00403f1d
0x00403f1d
0x00403f1d
0x00403f1d
0x00403f23
0x00403f23
0x00403f23
0x00403f41
0x004041f5
0x004041fb
0x004041fb
0x00403f47
0x00403f50
0x00403f56
0x00403f72
0x00403f74
0x00403f7e
0x00403f8e
0x00403f94
0x00403fa0
0x00403fa6
0x00403fad
0x00403fb8
0x00403fba
0x00403fcb
0x00403fd8
0x00403fda
0x00403ff2
0x00403ff4
0x00403ff4
0x00404002
0x0040405a
0x0040405d
0x0040405e
0x00404061
0x00404061
0x00404004
0x00404004
0x00404008
0x0040401a
0x0040401c
0x0040401f
0x00404020
0x00404024
0x00404030
0x00404037
0x0040404f
0x00404051
0x00404051
0x00404064
0x00404064
0x00404067
0x00404070
0x00404088
0x00404069
0x00404069
0x0040408c
0x004040a4
0x0040406b
0x0040406c
0x004040a8
0x004040c0
0x0040406e
0x004040ce
0x004040ce
0x0040406c
0x00404069
0x004040d0
0x004040d3
0x004040d4
0x004040d8
0x004040e5
0x004040e5
0x004040e7
0x004040e8
0x004040ee
0x00000000
0x00000000
0x00000000
0x00000000
0x004040ee
0x004040f4
0x004040fb
0x00404119
0x00404119
0x0040411f
0x00404129
0x00404130
0x00404130
0x00404130
0x00404143
0x004041c4
0x004041c4
0x004041d7
0x004041e1
0x004041f0
0x00000000
0x004041f0
0x0040414c
0x0040414e
0x00404151
0x00404152
0x00404155
0x00404156
0x00404159
0x0040415a
0x0040415d
0x0040415d
0x0040415e
0x00404176
0x0040417e
0x00404181
0x00404183
0x00404184
0x0040418c
0x00000000
0x00404192
0x00404194
0x00404196
0x00404199
0x0040419a
0x0040419d
0x0040419d
0x004041ad
0x004041b7
0x00000000
0x00000000
0x004041b9
0x004041ba
0x004041c1
0x004041c2
0x00000000
0x00000000
0x004041c2
0x00403e05
0x00403e05
0x00403e0b
0x00403e0c
0x00403e0d
0x00000000
0x00403e0f
0x00403e28
0x00403e3a
0x00403e3f
0x00403e41
0x00403e47
0x00403e4e
0x00000000
0x00403e4e

Strings

rpE, xrefs: 00403F7E
7, xrefs: 00403F74
H*@, xrefs: 004041E1
D*@, xrefs: 004041C4, 004041D2
, xrefs: 00404129

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID:
String ID: $7$D*@$H*@$rpE
API String ID: 0-2939116076
Opcode ID: 89193499d3bf5b5d04dbc3245125499046023f5625875a3cf8553686718b4ad0
Instruction ID: a2a7225ccdca6f85d27b7bd5674335df368a042e8a6d5b72a154ea53205562a8
Opcode Fuzzy Hash: 89193499d3bf5b5d04dbc3245125499046023f5625875a3cf8553686718b4ad0
Instruction Fuzzy Hash: A581A170A042548FDB21EB2DCC84B99BBE4AB49705F0441F6E149FB3C2DB789E85CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00405608, Relevance: 10.6, APIs: 7, Instructions: 132
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405608(signed char* __eax, void* __ecx, void* __edx, void* __eflags) {
				void* _t49;
				long _t52;
				signed char _t53;
				signed char _t54;
				intOrPtr _t55;
				signed char _t56;
				signed char _t57;
				void* _t73;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t76;

				_t73 = __edx;
				_t74 = __eax;
				_t75 =  *((intOrPtr*)(__eax + 0x10));
				while(1) {
					L1:
					 *_t76 = E004058B8(_t74);
					if( *_t76 != 0 || _t73 == 0) {
						break;
					}
					_t76[1] = 0;
					if(_t75 <= 0) {
						while(1) {
							L17:
							_t53 =  *_t74;
							if(_t53 == 0) {
								goto L1;
							}
							if(_t53 != E00402728(_t74, _t53)) {
								continue;
							} else {
								goto L19;
							}
							do {
								L19:
								_t76[4] = GetTickCount();
								E00405804(_t74);
								_t55 =  *0x4598f8; // 0x458604
								 *((intOrPtr*)(_t55 + 0x10))();
								 *_t76 = 0 == 0;
								if(_t73 != 0xffffffff) {
									_t76[8] = GetTickCount();
									if(_t73 <= _t76[8] - _t76[4]) {
										_t73 = 0;
									} else {
										_t73 = _t73 - _t76[8] - _t76[4];
									}
								}
								if( *_t76 == 0) {
									do {
										_t56 =  *_t74;
									} while (_t56 != E00402728(_t74, _t56));
									_t76[1] = 1;
								} else {
									while(1) {
										_t57 =  *_t74;
										if((_t57 & 0x00000001) != 0) {
											goto L29;
										}
										if(_t57 != E00402728(_t74, _t57)) {
											continue;
										}
										_t76[1] = 1;
										goto L29;
									}
								}
								L29:
							} while (_t76[1] == 0);
							if( *_t76 != 0) {
								_t74[8] = GetCurrentThreadId();
								_t74[4] = 1;
							}
							goto L32;
						}
						continue;
					}
					_t76[4] = GetTickCount();
					if(_t75 <= 0) {
						L13:
						if(_t73 == 0xffffffff) {
							goto L17;
						}
						_t76[8] = GetTickCount();
						_t49 = _t76[8] - _t76[4];
						if(_t73 > _t49) {
							_t73 = _t73 - _t49;
							goto L17;
						}
						 *_t76 = 0;
						break;
					} else {
						goto L5;
					}
					do {
						L5:
						if(_t73 == 0xffffffff) {
							L8:
							_t54 =  *_t74;
							if(_t54 > 1) {
								goto L13;
							}
							if(_t54 != 0 || E00402728(_t74, 0) != 0) {
								goto L12;
							} else {
								_t74[8] = GetCurrentThreadId();
								_t74[4] = 1;
								 *_t76 = 1;
								goto L32;
							}
						}
						_t52 = GetTickCount();
						_t46 = _t52 - _t76[4];
						if(_t73 > _t52 - _t76[4]) {
							goto L8;
						} else {
							 *_t76 = 0;
							goto L32;
						}
						L12:
						_t46 = E004058FC(_t46);
						_t75 = _t75 - 1;
					} while (_t75 > 0);
					goto L13;
				}
				L32:
				return  *_t76 & 0x000000ff;
			}

0x0040560f
0x00405611
0x00405613
0x00405616
0x00405616
0x0040561d
0x00405624
0x00000000
0x00000000
0x00405632
0x00405639
0x004056cb
0x004056cb
0x004056cb
0x004056cf
0x00000000
0x00000000
0x004056e3
0x00000000
0x00000000
0x00000000
0x00000000
0x004056e5
0x004056e5
0x004056ea
0x004056f0
0x004056f7
0x00405701
0x00405706
0x0040570d
0x00405714
0x00405722
0x00405730
0x00405724
0x0040572c
0x0040572c
0x00405722
0x00405736
0x0040575b
0x0040575b
0x0040576b
0x0040576f
0x00000000
0x00405738
0x00405738
0x0040573d
0x00000000
0x00000000
0x00405752
0x00000000
0x00000000
0x00405754
0x00000000
0x00405754
0x00405738
0x00405774
0x00405774
0x00405783
0x0040578a
0x0040578d
0x0040578d
0x00000000
0x00405783
0x00000000
0x004056cb
0x00405644
0x0040564a
0x004056a6
0x004056a9
0x00000000
0x00000000
0x004056b0
0x004056b8
0x004056be
0x004056c9
0x00000000
0x004056c9
0x004056c0
0x00000000
0x00000000
0x00000000
0x00000000
0x0040564c
0x0040564c
0x0040564f
0x00405667
0x00405667
0x0040566c
0x00000000
0x00000000
0x00405670
0x00000000
0x00405684
0x00405689
0x0040568c
0x00405693
0x00000000
0x00405693
0x00405670
0x00405651
0x00405656
0x0040565c
0x00000000
0x0040565e
0x0040565e
0x00000000
0x0040565e
0x0040569c
0x0040569c
0x004056a1
0x004056a2
0x00000000
0x0040564c
0x00405794
0x0040579f

APIs

Part of subcall function 004058B8: GetCurrentThreadId.KERNEL32 ref: 004058BB

GetTickCount.KERNEL32 ref: 0040563F
GetTickCount.KERNEL32 ref: 00405651
GetCurrentThreadId.KERNEL32 ref: 00405684
GetTickCount.KERNEL32 ref: 004056AB
GetTickCount.KERNEL32 ref: 004056E5
GetTickCount.KERNEL32 ref: 0040570F
GetCurrentThreadId.KERNEL32 ref: 00405785

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 11601eaea2591db47d9e0a3339b5d9af6372044b92e2f434dcefd46fb28b69f0
Instruction ID: bb50489e2f4c0e7371ac908c50818e07fe8ea76bf222c5b51f101fc029dd4185
Opcode Fuzzy Hash: 11601eaea2591db47d9e0a3339b5d9af6372044b92e2f434dcefd46fb28b69f0
Instruction Fuzzy Hash: 1441A435608B818ADB20BA39C58472F7BD2DB90354F44893FE4D8973D2D6BD88859F1A

Uniqueness

Uniqueness Score: -1.00%

Function 0044F558, Relevance: 10.5, APIs: 7, Instructions: 35
windowsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0044F558(void* __eax) {
				struct tagMSG _v40;
				long _t4;
				long _t9;
				void* _t11;
				long _t12;
				MSG* _t13;

				_t11 = __eax;
				_t9 = GetTickCount();
				_t4 = GetTickCount();
				_t12 = _t4;
				while(_t11 > _t9 - _t12) {
					if(PeekMessageW( &_v40, 0, 0, 0, 1) != 0) {
						TranslateMessage(_t13);
						DispatchMessageW(_t13);
					}
					Sleep(1);
					_t4 = GetTickCount();
					_t9 = _t4;
				}
				return _t4;
			}

0x0044f55e
0x0044f565
0x0044f567
0x0044f56c
0x0044f5a0
0x0044f584
0x0044f587
0x0044f58d
0x0044f58d
0x0044f594
0x0044f599
0x0044f59e
0x0044f59e
0x0044f5ac

APIs

GetTickCount.KERNEL32 ref: 0044F560
GetTickCount.KERNEL32 ref: 0044F567
PeekMessageW.USER32 ref: 0044F57D
TranslateMessage.USER32 ref: 0044F587
DispatchMessageW.USER32 ref: 0044F58D
Sleep.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000001), ref: 0044F594
GetTickCount.KERNEL32 ref: 0044F599

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CountMessageTick$DispatchPeekSleepTranslate
String ID:
API String ID: 2701518618-0
Opcode ID: 570b9b745490f225cbbde1e8f4132b6a8791baa9916827578856fe64b9c198a4
Instruction ID: e9d9b799a6ce74786193a8bd3a6737283ddea505bea43c87b29b9ca160bb4cbe
Opcode Fuzzy Hash: 570b9b745490f225cbbde1e8f4132b6a8791baa9916827578856fe64b9c198a4
Instruction Fuzzy Hash: C8E09B71B4170136E510B6F60C87F8F10884B45798F95043B7645FA2D3F9BD586482BF

Uniqueness

Uniqueness Score: -1.00%

Function 004240AC, Relevance: 9.1, APIs: 6, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E004240AC(short* __eax, intOrPtr __ecx, signed short* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				void* __ebp;
				signed char _t47;
				signed int _t54;
				void* _t62;
				intOrPtr* _t73;
				signed short* _t91;
				void* _t93;
				void* _t95;
				void* _t98;
				void* _t99;
				intOrPtr* _t108;
				void* _t112;
				intOrPtr _t113;
				char* _t114;
				void* _t115;

				_t100 = __ecx;
				_v780 = __ecx;
				_t91 = __edx;
				_v776 = __eax;
				if(( *(__edx + 1) & 0x00000020) == 0) {
					E004237DC(0x80070057);
				}
				_t47 =  *_t91 & 0x0000ffff;
				if((_t47 & 0x00000fff) != 0xc) {
					_push(_t91);
					_push(_v776);
					L00421AA0();
					return E004237DC(_v776);
				} else {
					if((_t47 & 0x00000040) == 0) {
						_v792 = _t91[4];
					} else {
						_v792 =  *(_t91[4]);
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t93 = _v788 - 1;
					if(_t93 < 0) {
						L9:
						_push( &_v772);
						_t54 = _v788;
						_push(_t54);
						_push(0xc);
						L00421F54();
						_t113 = _t54;
						if(_t113 == 0) {
							E00423534(_t100);
						}
						E00423A74(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t113;
						_t95 = _v788 - 1;
						if(_t95 < 0) {
							L14:
							_t97 = _v788 - 1;
							if(E00424024(_v788 - 1, _t115) != 0) {
								L00421F6C();
								E004237DC(_v792);
								L00421F6C();
								E004237DC( &_v260);
								_v780(_t113,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t62 = E00424054(_t97, _t115);
						} else {
							_t98 = _t95 + 1;
							_t73 =  &_v768;
							_t108 =  &_v260;
							do {
								 *_t108 =  *_t73;
								_t108 = _t108 + 4;
								_t73 = _t73 + 8;
								_t98 = _t98 - 1;
							} while (_t98 != 0);
							do {
								goto L14;
							} while (_t62 != 0);
							return _t62;
						}
					} else {
						_t99 = _t93 + 1;
						_t112 = 0;
						_t114 =  &_v772;
						do {
							_v804 = _t114;
							_push(_v804 + 4);
							_t18 = _t112 + 1; // 0x1
							_push(_v792);
							L00421F5C();
							E004237DC(_v792);
							_push( &_v784);
							_t21 = _t112 + 1; // 0x1
							_push(_v792);
							L00421F64();
							E004237DC(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t112 = _t112 + 1;
							_t114 = _t114 + 8;
							_t99 = _t99 - 1;
						} while (_t99 != 0);
						goto L9;
					}
				}
			}

0x004240ac
0x004240b8
0x004240be
0x004240c0
0x004240ca
0x004240d1
0x004240d1
0x004240d6
0x004240e4
0x0042425d
0x00424264
0x00424265
0x00000000
0x004240ea
0x004240ed
0x004240ff
0x004240ef
0x004240f4
0x004240f4
0x0042410e
0x0042411a
0x0042411d
0x0042418a
0x00424190
0x00424191
0x00424197
0x00424198
0x0042419a
0x0042419f
0x004241a3
0x004241a5
0x004241a5
0x004241b0
0x004241bb
0x004241c6
0x004241cf
0x004241d2
0x004241ee
0x004241f5
0x00424200
0x00424217
0x0042421c
0x00424230
0x00424235
0x00424248
0x00424248
0x00424251
0x004241d4
0x004241d4
0x004241d5
0x004241db
0x004241e1
0x004241e3
0x004241e5
0x004241e8
0x004241eb
0x004241eb
0x004241ee
0x00000000
0x00000000
0x00000000
0x004241ee
0x0042411f
0x0042411f
0x00424120
0x00424122
0x00424128
0x0042412a
0x00424139
0x0042413a
0x00424144
0x00424145
0x0042414a
0x00424155
0x00424156
0x00424160
0x00424161
0x00424166
0x00424181
0x00424183
0x00424184
0x00424187
0x00424187
0x00000000
0x00424128
0x0042411d

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00424145
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00424161
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0042419A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00424217
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 00424230
VariantCopy.OLEAUT32(?,00000000), ref: 00424265

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 716bc8167cf287cc1e8f7d8ac4576e4a45568dddf1cc74a6b6858a9f436d61aa
Instruction ID: ec538f1c9a65e232910c9293e5ef4a32a88133be791216f42edbb47e06386550
Opcode Fuzzy Hash: 716bc8167cf287cc1e8f7d8ac4576e4a45568dddf1cc74a6b6858a9f436d61aa
Instruction Fuzzy Hash: 4351EDB5A0022D9BCB21DF59D881AD9B3BCEB58304F4041DAE509E7211DB38AF858F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041E114, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0041E114(intOrPtr* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v534;
				short _v1056;
				short _v1568;
				struct _MEMORY_BASIC_INFORMATION _v1596;
				char _v1600;
				intOrPtr _v1604;
				char _v1608;
				intOrPtr _v1612;
				char _v1616;
				intOrPtr _v1620;
				char _v1624;
				char* _v1628;
				char _v1632;
				char _v1636;
				char _v1640;
				struct HINSTANCE__* _t44;
				intOrPtr _t55;
				struct HINSTANCE__* _t57;
				signed int _t76;
				void* _t82;
				intOrPtr _t83;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				void* _t105;

				_v1640 = 0;
				_v8 = __ecx;
				_t82 = __edx;
				_t102 = __eax;
				_push(_t105);
				_push(0x41e2c0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t105 + 0xfffff99c;
				VirtualQuery(__edx,  &_v1596, 0x1c);
				if(_v1596.State != 0x1000 || GetModuleFileNameW(_v1596.AllocationBase,  &_v1056, 0x105) == 0) {
					_t44 =  *0x45bc50; // 0x400000
					GetModuleFileNameW(_t44,  &_v1056, 0x105);
					_v12 = E0041E108(_t82);
				} else {
					_v12 = _t82 - _v1596.AllocationBase;
				}
				E00419D94( &_v534, 0x104, E0041F56C() + 2);
				_t83 = 0x41e2d4;
				_t100 = 0x41e2d4;
				_t95 =  *0x414f38; // 0x414f90
				if(E00405050(_t102, _t95) != 0) {
					_t83 = E004072B8( *((intOrPtr*)(_t102 + 4)));
					_t76 = E00406B7C(_t83);
					if(_t76 != 0 &&  *((short*)(_t83 + _t76 * 2 - 2)) != 0x2e) {
						_t100 = 0x41e2d8;
					}
				}
				_t55 =  *0x458c5c; // 0x40b068
				_t18 = _t55 + 4; // 0xffe6
				_t57 =  *0x45bc50; // 0x400000
				LoadStringW(E00408500(_t57),  *_t18,  &_v1568, 0x100);
				E00404D14( *_t102,  &_v1640);
				_v1636 = _v1640;
				_v1632 = 0x11;
				_v1628 =  &_v534;
				_v1624 = 0xa;
				_v1620 = _v12;
				_v1616 = 5;
				_v1612 = _t83;
				_v1608 = 0xa;
				_v1604 = _t100;
				_v1600 = 0xa;
				E0041A074(4,  &_v1636);
				E00406B7C(_v8);
				_pop(_t98);
				 *[fs:eax] = _t98;
				_push(0x41e2c7);
				return E00406658( &_v1640);
			}

0x0041e122
0x0041e128
0x0041e12b
0x0041e12d
0x0041e131
0x0041e132
0x0041e137
0x0041e13a
0x0041e147
0x0041e156
0x0041e180
0x0041e186
0x0041e192
0x0041e197
0x0041e19d
0x0041e19d
0x0041e1bf
0x0041e1c4
0x0041e1c9
0x0041e1d0
0x0041e1dd
0x0041e1e7
0x0041e1eb
0x0041e1f2
0x0041e1fc
0x0041e1fc
0x0041e1f2
0x0041e20d
0x0041e212
0x0041e216
0x0041e221
0x0041e22e
0x0041e239
0x0041e23f
0x0041e24c
0x0041e252
0x0041e25c
0x0041e262
0x0041e269
0x0041e26f
0x0041e276
0x0041e27c
0x0041e298
0x0041e2a0
0x0041e2a9
0x0041e2ac
0x0041e2af
0x0041e2bf

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041E2C0), ref: 0041E147
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041E16B
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041E186
LoadStringW.USER32(00000000,0000FFE6,?,00000100), ref: 0041E221

Strings

MZP, xrefs: 0041E185

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: e9fd1f3ce4b77acde823d8c7d6f134688c3606b4cbb76889d531a3f11e78126b
Instruction ID: 8aaf1065241a5c402aa68a6ef7157060595233990321d419dbae8ae04927e37f
Opcode Fuzzy Hash: e9fd1f3ce4b77acde823d8c7d6f134688c3606b4cbb76889d531a3f11e78126b
Instruction Fuzzy Hash: 0E411274A002589FDB20DF55CC81BCAB7B9AB58304F5040FAE908E7291D7799E94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0044F1A8, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103
windowCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0044F1A8(void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				char _v28;
				struct HWND__* _v32;
				char _v36;
				char _v40;
				char _v56;
				char _v72;
				char _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t56;
				void* _t61;
				void* _t69;
				void* _t70;
				intOrPtr _t75;
				intOrPtr _t76;
				void* _t83;
				intOrPtr _t86;
				intOrPtr _t89;
				void* _t93;

				_t71 = 0xa;
				do {
					_push(0);
					_push(0);
					_t71 = _t71 - 1;
				} while (_t71 != 0);
				_push(_t71);
				_push(_t83);
				_t86 = _a8;
				_push(_a4);
				_push(0x44f29e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89;
				E004066A0( &_v8);
				if( *0x45dff4 != 0) {
					_push( &_v36);
					_push(1);
					_push(_t86);
					L0040AF78();
					_push( &_v40);
					_push(1);
					_push(_t86);
					L0040AF70();
					E004066A0( &_v8);
					_t69 = _v40 - _v36;
					if(_t69 >= 0) {
						_t70 = _t69 + 1;
						_t93 = _t70;
						_v32 = 0;
						do {
							_push(E00423A88( &_v28));
							_push( &_v32);
							_push(_t86);
							L0040AF80();
							E004296F4( &_v56, _t71, _v8);
							_push( &_v56);
							_t71 =  &_v72;
							E0042B9D8( &_v28,  &_v72, 0x100);
							_pop(_t56);
							E0042BFFC(_t56,  &_v72, __fp0);
							_push( &_v56);
							E00429758( &_v88, _t70,  &_v72, 0x20, _t86, _t93);
							_pop(_t61);
							E0042BFFC(_t61,  &_v88, __fp0);
							E004283D0( &_v8, _t70,  &_v56, _t83, _t86);
							_v32 =  &(_v32->i);
							_t70 = _t70 - 1;
						} while (_t70 != 0);
					}
					MessageBoxW(0, E00407024(_v8), L"Host", 0);
				}
				_pop(_t75);
				 *[fs:eax] = _t75;
				_t76 =  *0x401290; // 0x401294
				E00407A34( &_v88, 3, _t76);
				E00423A88( &_v28);
				E004066A0( &_v8);
				return 0;
			}

0x0044f1ab
0x0044f1b0
0x0044f1b0
0x0044f1b2
0x0044f1b4
0x0044f1b4
0x0044f1b7
0x0044f1ba
0x0044f1bb
0x0044f1be
0x0044f1c4
0x0044f1c9
0x0044f1cc
0x0044f1d2
0x0044f1de
0x0044f1e7
0x0044f1e8
0x0044f1ea
0x0044f1eb
0x0044f1f3
0x0044f1f4
0x0044f1f6
0x0044f1f7
0x0044f1ff
0x0044f207
0x0044f20c
0x0044f20e
0x0044f20e
0x0044f20f
0x0044f216
0x0044f21e
0x0044f222
0x0044f223
0x0044f224
0x0044f22f
0x0044f237
0x0044f238
0x0044f242
0x0044f24a
0x0044f24b
0x0044f253
0x0044f25b
0x0044f263
0x0044f264
0x0044f26f
0x0044f274
0x0044f277
0x0044f277
0x0044f216
0x0044f28c
0x0044f28c
0x0044f293
0x0044f296
0x0044f2a6
0x0044f2b1
0x0044f2b9
0x0044f2c1
0x0044f2ce

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0044F1EB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0044F1F7
SafeArrayGetElement.OLEAUT32(?,00000000,00000000), ref: 0044F224
MessageBoxW.USER32(00000000,00000000,Host,00000000), ref: 0044F28C

Strings

Host, xrefs: 0044F27C

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ElementMessage
String ID: Host
API String ID: 2136510208-1863695555
Opcode ID: 6bea62ae87c4374d69aceeaefbf4ecfaaaffadb96c263533fd0c3f765cb2c868
Instruction ID: 049a10011492fb1e4b86c8d757fe8ebaf3f838bebd80a5de250dc6091e4a2e1e
Opcode Fuzzy Hash: 6bea62ae87c4374d69aceeaefbf4ecfaaaffadb96c263533fd0c3f765cb2c868
Instruction Fuzzy Hash: 00314371A0020DAADB00EF91D982FDEB3BCEF44304F50047BF501B2181DB796F198AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405444, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00405444(void* __edx) {
				intOrPtr _v8;
				char _v12;
				char* _t20;
				intOrPtr _t26;
				signed int _t32;
				intOrPtr _t40;
				void* _t42;
				void* _t44;
				intOrPtr _t45;

				_t42 = _t44;
				_t45 = _t44 + 0xfffffff8;
				_v12 = 0;
				if(GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLogicalProcessorInformation") == 0) {
					L10:
					_t32 = 0x40;
					goto L11;
				} else {
					_t20 =  &_v12;
					_push(_t20);
					_push(0);
					L004028EC();
					if(_t20 != 0 || GetLastError() != 0x7a) {
						goto L10;
					} else {
						_v8 = E00404484(_v12);
						_push(_t42);
						_push(E004054F0);
						_push( *[fs:edx]);
						 *[fs:edx] = _t45;
						_push( &_v12);
						_push(_v8);
						L004028EC();
						_t26 = _v8;
						if(_v12 <= 0) {
							L8:
							_pop(_t40);
							 *[fs:eax] = _t40;
							_push(E004054F7);
							return E004044A0(_v8);
						} else {
							while( *((short*)(_t26 + 4)) != 2 ||  *((char*)(_t26 + 8)) != 1) {
								_t26 = _t26 + 0x18;
								_v12 = _v12 - 0x18;
								if(_v12 > 0) {
									continue;
								} else {
									goto L8;
								}
								goto L12;
							}
							_t32 =  *(_t26 + 0xa) & 0x0000ffff;
							E00405F50();
							L11:
							return _t32;
						}
					}
				}
				L12:
			}

0x00405445
0x00405447
0x0040544d
0x00405467
0x004054f7
0x004054f7
0x00000000
0x0040546d
0x0040546d
0x00405470
0x00405471
0x00405473
0x0040547a
0x00000000
0x00405486
0x0040548e
0x00405493
0x00405494
0x00405499
0x0040549c
0x004054a2
0x004054a6
0x004054a7
0x004054ac
0x004054b3
0x004054da
0x004054dc
0x004054df
0x004054e2
0x004054ef
0x004054b5
0x004054b5
0x004054cd
0x004054d0
0x004054d8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004054d8
0x004054c2
0x004054c6
0x004054fc
0x00405502
0x00405502
0x004054b3
0x0040547a
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation,024199E0), ref: 0040545A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00405460
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation,024199E0), ref: 0040547C

Strings

kernel32.dll, xrefs: 00405455
GetLogicalProcessorInformation, xrefs: 00405450

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-812649623
Opcode ID: e62829bc94120120a15bc42a474b9112073308fe30d9e610c1986f2702cc29ba
Instruction ID: c1e5ba1df838c586c200fb27a8426cfabcd458109b2cd9967c78b2c85d954edd
Opcode Fuzzy Hash: e62829bc94120120a15bc42a474b9112073308fe30d9e610c1986f2702cc29ba
Instruction Fuzzy Hash: F3119671D04604AEDB10EBA5DD45B9FB7A8EB40319F20407BE504B35C1E67C99C09F1D

Uniqueness

Uniqueness Score: -1.00%

Function 0042B0EC, Relevance: 7.8, APIs: 5, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0042B0EC(signed short* __eax, signed int __ecx, signed short* __edx, void* __edi, void* __fp0) {
				signed short* _v8;
				signed int _v12;
				signed char _v13;
				signed int _v16;
				signed int _v18;
				void* _v24;
				void* _v28;
				signed int _v44;
				void* __ebp;
				signed int _t134;
				signed short* _t253;
				intOrPtr _t303;
				intOrPtr _t306;
				intOrPtr _t314;
				intOrPtr _t321;
				intOrPtr _t329;
				signed int _t334;
				void* _t342;
				void* _t344;
				intOrPtr _t345;

				_t349 = __fp0;
				_t342 = _t344;
				_t345 = _t344 + 0xffffffd8;
				_v12 = __ecx;
				_v8 = __edx;
				_t253 = __eax;
				_v13 = 1;
				_t334 =  *__eax & 0x0000ffff;
				if((_t334 & 0x00000fff) >= 0x10f) {
					_t134 =  *_v8 & 0x0000ffff;
					if(_t134 != 0) {
						if(_t134 != 1) {
							if(E0042BE20(_t334,  &_v24) != 0) {
								_push( &_v18);
								if( *((intOrPtr*)( *_v24 + 8))() == 0) {
									_t337 =  *_v8 & 0x0000ffff;
									if(( *_v8 & 0xfff) >= 0x10f) {
										if(E0042BE20(_t337,  &_v28) != 0) {
											_push( &_v16);
											if( *((intOrPtr*)( *_v28 + 4))() == 0) {
												E004233F0(0xb);
												goto L41;
											} else {
												if(( *_t253 & 0x0000ffff) == _v16) {
													_v13 =  *(0x45870a + _v12 * 2 + ( *((intOrPtr*)( *_v28 + 0x34))(_v12) & 0x0000007f) - 0x1c) & 0x000000ff;
													goto L41;
												} else {
													_push( &_v44);
													L00421A90();
													_push(_t342);
													_push(0x42b4cc);
													_push( *[fs:eax]);
													 *[fs:eax] = _t345;
													_t265 = _v16 & 0x0000ffff;
													E004248E4( &_v44, _v16 & 0x0000ffff, _t253, __edi, __fp0);
													if((_v44 & 0x0000ffff) != _v16) {
														E00423300(_t265);
													}
													_v13 =  *(0x45870a + _v12 * 2 + ( *((intOrPtr*)( *_v28 + 0x34))(_v12) & 0x0000007f) - 0x1c) & 0x000000ff;
													_pop(_t303);
													 *[fs:eax] = _t303;
													_push(0x42b500);
													return E00423A74( &_v44);
												}
											}
										} else {
											E004233F0(0xb);
											goto L41;
										}
									} else {
										_push( &_v44);
										L00421A90();
										_push(_t342);
										_push(0x42b418);
										_push( *[fs:eax]);
										 *[fs:eax] = _t345;
										_t270 =  *_v8 & 0x0000ffff;
										E004248E4( &_v44,  *_v8 & 0x0000ffff, _t253, __edi, __fp0);
										if(( *_v8 & 0x0000ffff) != _v44) {
											E00423300(_t270);
										}
										_v13 = E0042AF34( &_v44, _v12, _v8, _t349);
										_pop(_t306);
										 *[fs:eax] = _t306;
										_push(0x42b500);
										return E00423A74( &_v44);
									}
								} else {
									if(( *_v8 & 0x0000ffff) == _v18) {
										_v13 =  *(0x45870a + _v12 * 2 + ( *((intOrPtr*)( *_v24 + 0x34))(_v12) & 0x0000007f) - 0x1c) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v44);
										L00421A90();
										_push(_t342);
										_push(0x42b375);
										_push( *[fs:eax]);
										 *[fs:eax] = _t345;
										_t275 = _v18 & 0x0000ffff;
										E004248E4( &_v44, _v18 & 0x0000ffff, _v8, __edi, __fp0);
										if((_v44 & 0x0000ffff) != _v18) {
											E00423300(_t275);
										}
										_v13 =  *(0x45870a + _v12 * 2 + ( *((intOrPtr*)( *_v24 + 0x34))(_v12) & 0x0000007f) - 0x1c) & 0x000000ff;
										_pop(_t314);
										 *[fs:eax] = _t314;
										_push(0x42b500);
										return E00423A74( &_v44);
									}
								}
							} else {
								E004233F0(__ecx);
								goto L41;
							}
						} else {
							_v13 = E0042ACC8(_v12, 2);
							goto L41;
						}
					} else {
						_v13 = E0042ACB4(0, 1);
						goto L41;
					}
				} else {
					if(_t334 != 0) {
						if(_t334 != 1) {
							if(E0042BE20( *_v8 & 0x0000ffff,  &_v28) != 0) {
								_push( &_v16);
								if( *((intOrPtr*)( *_v28 + 4))() == 0) {
									_push( &_v44);
									L00421A90();
									_push(_t342);
									_push(0x42b287);
									_push( *[fs:eax]);
									 *[fs:eax] = _t345;
									_t281 =  *_t253 & 0x0000ffff;
									E004248E4( &_v44,  *_t253 & 0x0000ffff, _v8, __edi, __fp0);
									if((_v44 & 0xfff) !=  *_t253) {
										E00423300(_t281);
									}
									_v13 = E0042AF34(_t253, _v12,  &_v44, _t349);
									_pop(_t321);
									 *[fs:eax] = _t321;
									_push(0x42b500);
									return E00423A74( &_v44);
								} else {
									if(( *_t253 & 0x0000ffff) == _v16) {
										_v13 =  *(0x45870a + _v12 * 2 + ( *((intOrPtr*)( *_v28 + 0x34))(_v12) & 0x0000007f) - 0x1c) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v44);
										L00421A90();
										_push(_t342);
										_push(0x42b1f8);
										_push( *[fs:eax]);
										 *[fs:eax] = _t345;
										_t286 = _v16 & 0x0000ffff;
										E004248E4( &_v44, _v16 & 0x0000ffff, _t253, __edi, __fp0);
										if((_v44 & 0xfff) != _v16) {
											E00423300(_t286);
										}
										_v13 =  *(0x45870a + _v12 * 2 + ( *((intOrPtr*)( *_v28 + 0x34))(_v12) & 0x0000007f) - 0x1c) & 0x000000ff;
										_pop(_t329);
										 *[fs:eax] = _t329;
										_push(0x42b500);
										return E00423A74( &_v44);
									}
								}
							} else {
								E004233F0(__ecx);
								goto L41;
							}
						} else {
							_v13 = E0042ACC8(_v12, 0);
							goto L41;
						}
					} else {
						_v13 = E0042ACB4(1, 0);
						L41:
						return _v13 & 0x000000ff;
					}
				}
			}

0x0042b0ec
0x0042b0ed
0x0042b0ef
0x0042b0f4
0x0042b0f7
0x0042b0fa
0x0042b0fc
0x0042b100
0x0042b10d
0x0042b291
0x0042b297
0x0042b2ae
0x0042b2d0
0x0042b2df
0x0042b2f2
0x0042b3aa
0x0042b3b7
0x0042b42b
0x0042b43a
0x0042b44c
0x0042b4fb
0x00000000
0x0042b452
0x0042b459
0x0042b4f6
0x00000000
0x0042b45b
0x0042b45e
0x0042b45f
0x0042b466
0x0042b467
0x0042b46c
0x0042b46f
0x0042b472
0x0042b47b
0x0042b488
0x0042b48a
0x0042b48a
0x0042b4b3
0x0042b4b8
0x0042b4bb
0x0042b4be
0x0042b4cb
0x0042b4cb
0x0042b459
0x0042b42d
0x0042b42d
0x00000000
0x0042b42d
0x0042b3b9
0x0042b3bc
0x0042b3bd
0x0042b3c4
0x0042b3c5
0x0042b3ca
0x0042b3cd
0x0042b3d3
0x0042b3db
0x0042b3ea
0x0042b3ec
0x0042b3ec
0x0042b3ff
0x0042b404
0x0042b407
0x0042b40a
0x0042b417
0x0042b417
0x0042b2f8
0x0042b302
0x0042b39f
0x00000000
0x0042b304
0x0042b307
0x0042b308
0x0042b30f
0x0042b310
0x0042b315
0x0042b318
0x0042b31b
0x0042b325
0x0042b332
0x0042b334
0x0042b334
0x0042b35c
0x0042b361
0x0042b364
0x0042b367
0x0042b374
0x0042b374
0x0042b302
0x0042b2d2
0x0042b2d2
0x00000000
0x0042b2d2
0x0042b2b0
0x0042b2bc
0x00000000
0x0042b2bc
0x0042b299
0x0042b2a2
0x00000000
0x0042b2a2
0x0042b113
0x0042b116
0x0042b12d
0x0042b153
0x0042b162
0x0042b174
0x0042b22d
0x0042b22e
0x0042b235
0x0042b236
0x0042b23b
0x0042b23e
0x0042b241
0x0042b24a
0x0042b25a
0x0042b25c
0x0042b25c
0x0042b26e
0x0042b273
0x0042b276
0x0042b279
0x0042b286
0x0042b17a
0x0042b181
0x0042b222
0x00000000
0x0042b183
0x0042b186
0x0042b187
0x0042b18e
0x0042b18f
0x0042b194
0x0042b197
0x0042b19a
0x0042b1a3
0x0042b1b4
0x0042b1b6
0x0042b1b6
0x0042b1df
0x0042b1e4
0x0042b1e7
0x0042b1ea
0x0042b1f7
0x0042b1f7
0x0042b181
0x0042b155
0x0042b155
0x00000000
0x0042b155
0x0042b12f
0x0042b13b
0x00000000
0x0042b13b
0x0042b118
0x0042b121
0x0042b500
0x0042b509
0x0042b509
0x0042b116

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d506dea4572a16f2d663bf4d7ccd67ecc8a7a09006d430df05dc4ff7f1d5ac
Instruction ID: e663d32daf8916aded8d63c0d2434aa33fd3dabb5640a439b59991884f9fc373
Opcode Fuzzy Hash: a3d506dea4572a16f2d663bf4d7ccd67ecc8a7a09006d430df05dc4ff7f1d5ac
Instruction Fuzzy Hash: 54D19535B00169EFCB00EF95D4818FDBBB5EF48314F9444A7E840A7251DB38AE85DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00429BCC, Relevance: 7.8, APIs: 5, Instructions: 269
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00429BCC(signed short* __eax, intOrPtr __ecx, signed short* __edx, void* __edi, void* __fp0) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				signed int _v18;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v44;
				void* __ebp;
				void* _t115;
				signed int _t203;
				intOrPtr _t212;
				intOrPtr _t213;
				intOrPtr _t246;
				intOrPtr _t251;
				intOrPtr _t255;
				intOrPtr _t260;
				intOrPtr _t264;
				void* _t267;
				void* _t269;
				intOrPtr _t270;

				_t274 = __fp0;
				_t265 = __edi;
				_t267 = _t269;
				_t270 = _t269 + 0xffffffd8;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t200 =  *_v8 & 0x0000ffff;
				if(( *_v8 & 0xfff) >= 0x10f) {
					if(E0042BE20(_t200,  &_v24) == 0) {
						E004233F0(__ecx);
					}
					_push( &_v20);
					_t212 = _v16;
					if( *((intOrPtr*)( *_v24 + 8))() == 0) {
						_t203 =  *_v12 & 0x0000ffff;
						if((_t203 & 0x00000fff) >= 0x10f) {
							if(E0042BE20(_t203,  &_v28) != 0) {
								_push( &_v18);
								_t213 = _v16;
								if( *((intOrPtr*)( *_v28 + 4))() == 0) {
									_t115 = E004233F0(_t213);
									goto L35;
								} else {
									if(( *_v8 & 0x0000ffff) == _v18) {
										_t115 =  *((intOrPtr*)( *_v28 + 0x2c))(_v16);
										goto L35;
									} else {
										_push( &_v44);
										L00421A90();
										_push(_t267);
										_push(0x429eeb);
										_push( *[fs:eax]);
										 *[fs:eax] = _t270;
										_t215 = _v18 & 0x0000ffff;
										E004248E4( &_v44, _v18 & 0x0000ffff, _v8, _t265, _t274);
										E0042436C(_v8, _v18 & 0x0000ffff,  &_v44);
										if(( *_v8 & 0x0000ffff) != _v18) {
											E00423300(_t215);
										}
										_pop(_t246);
										 *[fs:eax] = _t246;
										_push(0x429ef2);
										return E00423A74( &_v44);
									}
								}
							} else {
								_t115 = E004233F0(_t212);
								goto L35;
							}
						} else {
							if(_t203 ==  *_v8) {
								_t115 = E0042AB4C(_v8, _v16, _v12);
								goto L35;
							} else {
								_push( &_v44);
								L00421A90();
								_push(_t267);
								_push(0x429e3f);
								_push( *[fs:eax]);
								 *[fs:eax] = _t270;
								_t220 =  *_v12 & 0x0000ffff;
								E004248E4( &_v44,  *_v12 & 0x0000ffff, _v8, _t265, _t274);
								E0042436C(_v8,  *_v12 & 0x0000ffff,  &_v44);
								if(( *_v8 & 0x0000ffff) !=  *_v12) {
									E00423300(_t220);
								}
								_pop(_t251);
								 *[fs:eax] = _t251;
								_push(0x429e46);
								return E00423A74( &_v44);
							}
						}
					} else {
						if(( *_v12 & 0x0000ffff) == _v20) {
							_t115 =  *((intOrPtr*)( *_v24 + 0x2c))(_v16);
							goto L35;
						} else {
							_push( &_v44);
							L00421A90();
							_push(_t267);
							_push(0x429da4);
							_push( *[fs:eax]);
							 *[fs:eax] = _t270;
							_t224 = _v20 & 0x0000ffff;
							E004248E4( &_v44, _v20 & 0x0000ffff, _v12, _t265, _t274);
							if((_v44 & 0x0000ffff) != _v20) {
								E00423300(_t224);
							}
							 *((intOrPtr*)( *_v24 + 0x2c))(_v16);
							_pop(_t255);
							 *[fs:eax] = _t255;
							_push(0x429f0b);
							return E00423A74( &_v44);
						}
					}
				} else {
					if(E0042BE20( *_v12 & 0x0000ffff,  &_v28) != 0) {
						_push( &_v18);
						if( *((intOrPtr*)( *_v28 + 4))() == 0) {
							_push( &_v44);
							L00421A90();
							_push(_t267);
							_push(0x429d07);
							_push( *[fs:eax]);
							 *[fs:eax] = _t270;
							_t230 =  *_v8 & 0x0000ffff;
							E004248E4( &_v44,  *_v8 & 0x0000ffff, _v12, __edi, __fp0);
							if(( *_v8 & 0x0000ffff) != _v44) {
								E00423300(_t230);
							}
							E0042AB4C(_v8, _v16,  &_v44);
							_pop(_t260);
							 *[fs:eax] = _t260;
							_push(0x429f0b);
							return E00423A74( &_v44);
						} else {
							if(( *_v8 & 0x0000ffff) == _v18) {
								_t115 =  *((intOrPtr*)( *_v28 + 0x2c))(_v16);
								goto L35;
							} else {
								_push( &_v44);
								L00421A90();
								_push(_t267);
								_push(0x429c8c);
								_push( *[fs:eax]);
								 *[fs:eax] = _t270;
								_t235 = _v18 & 0x0000ffff;
								E004248E4( &_v44, _v18 & 0x0000ffff, _v8, __edi, __fp0);
								E0042436C(_v8, _v18 & 0x0000ffff,  &_v44);
								if(( *_v8 & 0x0000ffff) != _v18) {
									E00423300(_t235);
								}
								_pop(_t264);
								 *[fs:eax] = _t264;
								_push(0x429c93);
								return E00423A74( &_v44);
							}
						}
					} else {
						_t115 = E004233F0(__ecx);
						L35:
						return _t115;
					}
				}
			}

0x00429bcc
0x00429bcc
0x00429bcd
0x00429bcf
0x00429bd3
0x00429bd6
0x00429bd9
0x00429bdf
0x00429bec
0x00429d1a
0x00429d1c
0x00429d1c
0x00429d24
0x00429d28
0x00429d35
0x00429dc5
0x00429dd2
0x00429e65
0x00429e74
0x00429e78
0x00429e85
0x00429f06
0x00000000
0x00429e87
0x00429e91
0x00429f01
0x00000000
0x00429e93
0x00429e96
0x00429e97
0x00429e9e
0x00429e9f
0x00429ea4
0x00429ea7
0x00429eaa
0x00429eb4
0x00429ebf
0x00429ece
0x00429ed0
0x00429ed0
0x00429ed7
0x00429eda
0x00429edd
0x00429eea
0x00429eea
0x00429e91
0x00429e67
0x00429e67
0x00000000
0x00429e67
0x00429dd8
0x00429de1
0x00429e4f
0x00000000
0x00429de3
0x00429de6
0x00429de7
0x00429dee
0x00429def
0x00429df4
0x00429df7
0x00429dfd
0x00429e06
0x00429e11
0x00429e22
0x00429e24
0x00429e24
0x00429e2b
0x00429e2e
0x00429e31
0x00429e3e
0x00429e3e
0x00429de1
0x00429d3b
0x00429d45
0x00429dba
0x00000000
0x00429d47
0x00429d4a
0x00429d4b
0x00429d52
0x00429d53
0x00429d58
0x00429d5b
0x00429d5e
0x00429d68
0x00429d75
0x00429d77
0x00429d77
0x00429d8b
0x00429d90
0x00429d93
0x00429d96
0x00429da3
0x00429da3
0x00429d45
0x00429bf2
0x00429c02
0x00429c11
0x00429c22
0x00429cad
0x00429cae
0x00429cb5
0x00429cb6
0x00429cbb
0x00429cbe
0x00429cc4
0x00429ccd
0x00429cdc
0x00429cde
0x00429cde
0x00429cec
0x00429cf3
0x00429cf6
0x00429cf9
0x00429d06
0x00429c28
0x00429c32
0x00429ca2
0x00000000
0x00429c34
0x00429c37
0x00429c38
0x00429c3f
0x00429c40
0x00429c45
0x00429c48
0x00429c4b
0x00429c55
0x00429c60
0x00429c6f
0x00429c71
0x00429c71
0x00429c78
0x00429c7b
0x00429c7e
0x00429c8b
0x00429c8b
0x00429c32
0x00429c04
0x00429c04
0x00429f0b
0x00429f0f
0x00429f0f
0x00429c02

APIs

VariantInit.OLEAUT32(?), ref: 00429C38
VariantInit.OLEAUT32(?), ref: 00429D4B

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 31dea10ece24042977b94ad332995b6db98b17d1f1c9655e5d9323ddbdefc42a
Instruction ID: 517de94f234af0a2b1e79363b42983113dc343d89ae35d42b00b593ffc3734a5
Opcode Fuzzy Hash: 31dea10ece24042977b94ad332995b6db98b17d1f1c9655e5d9323ddbdefc42a
Instruction Fuzzy Hash: 82B13935B00229EFCB00EF95E5818EDB7B9FF48714FD144A6F900A3255DB38AE45DA68

Uniqueness

Uniqueness Score: -1.00%

Function 0041E054, Relevance: 7.6, APIs: 5, Instructions: 50
threadCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0041E054(void* __esi, void* __eflags) {
				char _v8;
				intOrPtr* _t18;
				intOrPtr _t26;
				void* _t27;
				long _t29;
				intOrPtr _t32;
				void* _t33;

				_t33 = __eflags;
				_push(0);
				_push(_t32);
				_push(0x41e0eb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				E0041D5D8(GetThreadLocale(), 0x41e104, 0x100b,  &_v8);
				_t29 = E004193D8(0x41e104, 1, _t33);
				if(_t29 + 0xfffffffd - 3 < 0) {
					EnumCalendarInfoW(E0041DFA0, GetThreadLocale(), _t29, 4);
					_t27 = 7;
					_t18 = 0x45bd94;
					do {
						 *_t18 = 0xffffffff;
						_t18 = _t18 + 4;
						_t27 = _t27 - 1;
					} while (_t27 != 0);
					EnumCalendarInfoW(E0041DFDC, GetThreadLocale(), _t29, 3);
				}
				_pop(_t26);
				 *[fs:eax] = _t26;
				_push(0x41e0f2);
				return E00406658( &_v8);
			}

0x0041e054
0x0041e057
0x0041e05c
0x0041e05d
0x0041e062
0x0041e065
0x0041e07b
0x0041e08d
0x0041e097
0x0041e0a7
0x0041e0ac
0x0041e0b1
0x0041e0b6
0x0041e0b6
0x0041e0bc
0x0041e0bf
0x0041e0bf
0x0041e0d0
0x0041e0d0
0x0041e0d7
0x0041e0da
0x0041e0dd
0x0041e0ea

APIs

GetThreadLocale.KERNEL32(?,00000000,0041E0EB,?,?,00000000), ref: 0041E06C

Part of subcall function 0041D5D8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041D5F6

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0041E0EB,?,?,00000000), ref: 0041E09C
EnumCalendarInfoW.KERNEL32(Function_0001DFA0,00000000,00000000,00000004,00000000,0041E0EB,?,?,00000000), ref: 0041E0A7
GetThreadLocale.KERNEL32(00000000,00000003,Function_0001DFA0,00000000,00000000,00000004,00000000,0041E0EB,?,?,00000000), ref: 0041E0C5
EnumCalendarInfoW.KERNEL32(Function_0001DFDC,00000000,00000000,00000003,Function_0001DFA0,00000000,00000000,00000004,00000000,0041E0EB,?,?,00000000), ref: 0041E0D0

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 3ade1bf6ed9f5a8d4e29643ca631aa76670860bd7149988f10ef33ca57e66939
Instruction ID: 1b18b928cb1ddebf41b21687c81fa495ad61704039416c792120c45b5feafcb9
Opcode Fuzzy Hash: 3ade1bf6ed9f5a8d4e29643ca631aa76670860bd7149988f10ef33ca57e66939
Instruction Fuzzy Hash: 640147747006147BD311B6728C13F9E7558EB0A718F614837F801B76C1D67C9E51826E

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF44, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79
threadCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0041BF44(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				short _v536;
				intOrPtr _v540;
				short* _t34;
				intOrPtr* _t50;
				intOrPtr _t59;
				void* _t64;
				intOrPtr _t66;
				void* _t70;

				_v8 = 0;
				_t50 = __edx;
				_t64 = __eax;
				_push(_t70);
				_push(0x41c033);
				_push( *[fs:eax]);
				 *[fs:eax] = _t70 + 0xfffffde8;
				E00406658(__edx);
				_v24 =  *(_a4 - 2) & 0x0000ffff;
				_v22 =  *(_a4 - 4) & 0x0000ffff;
				_v18 =  *(_a4 - 6) & 0x0000ffff;
				if(_t64 > 2) {
					E00406A80( &_v8, L"yyyy");
				} else {
					E00406A80( &_v8, 0x41c04c);
				}
				_t34 = E004072B8(_v8);
				if(GetDateFormatW(GetThreadLocale(), 4,  &_v24, _t34,  &_v536, 0x200) != 0) {
					E0040734C(_t50, 0x100,  &_v536);
					if(_t64 == 1 &&  *((short*)( *_t50)) == 0x30) {
						_v540 =  *_t50;
						_t66 = _v540;
						if(_t66 != 0) {
							_t66 =  *((intOrPtr*)(_t66 - 4));
						}
						E0040766C( *_t50, _t66 - 1, 2, _t50);
					}
				}
				_pop(_t59);
				 *[fs:eax] = _t59;
				_push(0x41c03a);
				return E00406658( &_v8);
			}

0x0041bf51
0x0041bf54
0x0041bf56
0x0041bf5a
0x0041bf5b
0x0041bf60
0x0041bf63
0x0041bf68
0x0041bf74
0x0041bf7f
0x0041bf8a
0x0041bf91
0x0041bfaa
0x0041bf93
0x0041bf9b
0x0041bf9b
0x0041bfbe
0x0041bfd7
0x0041bfe6
0x0041bfec
0x0041bff8
0x0041bffe
0x0041c006
0x0041c00b
0x0041c00b
0x0041c018
0x0041c018
0x0041bfec
0x0041c01f
0x0041c022
0x0041c025
0x0041c032

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,0041C033), ref: 0041BFCA
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,0041C033), ref: 0041BFD0

Strings

yyyy, xrefs: 0041BFA5
, xrefs: 0041BF96

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: e9f8ddc607c78921057641c82d02b20c64341dd6abf628d872694aad5630559b
Instruction ID: 1d82e2325234fb9921a237082344897347903be7d979594794ede7a7775da521
Opcode Fuzzy Hash: e9f8ddc607c78921057641c82d02b20c64341dd6abf628d872694aad5630559b
Instruction Fuzzy Hash: 08215535A406189FD711EFA5CC81A9EB7B4EF08700F5144AAF805E7391D7389E409BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0044C688, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E0044C688(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr* _v12;
				char _v16;
				struct HINSTANCE__* _t18;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr _t30;
				intOrPtr* _t33;
				intOrPtr* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t62;

				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t41 = __edx;
				_push(_t62);
				_push(0x44c750);
				_push( *[fs:eax]);
				 *[fs:eax] = _t62;
				_t18 = GetModuleHandleW(L"OLEAUT32.DLL");
				_t57 = _t18;
				if(_t18 != 0) {
					_t59 = 0;
					if(_t41 != 0) {
						_t59 = E0040A8C4(_t41, 0, _t57, L"UnRegisterTypeLibForUser");
					}
					if(_t59 == 0) {
						_t59 = E0040A8C4(_t41, _t59, _t57, L"UnRegisterTypeLib");
					}
					if(_t59 != 0) {
						_t24 =  *0x45dfe4; // 0x0
						 *((intOrPtr*)( *_t24 + 0x1c))( &_v8);
						_t26 = _v12;
						E00448954( *((intOrPtr*)( *_t26 + 0x1c))(_t26));
						_t30 = _v8;
						 *_t59(_t30,  *(_t30 + 0x18) & 0x0000ffff,  *(_t30 + 0x1a) & 0x0000ffff,  *((intOrPtr*)(_t30 + 0x10)),  *((intOrPtr*)(_t30 + 0x14)));
						_t33 =  *0x45dfe4; // 0x0
						 *((intOrPtr*)( *_t33 + 0x1c))(_v8);
						_t35 = _v16;
						 *((intOrPtr*)( *_t35 + 0x30))(_t35);
					}
				}
				_pop(_t48);
				 *[fs:eax] = _t48;
				_push(0x44c757);
				_t49 =  *0x40adc8; // 0x40adcc
				return E00407A34( &_v16, 2, _t49);
			}

0x0044c68b
0x0044c68d
0x0044c68f
0x0044c691
0x0044c692
0x0044c694
0x0044c698
0x0044c699
0x0044c69e
0x0044c6a1
0x0044c6a9
0x0044c6ae
0x0044c6b2
0x0044c6b6
0x0044c6ba
0x0044c6c7
0x0044c6c7
0x0044c6cb
0x0044c6d8
0x0044c6d8
0x0044c6dc
0x0044c6e5
0x0044c6ec
0x0044c6ef
0x0044c6f8
0x0044c6fd
0x0044c713
0x0044c71c
0x0044c723
0x0044c726
0x0044c72c
0x0044c72c
0x0044c6dc
0x0044c731
0x0044c734
0x0044c737
0x0044c73f
0x0044c74f

APIs

GetModuleHandleW.KERNEL32(OLEAUT32.DLL,00000000,0044C750,?,?,?,?,00000000,00000000,00000000), ref: 0044C6A9

Part of subcall function 0040A8C4: GetProcAddress.KERNEL32(?,?), ref: 0040A8E8

Strings

UnRegisterTypeLib, xrefs: 0044C6CD
OLEAUT32.DLL, xrefs: 0044C6A4
UnRegisterTypeLibForUser, xrefs: 0044C6BC

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLibForUser
API String ID: 1646373207-2227340434
Opcode ID: bfc294587217549e382812a8b63ea2c283c7221b92cba5bdfead8165f4c867af
Instruction ID: 581a0ccbc49df657ce8d146d8f35181bf60b64217acb18c72964299c9a78bf2f
Opcode Fuzzy Hash: bfc294587217549e382812a8b63ea2c283c7221b92cba5bdfead8165f4c867af
Instruction Fuzzy Hash: 0921D636A00210AFD751DF55C881E6AB7F8EF8C700B1580A6F900E7391DB38EC01CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0044C56C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69
registryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0044C56C(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _t38;
				intOrPtr _t47;
				intOrPtr* _t51;
				void* _t53;
				intOrPtr _t56;

				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t38 = __ecx;
				_t53 = __eax;
				_push(_t56);
				_push(0x44c62c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t56;
				E0040739C( &_v8, __edx);
				E00419A38(__edx,  &_v16);
				E0040739C( &_v12, _v16);
				if(_t38 == 0) {
					L4:
					_push(E00407024(_v12));
					_push(E00407024(_v8));
					_push(_t53);
					L0040AF90();
					E00448954(_t22);
				} else {
					_t39 = GetModuleHandleW(L"OLEAUT32.DLL");
					if(_t29 == 0) {
						goto L4;
					} else {
						_t51 = E0040A8C4(_t39, _t53, _t39, L"RegisterTypeLibForUser");
						if(_t51 == 0) {
							goto L4;
						} else {
							E00448954( *_t51(_t53, E00407024(_v8), E00407024(_v12)));
						}
					}
				}
				_pop(_t47);
				 *[fs:eax] = _t47;
				_push(0x44c633);
				E00406658( &_v16);
				return E00406718( &_v12, 2);
			}

0x0044c56f
0x0044c571
0x0044c573
0x0044c575
0x0044c576
0x0044c578
0x0044c57c
0x0044c580
0x0044c581
0x0044c586
0x0044c589
0x0044c591
0x0044c59b
0x0044c5a6
0x0044c5ad
0x0044c5ec
0x0044c5f4
0x0044c5fd
0x0044c5fe
0x0044c5ff
0x0044c604
0x0044c5af
0x0044c5b9
0x0044c5bd
0x00000000
0x0044c5bf
0x0044c5ca
0x0044c5ce
0x00000000
0x0044c5d0
0x0044c5e5
0x0044c5e5
0x0044c5ce
0x0044c5bd
0x0044c60b
0x0044c60e
0x0044c611
0x0044c619
0x0044c62b

APIs

GetModuleHandleW.KERNEL32(OLEAUT32.DLL,00000000,0044C62C,?,?,?,?,00000000,00000000,00000000), ref: 0044C5B4

Part of subcall function 0040A8C4: GetProcAddress.KERNEL32(?,?), ref: 0040A8E8

RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 0044C5FF

Strings

RegisterTypeLibForUser, xrefs: 0044C5BF
OLEAUT32.DLL, xrefs: 0044C5AF

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcRegisterType
String ID: OLEAUT32.DLL$RegisterTypeLibForUser
API String ID: 3041890036-2666564778
Opcode ID: b76a1db701e38e4d049415a984d16f40f69dc791161e4291dabc1b915e161a1b
Instruction ID: b9f07f21fab152b2e0b6290161ee90af867a6ede7a29fb68e4b0838362b732f2
Opcode Fuzzy Hash: b76a1db701e38e4d049415a984d16f40f69dc791161e4291dabc1b915e161a1b
Instruction Fuzzy Hash: 8C118471A056447BE751F7668C82B6E77ADDF44308F25407BB500B3282DA7CAE06855E

Uniqueness

Uniqueness Score: -1.00%

Function 004489EC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004489EC(void* __eax, intOrPtr __ecx, void* __edx, void* _a4) {
				void* _v8;
				int _v12;
				void* __ebp;
				long _t12;
				char* _t17;
				long _t25;
				intOrPtr _t27;
				intOrPtr _t33;
				void* _t37;
				intOrPtr _t40;

				_t40 = __ecx;
				_t37 = __edx;
				_t12 = RegCreateKeyExW(_a4, E004072B8(__eax), 0, 0x448a88, 0, 0x2001f, 0,  &_v8,  &_v12);
				_t25 = _t12;
				if(_t25 == 0) {
					_t27 = _t40;
					if(_t27 != 0) {
						_t27 =  *((intOrPtr*)(_t27 - 4));
					}
					_t17 = E004072B8(_t40);
					_t25 = RegSetValueExW(_v8, E004072B8(_t37), 0, 1, _t17, _t27 + 1 + _t27 + 1);
					_t12 = RegCloseKey(_v8);
				}
				if(_t25 != 0) {
					_t33 =  *0x458a28; // 0x444c40
					_t12 = E0041E50C(_t33, 1);
					E00405E5C();
				}
				return _t12;
			}

0x004489f5
0x004489f7
0x00448a1f
0x00448a24
0x00448a28
0x00448a2a
0x00448a2e
0x00448a33
0x00448a33
0x00448a3d
0x00448a58
0x00448a5e
0x00448a5e
0x00448a65
0x00448a67
0x00448a74
0x00448a79
0x00448a79
0x00448a84

APIs

RegCreateKeyExW.ADVAPI32(?,00000000,00000000,00448A88,00000000,0002001F,00000000,?,?), ref: 00448A1F
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,00000000,?,?,00000000,00000000,00448A88,00000000,0002001F,00000000,?,?), ref: 00448A53
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,?,?,00000000,00000000,00448A88,00000000,0002001F,00000000,?,?), ref: 00448A5E

Strings

@LD, xrefs: 00448A67

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: @LD
API String ID: 1818849710-2728841554
Opcode ID: ad0949387a5b27a4838306a1d23bf15ca7893b810df9bfeff83d51ab925dfca8
Instruction ID: 48d040dd62d64bf35a406fcf8b773a79cb87b5b43dc23b8b881fd69cf1a1342a
Opcode Fuzzy Hash: ad0949387a5b27a4838306a1d23bf15ca7893b810df9bfeff83d51ab925dfca8
Instruction Fuzzy Hash: 37115E767443046BE710EAAA9CC2F9B739C9B18714F10013BBA08F7282DDB9ED0457A9

Uniqueness

Uniqueness Score: -1.00%

Function 00408BB8, Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00408BB8(signed short __eax, void* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				short _v22;
				short _v24;
				char _v26;
				char _v32;
				void* __ebp;
				void* _t39;
				void* _t55;
				void* _t59;
				short* _t62;
				signed short _t66;
				void* _t67;
				void* _t68;
				signed short _t79;
				void* _t81;

				_t81 = __edx;
				_t66 = __eax;
				_v16 = 0;
				if(__eax !=  *0x45bb80()) {
					_v16 = E00408B74( &_v8);
					_t79 = _t66;
					_v20 = 3;
					_t62 =  &_v26;
					do {
						 *_t62 =  *(0xf + "0123456789ABCDEF") & 0x000000ff;
						_t79 = (_t79 & 0x0000ffff) >> 4;
						_v20 = _v20 - 1;
						_t62 = _t62 - 2;
					} while (_v20 != 0xffffffff);
					_v24 = 0;
					_v22 = 0;
					 *0x45bb7c(4,  &_v32,  &_v20);
				}
				_t39 = E00408B74( &_v12);
				_t67 = _t39;
				if(_t67 != 0) {
					_t55 = _v12 - 2;
					if(_t55 >= 0) {
						_t59 = _t55 + 1;
						_v20 = 0;
						do {
							if( *((short*)(_t67 + _v20 * 2)) == 0) {
								 *((short*)(_t67 + _v20 * 2)) = 0x2c;
							}
							_v20 = _v20 + 1;
							_t59 = _t59 - 1;
						} while (_t59 != 0);
					}
					E00407310(_t81, _t67);
					_t39 = E004044A0(_t67);
				}
				if(_v16 != 0) {
					 *0x45bb7c(0, 0,  &_v20);
					_t68 = E00408B74( &_v12);
					if(_v8 != _v12 || E00408B50(_v16, _v12, _t68) != 0) {
						 *0x45bb7c(8, _v16,  &_v20);
					}
					E004044A0(_t68);
					return E004044A0(_v16);
				}
				return _t39;
			}

0x00408bc0
0x00408bc2
0x00408bc6
0x00408bd2
0x00408bdc
0x00408bdf
0x00408be1
0x00408be8
0x00408beb
0x00408bfc
0x00408c02
0x00408c05
0x00408c08
0x00408c0b
0x00408c11
0x00408c17
0x00408c27
0x00408c27
0x00408c30
0x00408c35
0x00408c39
0x00408c3e
0x00408c43
0x00408c45
0x00408c46
0x00408c4d
0x00408c55
0x00408c5a
0x00408c5a
0x00408c60
0x00408c63
0x00408c63
0x00408c4d
0x00408c6a
0x00408c71
0x00408c71
0x00408c7a
0x00408c84
0x00408c92
0x00408c9a
0x00408cb7
0x00408cb7
0x00408cbf
0x00000000
0x00408cc7
0x00408cd1

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00408BC9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00408C27
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00408C84
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00408CB7

Part of subcall function 00408B74: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00408C35), ref: 00408B8B
Part of subcall function 00408B74: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00408C35), ref: 00408BA8

Memory Dump Source

Source File: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: e84ce1af6ecec7689740048bac9e8a8c5cefbf12e63df4037a13d5de7f97c819
Instruction ID: 9f23075f820d752611a58e0315da63b4785e45efd7f0cfeaa8e5b6fde4ab111b
Opcode Fuzzy Hash: e84ce1af6ecec7689740048bac9e8a8c5cefbf12e63df4037a13d5de7f97c819
Instruction Fuzzy Hash: A2317E70A0421E9BDB10DFA5C984AAEB3B8FF54315F00457EE551F72D1DB78AA04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004282F4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E004282F4(signed short* __eax, void* __ebx, intOrPtr* __edx) {
				intOrPtr* _v8;
				char _v9;
				void* _v16;
				char _v24;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr* _t21;
				signed short* _t43;
				intOrPtr _t54;
				intOrPtr _t60;
				void* _t63;
				void* _t64;
				intOrPtr _t65;

				_t63 = _t64;
				_t65 = _t64 + 0xffffffdc;
				_v36 = 0;
				_v40 = 0;
				_v8 = __edx;
				_t43 = __eax;
				_t21 = _v8;
				if(_t21 != 0) {
					 *_t21 = 0;
				}
				_push(_t63);
				_push(0x4283bf);
				_push( *[fs:eax]);
				 *[fs:eax] = _t65;
				_v9 = E0042BE20( *_t43 & 0x0000ffff,  &_v16);
				if(_v9 == 0) {
					_pop(_t54);
					 *[fs:eax] = _t54;
					_push(E004283C6);
					return E004066B8( &_v40, 2);
				} else {
					_t8 =  &_v32; // 0x424f0d
					L00421A90();
					 *[fs:eax] = _t65;
					 *((intOrPtr*)( *_v16 + 0x1c))( *[fs:eax], 0x42839d, _t63, _t8);
					_t14 =  &_v24; // 0x425148
					E00407310( &_v40,  *_t14);
					E0040766C(_v40, 0x7fffffff, 1,  &_v36);
					E0040739C(_v8, _v36);
					_t60 = 8;
					 *[fs:eax] = _t60;
					_push(E004283A4);
					_t18 =  &_v32; // 0x424f0d
					return E00423A74(_t18);
				}
			}

0x004282f5
0x004282f7
0x004282fd
0x00428300
0x00428303
0x00428306
0x00428308
0x0042830d
0x00428311
0x00428311
0x00428315
0x00428316
0x0042831b
0x0042831e
0x0042832c
0x00428333
0x004283a6
0x004283a9
0x004283ac
0x004283be
0x00428335
0x00428335
0x00428339
0x00428349
0x00428358
0x00428362
0x00428365
0x00428377
0x00428382
0x00428389
0x0042838c
0x0042838f
0x00428394
0x0042839c
0x0042839c

APIs

VariantInit.OLEAUT32(OB), ref: 00428339

Strings

HQB, xrefs: 00428362
OB, xrefs: 00428335, 00428350, 00428394, 00428338

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: OB$HQB
API String ID: 1927566239-1244505494
Opcode ID: d30197d52ff7d55f698807342833a6a64f2f0040529bc8a1943bd7b72fdb63ae
Instruction ID: ce50e00e062e4224360ad58fb7818a9a0cafc2074aeafacec8c2964351eff409
Opcode Fuzzy Hash: d30197d52ff7d55f698807342833a6a64f2f0040529bc8a1943bd7b72fdb63ae
Instruction Fuzzy Hash: 33218630B042089FDB05DFA5D8429DEB7F9EB49710F9185BAEC00E3691DB396D05CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0044E1D0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
windowCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0044E1D0(void* __ecx, void* __eflags, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* __ebp;
				intOrPtr _t34;
				void* _t40;
				intOrPtr _t41;

				_push(0);
				_push(0);
				_push(0);
				_push(_a4);
				_push(_t40);
				_push(0x44e236);
				_push( *[fs:eax]);
				 *[fs:eax] = _t41;
				E00404844(0,  &_v16, _t40);
				E00419B90(_v16,  &_v12);
				E004074FC( &_v8, _v12, L"Usage: ");
				MessageBoxW(0, E004072B8(_v8), L"Host", 0);
				_pop(_t34);
				 *[fs:eax] = _t34;
				E004066B8( &_v16, 3);
				return 0;
			}

0x0044e1d3
0x0044e1d5
0x0044e1d7
0x0044e1dc
0x0044e1e1
0x0044e1e2
0x0044e1e7
0x0044e1ea
0x0044e1f2
0x0044e1fd
0x0044e20d
0x0044e224
0x0044e22b
0x0044e22e
0x0044e243
0x0044e250

APIs

Part of subcall function 00404844: GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 00404868

MessageBoxW.USER32(00000000,00000000,Host,00000000), ref: 0044E224

Strings

Host, xrefs: 0044E214
Usage: , xrefs: 0044E208

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FileMessageModuleName
String ID: Host$Usage:
API String ID: 3425244467-3988290099
Opcode ID: e06bbbeb76da8c48c34ab86bd58cff87c86df879cd6d5b352f54d525989dccd7
Instruction ID: 3efb4be876b19a7bab69bb76604f0080fa663807799fddb178197189f838b234
Opcode Fuzzy Hash: e06bbbeb76da8c48c34ab86bd58cff87c86df879cd6d5b352f54d525989dccd7
Instruction Fuzzy Hash: 8601AC31B04208BFE711EAA2DC52F5EB7ACFB85714F6144BBF900A71C1D5746E14C669

Uniqueness

Uniqueness Score: -1.00%

Function 0044DF38, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
windowCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0044DF38(void* __ecx, void* __eflags, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				void* __ebp;
				intOrPtr _t34;
				void* _t40;
				intOrPtr _t41;

				_push(0);
				_push(0);
				_push(0);
				_push(_a4);
				_push(_t40);
				_push(0x44df9e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t41;
				E00404844(0,  &_v16, _t40);
				E00419B90(_v16,  &_v12);
				E004074FC( &_v8, _v12, L"Usage: ");
				MessageBoxW(0, E004072B8(_v8), L"Host", 0);
				_pop(_t34);
				 *[fs:eax] = _t34;
				E004066B8( &_v16, 3);
				return 0;
			}

0x0044df3b
0x0044df3d
0x0044df3f
0x0044df44
0x0044df49
0x0044df4a
0x0044df4f
0x0044df52
0x0044df5a
0x0044df65
0x0044df75
0x0044df8c
0x0044df93
0x0044df96
0x0044dfab
0x0044dfb8

APIs

Part of subcall function 00404844: GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 00404868

MessageBoxW.USER32(00000000,00000000,Host,00000000), ref: 0044DF8C

Strings

Host, xrefs: 0044DF7C
Usage: , xrefs: 0044DF70

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: FileMessageModuleName
String ID: Host$Usage:
API String ID: 3425244467-3988290099
Opcode ID: 4f8f2f27a05abcf9c2918ded1fa91444e2f0c36f217527477f04cef9f6852ed1
Instruction ID: 9564ca235332580de59704b676867ee861e5f14ad262926aa16c1aef51b55e22
Opcode Fuzzy Hash: 4f8f2f27a05abcf9c2918ded1fa91444e2f0c36f217527477f04cef9f6852ed1
Instruction Fuzzy Hash: 7C01F731B04208BFE710EA91DC52F9EB7ACDB85714F60447BF901A72C0C5786A18C669

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDA4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041FDA4() {
				void* __ebx;
				struct HINSTANCE__* _t1;
				void* _t4;

				_t1 = GetModuleHandleW(L"kernel32.dll");
				_t3 = _t1;
				if(_t1 != 0) {
					_t1 = E0040A8C4(_t3, _t4, _t3, L"GetDiskFreeSpaceExW");
					 *0x457f28 = _t1;
				}
				if( *0x457f28 == 0) {
					 *0x457f28 = E00419CF4;
					return E00419CF4;
				}
				return _t1;
			}

0x0041fdaa
0x0041fdaf
0x0041fdb3
0x0041fdbb
0x0041fdc0
0x0041fdc0
0x0041fdcc
0x0041fdd3
0x00000000
0x0041fdd3
0x0041fdd9

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0045633F,00000000,00456365), ref: 0041FDAA

Part of subcall function 0040A8C4: GetProcAddress.KERNEL32(?,?), ref: 0040A8E8

Strings

GetDiskFreeSpaceExW, xrefs: 0041FDB5
kernel32.dll, xrefs: 0041FDA5

Memory Dump Source

Source File: 00000001.00000002.407890365.0000000000412000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.407814853.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.407834625.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407866406.000000000040D000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.407942394.0000000000457000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407962431.000000000045D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.407980888.0000000000460000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408008337.0000000000461000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.408040014.0000000000462000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.408057289.000000000046E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Mes_Drivers_3.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: 0b3a606038b328406dc74f3cc23160753029376674eff30f24c53e40434d247e
Instruction ID: afe081b95e3e5f968adbc578c3e2cf1d6d7254a913b0af528e6dfd0b35c9c040
Opcode Fuzzy Hash: 0b3a606038b328406dc74f3cc23160753029376674eff30f24c53e40434d247e
Instruction Fuzzy Hash: 50D0C7726543455FDB00EBA57CD677921949714716F20443BE102652D3E67CC8DE871D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: detection.exe PID: 5556 Parent PID: 400 detection.exeCOMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1567
Total number of Limit Nodes:	57

Executed Functions

Function 00409E04, Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00409E04(char __eax, void* __ebx, intOrPtr* __edx, void* __eflags) {
				char _v8;
				short _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _t29;
				void* _t40;
				intOrPtr* _t44;
				intOrPtr _t55;
				void* _t61;

				_push(__ebx);
				_v24 = 0;
				_v20 = 0;
				_t44 = __edx;
				_v8 = __eax;
				E0040702C(_v8);
				_push(_t61);
				_push(0x409ec4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t61 + 0xffffffec;
				_t21 =  &_v16;
				L00402874();
				GetLocaleInfoW( &_v16 & 0x0000ffff, 3, _t21, 4);
				E00407C3C( &_v20, 4,  &_v16);
				E00407DEC(_t44, _v20, _v8);
				_t29 = E00409CCC( *_t44, _t44); // executed
				if(_t29 == 0) {
					_v12 = 0;
					E00407C3C( &_v24, 4,  &_v16);
					E00407DEC(_t44, _v24, _v8);
					_t40 = E00409CCC( *_t44, _t44); // executed
					if(_t40 == 0) {
						E00406F48(_t44);
					}
				}
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(E00409ECB);
				E00406FA8( &_v24, 2);
				return E00406F48( &_v8);
			}

0x00409e0a
0x00409e0d
0x00409e10
0x00409e13
0x00409e15
0x00409e1b
0x00409e22
0x00409e23
0x00409e28
0x00409e2b
0x00409e30
0x00409e36
0x00409e3f
0x00409e4f
0x00409e5c
0x00409e63
0x00409e6a
0x00409e6c
0x00409e7d
0x00409e8a
0x00409e91
0x00409e98
0x00409e9c
0x00409e9c
0x00409e98
0x00409ea3
0x00409ea6
0x00409ea9
0x00409eb6
0x00409ec3

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,00409EC4,?,?), ref: 00409E36
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,00409EC4,?,?), ref: 00409E3F

Part of subcall function 00409CCC: FindFirstFileW.KERNEL32(00000000,?,00000000,00409D2A,?,00000001), ref: 00409CFF
Part of subcall function 00409CCC: FindClose.KERNEL32(00000000,00000000,?,00000000,00409D2A,?,00000001), ref: 00409D0F

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: ded9c7ac0b999c5325c61e88323c58170cccd6dadc36e87a570d60ef0880be53
Instruction ID: 65de620f2e74b8c0ce9bff9e180b80b9fcb39b4a329e951541a1473207173095
Opcode Fuzzy Hash: ded9c7ac0b999c5325c61e88323c58170cccd6dadc36e87a570d60ef0880be53
Instruction Fuzzy Hash: FC118770A042099BDF00EBA5DD42AAEB3B9EF44304F50447BF904B33D2D778AE05C669

Uniqueness

Uniqueness Score: -1.00%

Function 00409CCC, Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E00409CCC(char __eax, signed int __ebx) {
				char _v8;
				struct _WIN32_FIND_DATAW _v600;
				void* _t15;
				intOrPtr _t24;
				void* _t27;

				_push(__ebx);
				_v8 = __eax;
				E0040702C(_v8);
				_push(_t27);
				_push(0x409d2a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27 + 0xfffffdac;
				_t15 = FindFirstFileW(E00407BA8(_v8),  &_v600); // executed
				if((__ebx & 0xffffff00 | _t15 != 0xffffffff) != 0) {
					FindClose(_t15);
				}
				_pop(_t24);
				 *[fs:eax] = _t24;
				_push(E00409D31);
				return E00406F48( &_v8);
			}

0x00409cd5
0x00409cd6
0x00409cdc
0x00409ce3
0x00409ce4
0x00409ce9
0x00409cec
0x00409cff
0x00409d0c
0x00409d0f
0x00409d0f
0x00409d16
0x00409d19
0x00409d1c
0x00409d29

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00409D2A,?,00000001), ref: 00409CFF
FindClose.KERNEL32(00000000,00000000,?,00000000,00409D2A,?,00000001), ref: 00409D0F

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 19e8d59d174df1d283add6c95ed35737f83bc25e7cfd383e7118d10e6c61377c
Instruction ID: daba3004d8ebb30b6a3043d4ada563e9bc72c4e2ae1a488f8d87b610c453e66b
Opcode Fuzzy Hash: 19e8d59d174df1d283add6c95ed35737f83bc25e7cfd383e7118d10e6c61377c
Instruction Fuzzy Hash: 3BF0BE31944208BEC711EB75CD1299EB3ACEF8832476005B6B400F35D2EA3CAE009528

Uniqueness

Uniqueness Score: -1.00%

Function 004098FC, Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 174
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E004098FC(char __eax, void* __ebx, void* __edx) {
				char _v8;
				char* _v12;
				void* _v16;
				int _v20;
				short _v542;
				long _t51;
				long _t85;
				long _t87;
				long _t89;
				long _t91;
				long _t93;
				void* _t97;
				intOrPtr _t103;
				intOrPtr _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t111;

				_t109 = _t110;
				_t111 = _t110 + 0xfffffde4;
				_t97 = __edx;
				_v8 = __eax;
				E0040702C(_v8);
				_push(_t109);
				_push(0x409b21);
				_push( *[fs:eax]);
				 *[fs:eax] = _t111;
				if(_v8 != 0) {
					lstrcpynW( &_v542, E00407BA8(_v8), 0x105);
				} else {
					GetModuleFileNameW(0,  &_v542, 0x105);
				}
				if(_v542 == 0) {
					L18:
					_pop(_t103);
					 *[fs:eax] = _t103;
					_push(E00409B28);
					return E00406F48( &_v8);
				} else {
					_v12 = 0;
					_t51 = RegOpenKeyExW(0x80000001, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
					if(_t51 == 0) {
						L10:
						_push(_t109);
						_push(0x409b04);
						_push( *[fs:eax]);
						 *[fs:eax] = _t111;
						E00409708( &_v542, 0x105);
						if(RegQueryValueExW(_v16,  &_v542, 0, 0, 0,  &_v20) != 0) {
							if(RegQueryValueExW(_v16, 0x409c14, 0, 0, 0,  &_v20) == 0) {
								_v12 = E004044CC(_v20);
								RegQueryValueExW(_v16, 0x409c14, 0, 0, _v12,  &_v20);
								E00407C00(_t97, _v12);
							}
						} else {
							_v12 = E004044CC(_v20);
							RegQueryValueExW(_v16,  &_v542, 0, 0, _v12,  &_v20);
							E00407C00(_t97, _v12);
						}
						_pop(_t105);
						 *[fs:eax] = _t105;
						_push(0x409b0b);
						if(_v12 != 0) {
							E004044E8(_v12);
						}
						return RegCloseKey(_v16);
					} else {
						_t85 = RegOpenKeyExW(0x80000002, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
						if(_t85 == 0) {
							goto L10;
						} else {
							_t87 = RegOpenKeyExW(0x80000001, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
							if(_t87 == 0) {
								goto L10;
							} else {
								_t89 = RegOpenKeyExW(0x80000002, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
								if(_t89 == 0) {
									goto L10;
								} else {
									_t91 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Locales", 0, 0xf0019,  &_v16); // executed
									if(_t91 == 0) {
										goto L10;
									} else {
										_t93 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v16); // executed
										if(_t93 != 0) {
											goto L18;
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				}
			}

0x004098fd
0x004098ff
0x00409906
0x00409908
0x0040990e
0x00409915
0x00409916
0x0040991b
0x0040991e
0x00409925
0x00409951
0x00409927
0x00409935
0x00409935
0x0040995e
0x00409b0b
0x00409b0d
0x00409b10
0x00409b13
0x00409b20
0x00409964
0x00409966
0x0040997e
0x00409985
0x00409a25
0x00409a27
0x00409a28
0x00409a2d
0x00409a30
0x00409a3e
0x00409a5f
0x00409aae
0x00409ab8
0x00409ad0
0x00409ada
0x00409ada
0x00409a61
0x00409a69
0x00409a83
0x00409a8d
0x00409a8d
0x00409ae1
0x00409ae4
0x00409ae7
0x00409af0
0x00409af5
0x00409af5
0x00409b03
0x0040998b
0x004099a0
0x004099a7
0x00000000
0x004099a9
0x004099be
0x004099c5
0x00000000
0x004099c7
0x004099dc
0x004099e3
0x00000000
0x004099e5
0x004099fa
0x00409a01
0x00000000
0x00409a03
0x00409a18
0x00409a1f
0x00000000
0x00000000
0x00000000
0x00000000
0x00409a1f
0x00409a01
0x004099e3
0x004099c5
0x004099a7
0x00409985

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00409B21,?,?), ref: 00409935
lstrcpynW.KERNEL32(?,00000000,00000105,00000000,00409B21,?,?), ref: 00409951
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409B21,?,?), ref: 0040997E
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409B21), ref: 004099A0
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,?), ref: 004099BE
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 004099DC
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 004099FA
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00409A18
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00409B04,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,?,00000000), ref: 00409A58
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,00409B04,?,80000001), ref: 00409A83
RegCloseKey.ADVAPI32(?,00409B0B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409B04,?,80000001,Software\Embarcadero\Locales), ref: 00409AFE

Strings

Software\CodeGear\Locales, xrefs: 004099B4, 004099D2
Software\Borland\Locales, xrefs: 004099F0
Software\Borland\Delphi\Locales, xrefs: 00409A0E
Software\Embarcadero\Locales, xrefs: 00409974, 00409996

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: Open$QueryValue$CloseFileModuleNamelstrcpyn
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 512384800-3496071916
Opcode ID: 1e9b74609b1608ff3bdd422726f6ce104cff35ebff053c77ceb97ea66b5e2667
Instruction ID: fb289f13ee56ccd2e6aa8b4d377abf4db65de8e90ac3277964fda8f0ede3f15a
Opcode Fuzzy Hash: 1e9b74609b1608ff3bdd422726f6ce104cff35ebff053c77ceb97ea66b5e2667
Instruction Fuzzy Hash: 6851F175B40208BEEB11EA95CD46FAE73BCEB08714F50447BB604F61C2D6B8AD44CA69

Uniqueness

Uniqueness Score: -1.00%

Function 00403058, Relevance: 9.0, APIs: 7, Instructions: 298
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00403058(signed int __eax) {
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* _t96;
				void** _t99;
				signed int _t104;
				signed int _t109;
				signed int _t110;
				intOrPtr* _t114;
				void* _t116;
				void* _t121;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				unsigned int _t140;
				unsigned int _t141;
				signed int _t142;
				void* _t144;
				void* _t147;
				intOrPtr _t148;
				signed int _t150;
				long _t156;
				intOrPtr _t159;
				signed int _t162;

				_t140 = __eax + 3 >> 3;
				_t129 =  *0x45a059; // 0x1
				if(__eax > 0xa2c) {
					__eflags = __eax - 0x40a2c;
					if(__eax > 0x40a2c) {
						_pop(_t120);
						__eflags = __eax;
						if(__eax >= 0) {
							_push(_t120);
							_t162 = __eax;
							_t156 = __eax + 0x00010010 - 0x00000001 + 0x00000004 & 0xffff0000;
							_t96 = VirtualAlloc(0, _t156, 0x101000, 4); // executed
							_t121 = _t96;
							if(_t121 != 0) {
								_t147 = _t121;
								 *((intOrPtr*)(_t147 + 8)) = _t162;
								 *(_t147 + 0xc) = _t156 | 0x00000004;
								E00402DB8(_t96, _t140, _t147);
								_t99 =  *0x45cb00; // 0x45cafc
								 *_t147 = 0x45cafc;
								 *0x45cb00 = _t121;
								 *(_t147 + 4) = _t99;
								 *_t99 = _t121;
								 *0x45caf8 = 0;
								_t121 = _t121 + 0x10;
							}
							return _t121;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t125 = (__eax + 0x000000d3 & 0xffffff00) + 0x30;
						__eflags = _t129;
						if(__eflags != 0) {
							while(1) {
								asm("lock cmpxchg [0x45aa68], ah");
								if(__eflags == 0) {
									goto L42;
								}
								asm("pause");
								__eflags =  *0x45a909;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									asm("lock cmpxchg [0x45aa68], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L42;
							}
						}
						L42:
						_t141 = _t125 - 0xb30;
						_t142 = _t141 >> 0xd;
						_t131 = _t141 >> 8;
						_t104 = 0xffffffff << _t131 &  *(0x45aa78 + _t142 * 4);
						__eflags = 0xffffffff;
						if(0xffffffff == 0) {
							_t132 = _t142;
							__eflags = 0xfffffffe << _t132 &  *0x45aa74;
							if((0xfffffffe << _t132 &  *0x45aa74) == 0) {
								_t133 =  *0x45aa70; // 0x0
								_t134 = _t133 - _t125;
								__eflags = _t134;
								if(_t134 < 0) {
									_t109 = E00402D40(_t125, _t142);
								} else {
									_t110 =  *0x45aa6c; // 0x258fff0
									_t109 = _t110 - _t125;
									 *0x45aa6c = _t109;
									 *0x45aa70 = _t134;
									 *(_t109 - 4) = _t125 | 0x00000002;
								}
								 *0x45aa68 = 0;
								return _t109;
							} else {
								asm("bsf edx, eax");
								asm("bsf ecx, eax");
								_t135 = _t132 | _t142 << 0x00000005;
								goto L50;
							}
						} else {
							asm("bsf eax, eax");
							_t135 = _t131 & 0xffffffe0 | _t104;
							L50:
							_push(_t152);
							_push(_t145);
							_t148 = 0x45aaf8 + _t135 * 8;
							_t159 =  *((intOrPtr*)(_t148 + 4));
							_t114 =  *((intOrPtr*)(_t159 + 4));
							 *((intOrPtr*)(_t148 + 4)) = _t114;
							 *_t114 = _t148;
							__eflags = _t148 - _t114;
							if(_t148 == _t114) {
								asm("rol eax, cl");
								_t80 = 0x45aa78 + _t142 * 4;
								 *_t80 =  *(0x45aa78 + _t142 * 4) & 0xfffffffe;
								__eflags =  *_t80;
								if( *_t80 == 0) {
									asm("btr [0x45aa74], edx");
								}
							}
							_t150 = 0xfffffff0 &  *(_t159 - 4);
							_t144 = 0xfffffff0 - _t125;
							__eflags = 0xfffffff0;
							if(0xfffffff0 == 0) {
								_t89 =  &((_t159 - 4)[0xfffffffffffffffc]);
								 *_t89 =  *(_t159 - 4 + _t150) & 0x000000f7;
								__eflags =  *_t89;
							} else {
								_t116 = _t125 + _t159;
								 *((intOrPtr*)(_t116 - 4)) = 0xfffffffffffffff3;
								 *(0xfffffff0 + _t116 - 8) = 0xfffffff0;
								__eflags = 0xfffffff0 - 0xb30;
								if(0xfffffff0 >= 0xb30) {
									E00402C74(_t116, 0xfffffffffffffff3, _t144);
								}
							}
							 *(_t159 - 4) = _t125 + 2;
							 *0x45aa68 = 0;
							return _t159;
						}
					}
				} else {
					__eflags = __cl;
					__eax =  *(__edx + 0x45a910) & 0x000000ff;
					__ebx = 0x458074 + ( *(__edx + 0x45a910) & 0x000000ff) * 8;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L5;
							}
							__ebx = __ebx + 0x20;
							__eflags = __ebx;
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__ebx != 0) {
								__ebx = __ebx + 0x20;
								__eflags = __ebx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__ebx != 0) {
									__ebx = __ebx - 0x40;
									asm("pause");
									__eflags =  *0x45a909;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [ebx], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
								}
							}
							goto L5;
						}
					}
					L5:
					__edx =  *(__ebx + 8);
					__eax =  *(__edx + 0x10);
					__ecx = 0xfffffff8;
					__eflags = __edx - __ebx;
					if(__edx == __ebx) {
						__edx =  *(__ebx + 0x18);
						__ecx =  *(__ebx + 2) & 0x0000ffff;
						__ecx = ( *(__ebx + 2) & 0x0000ffff) + __eax;
						__eflags = __eax -  *(__ebx + 0x14);
						if(__eax >  *(__ebx + 0x14)) {
							_push(__esi);
							_push(__edi);
							__eflags =  *0x45a059;
							if(__eflags != 0) {
								while(1) {
									__eax = 0x100;
									asm("lock cmpxchg [0x45aa68], ah");
									if(__eflags == 0) {
										goto L22;
									}
									asm("pause");
									__eflags =  *0x45a909;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [0x45aa68], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
									goto L22;
								}
							}
							L22:
							 *(__ebx + 1) =  *(__ebx + 1) &  *0x45aa74;
							__eflags =  *(__ebx + 1) &  *0x45aa74;
							if(( *(__ebx + 1) &  *0x45aa74) == 0) {
								__ecx =  *(__ebx + 4) & 0x0000ffff;
								__edi =  *0x45aa70; // 0x0
								__eflags = __edi - ( *(__ebx + 4) & 0x0000ffff);
								if(__edi < ( *(__ebx + 4) & 0x0000ffff)) {
									__eax =  *(__ebx + 6) & 0x0000ffff;
									__edi = __eax;
									__eax = E00402D40(__eax, __edx);
									__esi = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										goto L35;
									} else {
										 *0x45aa68 = __al;
										 *__ebx = __al;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										return __eax;
									}
								} else {
									__esi =  *0x45aa6c; // 0x258fff0
									__ecx =  *(__ebx + 6) & 0x0000ffff;
									__edx = __ecx + 0xb30;
									__eflags = __edi - __ecx + 0xb30;
									if(__edi >= __ecx + 0xb30) {
										__edi = __ecx;
									}
									__esi = __esi - __edi;
									 *0x45aa70 =  *0x45aa70 - __edi;
									 *0x45aa6c = __esi;
									goto L35;
								}
							} else {
								asm("bsf eax, esi");
								__esi = __eax * 8;
								__ecx =  *(0x45aa78 + __eax * 4);
								asm("bsf ecx, ecx");
								__ecx =  *(0x45aa78 + __eax * 4) + __eax * 8 * 4;
								__edi = 0x45aaf8 + ( *(0x45aa78 + __eax * 4) + __eax * 8 * 4) * 8;
								__esi =  *(__edi + 4);
								__edx =  *(__esi + 4);
								 *(__edi + 4) = __edx;
								 *__edx = __edi;
								__eflags = __edi - __edx;
								if(__edi == __edx) {
									__edx = 0xfffffffe;
									asm("rol edx, cl");
									_t38 = 0x45aa78 + __eax * 4;
									 *_t38 =  *(0x45aa78 + __eax * 4) & 0xfffffffe;
									__eflags =  *_t38;
									if( *_t38 == 0) {
										asm("btr [0x45aa74], eax");
									}
								}
								__edi = 0xfffffff0;
								__edi = 0xfffffff0 &  *(__esi - 4);
								__eflags = 0xfffffff0 - 0x10a60;
								if(0xfffffff0 < 0x10a60) {
									_t52 =  &((__esi - 4)[0xfffffffffffffffc]);
									 *_t52 = (__esi - 4)[0xfffffffffffffffc] & 0x000000f7;
									__eflags =  *_t52;
								} else {
									__edx = __edi;
									__edi =  *(__ebx + 6) & 0x0000ffff;
									__edx = __edx - __edi;
									__eax = __edi + __esi;
									__ecx = __edx + 3;
									 *(__eax - 4) = __ecx;
									 *(__edx + __eax - 8) = __edx;
									__eax = E00402C74(__eax, __ecx, __edx);
								}
								L35:
								_t56 = __edi + 6; // 0x6
								__ecx = _t56;
								 *(__esi - 4) = _t56;
								__eax = 0;
								 *0x45aa68 = __al;
								 *__esi = __ebx;
								 *((intOrPtr*)(__esi + 0x10)) = 0;
								 *((intOrPtr*)(__esi + 0x14)) = 1;
								 *(__ebx + 0x18) = __esi;
								_t61 = __esi + 0x20; // 0x2590010
								__eax = _t61;
								__ecx =  *(__ebx + 2) & 0x0000ffff;
								__edx = __ecx + __eax;
								 *(__ebx + 0x10) = __ecx + __eax;
								__edi = __edi + __esi;
								__edi = __edi - __ecx;
								__eflags = __edi;
								 *(__ebx + 0x14) = __edi;
								 *__ebx = 0;
								 *(__eax - 4) = __esi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
						} else {
							_t19 = __edx + 0x14;
							 *_t19 =  *(__edx + 0x14) + 1;
							__eflags =  *_t19;
							 *(__ebx + 0x10) = __ecx;
							 *__ebx = 0;
							 *(__eax - 4) = __edx;
							_pop(__ebx);
							return __eax;
						}
					} else {
						 *(__edx + 0x14) =  *(__edx + 0x14) + 1;
						__ecx = 0xfffffff8 &  *(__eax - 4);
						__eflags = 0xfffffff8;
						 *(__edx + 0x10) = 0xfffffff8 &  *(__eax - 4);
						 *(__eax - 4) = __edx;
						if(0xfffffff8 == 0) {
							__ecx =  *(__edx + 8);
							 *(__ecx + 0xc) = __ebx;
							 *(__ebx + 8) = __ecx;
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						} else {
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x0040305b
0x00403064
0x0040306a
0x004032b8
0x004032bd
0x004033d0
0x004033d1
0x004033d3
0x00402e00
0x00402e04
0x00402e10
0x00402e20
0x00402e25
0x00402e29
0x00402e2b
0x00402e2d
0x00402e33
0x00402e36
0x00402e3b
0x00402e40
0x00402e46
0x00402e4c
0x00402e4f
0x00402e51
0x00402e58
0x00402e58
0x00402e61
0x004033d9
0x004033d9
0x004033db
0x004033db
0x004032c3
0x004032cf
0x004032d2
0x004032d4
0x0040327c
0x00403281
0x00403289
0x00000000
0x00000000
0x0040328b
0x0040328d
0x00403294
0x00000000
0x00403296
0x00403298
0x004032a2
0x004032aa
0x004032ae
0x00000000
0x004032ae
0x004032aa
0x00000000
0x00403294
0x0040327c
0x004032d6
0x004032d6
0x004032de
0x004032e1
0x004032eb
0x004032eb
0x004032f2
0x00403305
0x00403309
0x0040330f
0x00403328
0x0040332e
0x0040332e
0x00403330
0x0040334e
0x00403332
0x00403332
0x00403337
0x00403339
0x0040333e
0x00403347
0x00403347
0x00403353
0x0040335b
0x00403311
0x00403311
0x0040331b
0x00403323
0x00000000
0x00403323
0x004032f4
0x004032f7
0x004032fa
0x0040335c
0x0040335c
0x0040335d
0x0040335e
0x00403365
0x00403368
0x0040336b
0x0040336e
0x00403370
0x00403372
0x00403379
0x0040337b
0x0040337b
0x0040337b
0x00403382
0x00403384
0x00403384
0x00403382
0x00403390
0x00403395
0x00403395
0x00403397
0x004033b8
0x004033b8
0x004033b8
0x00403399
0x00403399
0x0040339f
0x004033a2
0x004033a6
0x004033ac
0x004033ae
0x004033ae
0x004033ac
0x004033c0
0x004033c3
0x004033cf
0x004033cf
0x004032f2
0x00403070
0x00403070
0x00403072
0x00403079
0x00403080
0x004030d8
0x004030d8
0x004030dd
0x004030e1
0x00000000
0x00000000
0x004030e3
0x004030e3
0x004030e6
0x004030eb
0x004030ef
0x004030f1
0x004030f1
0x004030f4
0x004030f9
0x004030fd
0x004030ff
0x00403102
0x00403104
0x0040310b
0x00000000
0x0040310d
0x0040310f
0x00403114
0x00403119
0x0040311d
0x00403125
0x00000000
0x00403125
0x0040311d
0x0040310b
0x004030fd
0x00000000
0x004030ef
0x004030d8
0x00403082
0x00403082
0x00403085
0x00403088
0x0040308d
0x0040308f
0x004030a8
0x004030ab
0x004030af
0x004030b1
0x004030b4
0x0040312c
0x0040312d
0x0040312e
0x00403135
0x00403137
0x00403137
0x0040313c
0x00403144
0x00000000
0x00000000
0x00403146
0x00403148
0x0040314f
0x00000000
0x00403151
0x00403153
0x00403158
0x0040315d
0x00403165
0x00403169
0x00000000
0x00403169
0x00403165
0x00000000
0x0040314f
0x00403137
0x00403170
0x00403174
0x00403174
0x0040317a
0x004031ec
0x004031f0
0x004031f6
0x004031f8
0x00403220
0x00403224
0x00403226
0x0040322b
0x0040322d
0x0040322f
0x00000000
0x00403231
0x00403231
0x00403236
0x00403238
0x00403239
0x0040323a
0x0040323b
0x0040323b
0x004031fa
0x004031fa
0x00403200
0x00403204
0x0040320a
0x0040320c
0x0040320e
0x0040320e
0x00403210
0x00403212
0x00403218
0x00000000
0x00403218
0x0040317c
0x0040317c
0x0040317f
0x00403186
0x0040318d
0x00403190
0x00403193
0x0040319a
0x0040319d
0x004031a0
0x004031a3
0x004031a5
0x004031a7
0x004031a9
0x004031ae
0x004031b0
0x004031b0
0x004031b0
0x004031b7
0x004031b9
0x004031b9
0x004031b7
0x004031c0
0x004031c5
0x004031c8
0x004031ce
0x0040323c
0x0040323c
0x0040323c
0x004031d0
0x004031d0
0x004031d2
0x004031d6
0x004031d8
0x004031db
0x004031de
0x004031e1
0x004031e5
0x004031e5
0x00403241
0x00403241
0x00403241
0x00403244
0x00403247
0x00403249
0x0040324e
0x00403250
0x00403253
0x0040325a
0x0040325d
0x0040325d
0x00403260
0x00403264
0x00403267
0x0040326a
0x0040326c
0x0040326c
0x0040326e
0x00403271
0x00403274
0x00403277
0x00403278
0x00403279
0x0040327a
0x0040327a
0x004030b6
0x004030b6
0x004030b6
0x004030b6
0x004030ba
0x004030bd
0x004030c0
0x004030c3
0x004030c4
0x004030c4
0x00403091
0x00403091
0x00403095
0x00403095
0x00403098
0x0040309b
0x0040309e
0x004030c8
0x004030cb
0x004030ce
0x004030d1
0x004030d4
0x004030d5
0x004030a0
0x004030a0
0x004030a3
0x004030a4
0x004030a4
0x0040309e
0x0040308f

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00403024), ref: 0040310F
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00403024), ref: 00403125
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00403024), ref: 00403153
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00403024), ref: 00403169

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 35d25aad1f7fc4716a0dfc02f7a215eb0f1f60094d603e12b1297e6ec73346e6
Instruction ID: d24c38d3cd346257549e836a0e34f297571455aa338da2ddacc15011fe2918f0
Opcode Fuzzy Hash: 35d25aad1f7fc4716a0dfc02f7a215eb0f1f60094d603e12b1297e6ec73346e6
Instruction Fuzzy Hash: 6BC126726013508BD715CF28D984316BFE5BB89312F1882BFD444AB3D6C774EA91C799

Uniqueness

Uniqueness Score: -1.00%

Function 004033DC, Relevance: 7.7, APIs: 6, Instructions: 196
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E004033DC(void* __eax, signed int __edi, void* __ebp) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				signed int __ebx;
				void* _t58;
				signed int _t61;
				int _t65;
				signed int _t67;
				void _t70;
				int _t71;
				signed int _t78;
				void* _t79;
				signed int _t81;
				intOrPtr _t82;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				signed int _t92;
				void* _t96;
				signed int _t99;
				void* _t103;
				intOrPtr _t104;
				void* _t106;
				void* _t108;
				signed int _t113;
				void* _t115;
				void* _t116;

				_t56 = __eax;
				_t89 =  *(__eax - 4);
				_t78 =  *0x45a059; // 0x1
				if((_t89 & 0x00000007) != 0) {
					__eflags = _t89 & 0x00000005;
					if((_t89 & 0x00000005) != 0) {
						_pop(_t78);
						__eflags = _t89 & 0x00000003;
						if((_t89 & 0x00000003) == 0) {
							_push(_t78);
							_push(__edi);
							_t116 = _t115 + 0xffffffdc;
							_t103 = __eax - 0x10;
							E00402DB8(__eax, _t89, __edi);
							_t58 = _t103;
							 *_t116 =  *_t58;
							_v48 =  *((intOrPtr*)(_t58 + 4));
							_t92 =  *(_t58 + 0xc);
							if((_t92 & 0x00000008) != 0) {
								_t79 = _t103;
								_t113 = _t92 & 0xfffffff0;
								_t99 = 0;
								__eflags = 0;
								while(1) {
									VirtualQuery(_t79,  &_v44, 0x1c);
									_t61 = VirtualFree(_t79, 0, 0x8000);
									__eflags = _t61;
									if(_t61 == 0) {
										_t99 = _t99 | 0xffffffff;
										goto L10;
									}
									_t104 = _v44.RegionSize;
									__eflags = _t113 - _t104;
									if(_t113 > _t104) {
										_t113 = _t113 - _t104;
										_t79 = _t79 + _t104;
										continue;
									}
									goto L10;
								}
							} else {
								_t65 = VirtualFree(_t103, 0, 0x8000); // executed
								if(_t65 == 0) {
									_t99 = __edi | 0xffffffff;
								} else {
									_t99 = 0;
								}
							}
							L10:
							if(_t99 == 0) {
								 *_v48 =  *_t116;
								 *( *_t116 + 4) = _v48;
							}
							 *0x45caf8 = 0;
							return _t99;
						} else {
							return 0xffffffff;
						}
					} else {
						goto L31;
					}
				} else {
					__eflags = __bl;
					__ebx =  *__edx;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L14;
							}
							asm("pause");
							__eflags =  *0x45a909;
							if(__eflags != 0) {
								continue;
							} else {
								Sleep(0);
								__edx = __edx;
								__ecx = __ecx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__eflags != 0) {
									Sleep(0xa);
									__edx = __edx;
									__ecx = __ecx;
									continue;
								}
							}
							goto L14;
						}
					}
					L14:
					_t14 = __edx + 0x14;
					 *_t14 =  *(__edx + 0x14) - 1;
					__eflags =  *_t14;
					__eax =  *(__edx + 0x10);
					if( *_t14 == 0) {
						__eflags = __eax;
						if(__eax == 0) {
							L20:
							 *(__ebx + 0x14) = __eax;
						} else {
							__eax =  *(__edx + 0xc);
							__ecx =  *(__edx + 8);
							 *(__eax + 8) = __ecx;
							 *(__ecx + 0xc) = __eax;
							__eax = 0;
							__eflags =  *((intOrPtr*)(__ebx + 0x18)) - __edx;
							if( *((intOrPtr*)(__ebx + 0x18)) == __edx) {
								goto L20;
							}
						}
						 *__ebx = __al;
						__eax = __edx;
						__edx =  *(__edx - 4);
						__bl =  *0x45a059; // 0x1
						L31:
						_t95 = _t89 & 0xfffffff0;
						__eflags = _t78;
						_t81 = _t89 & 0xfffffff0;
						_push(_t101);
						_t106 = _t56;
						if(__eflags != 0) {
							while(1) {
								_t67 = 0x100;
								asm("lock cmpxchg [0x45aa68], ah");
								if(__eflags == 0) {
									goto L32;
								}
								asm("pause");
								__eflags =  *0x45a909;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									_t67 = 0x100;
									asm("lock cmpxchg [0x45aa68], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L32;
							}
						}
						L32:
						__eflags = (_t106 - 4)[_t81] & 0x00000001;
						_t87 = (_t106 - 4)[_t81];
						if(((_t106 - 4)[_t81] & 0x00000001) != 0) {
							_t67 = _t81 + _t106;
							_t88 = _t87 & 0xfffffff0;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00402C34(_t67);
							}
						} else {
							_t88 = _t87 | 0x00000008;
							__eflags = _t88;
							(_t106 - 4)[_t81] = _t88;
						}
						__eflags =  *(_t106 - 4) & 0x00000008;
						if(( *(_t106 - 4) & 0x00000008) != 0) {
							_t88 =  *(_t106 - 8);
							_t106 = _t106 - _t88;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00402C34(_t106);
							}
						}
						__eflags = _t81 - 0x13ffe0;
						if(_t81 == 0x13ffe0) {
							__eflags =  *0x45aa70 - 0x13ffe0;
							if( *0x45aa70 != 0x13ffe0) {
								_t82 = _t106 + 0x13ffe0;
								E00402CD4(_t67, _t95);
								 *((intOrPtr*)(_t82 - 4)) = 2;
								 *0x45aa70 = 0x13ffe0;
								 *0x45aa6c = _t82;
								 *0x45aa68 = 0;
								__eflags = 0;
								return 0;
							} else {
								_t108 = _t106 - 0x10;
								_t70 =  *_t108;
								_t96 =  *(_t108 + 4);
								 *(_t70 + 4) = _t96;
								 *_t96 = _t70;
								 *0x45aa68 = 0;
								_t71 = VirtualFree(_t108, 0, 0x8000);
								__eflags = _t71 - 1;
								asm("sbb eax, eax");
								return _t71;
							}
						} else {
							 *(_t106 - 4) = _t81 + 3;
							 *(_t106 - 8 + _t81) = _t81;
							E00402C74(_t106, _t88, _t81);
							 *0x45aa68 = 0;
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = __eax;
						 *(__edx + 0x10) = __ecx;
						 *(__ecx - 4) = __eax;
						if(__eflags == 0) {
							__ecx =  *(__ebx + 8);
							 *(__edx + 0xc) = __ebx;
							 *(__edx + 8) = __ecx;
							 *(__ecx + 0xc) = __edx;
							 *(__ebx + 8) = __edx;
							 *__ebx = 0;
							__eax = 0;
							__eflags = 0;
							_pop(__ebx);
							return 0;
						} else {
							__eax = 0;
							__eflags = 0;
							 *__ebx = __al;
							_pop(__ebx);
							return 0;
						}
					}
				}
			}

0x004033dc
0x004033dc
0x004033e5
0x004033eb
0x004034d4
0x004034d7
0x004035c4
0x004035c5
0x004035c8
0x00402e64
0x00402e66
0x00402e68
0x00402e6d
0x00402e70
0x00402e75
0x00402e79
0x00402e7f
0x00402e83
0x00402e89
0x00402ea5
0x00402ea9
0x00402eac
0x00402eac
0x00402eae
0x00402eb6
0x00402ec3
0x00402ec8
0x00402eca
0x00402ecc
0x00402ecf
0x00402ecf
0x00402ed1
0x00402ed5
0x00402ed7
0x00402ed9
0x00402edb
0x00000000
0x00402edb
0x00000000
0x00402ed7
0x00402e8b
0x00402e93
0x00402e9a
0x00402ea0
0x00402e9c
0x00402e9c
0x00402e9c
0x00402e9a
0x00402edf
0x00402ee1
0x00402eea
0x00402ef3
0x00402ef3
0x00402ef6
0x00402f06
0x004035ce
0x004035d3
0x004035d3
0x00000000
0x00000000
0x00000000
0x004033f1
0x004033f1
0x004033f3
0x004033f5
0x00403458
0x00403458
0x0040345d
0x00403461
0x00000000
0x00000000
0x00403463
0x00403465
0x0040346c
0x00000000
0x0040346e
0x00403472
0x00403477
0x00403478
0x00403479
0x0040347e
0x00403482
0x0040348c
0x00403491
0x00403492
0x00000000
0x00403492
0x00403482
0x00000000
0x0040346c
0x00403458
0x004033f7
0x004033f7
0x004033f7
0x004033f7
0x004033fb
0x004033fe
0x0040342c
0x0040342e
0x00403443
0x00403443
0x00403430
0x00403430
0x00403433
0x00403436
0x00403439
0x0040343c
0x0040343e
0x00403441
0x00000000
0x00000000
0x00403441
0x00403446
0x00403448
0x0040344a
0x0040344d
0x004034dd
0x004034dd
0x004034e0
0x004034e2
0x004034e4
0x004034e5
0x004034e7
0x00403498
0x00403498
0x0040349d
0x004034a5
0x00000000
0x00000000
0x004034a7
0x004034a9
0x004034b0
0x00000000
0x004034b2
0x004034b4
0x004034b9
0x004034be
0x004034c6
0x004034ca
0x00000000
0x004034ca
0x004034c6
0x00000000
0x004034b0
0x00403498
0x004034e9
0x004034e9
0x004034f1
0x004034f5
0x0040352c
0x0040352f
0x00403532
0x00403534
0x0040353a
0x0040353c
0x0040353c
0x004034f7
0x004034f7
0x004034f7
0x004034fa
0x004034fa
0x004034fe
0x00403502
0x00403544
0x00403547
0x00403549
0x0040354b
0x00403551
0x00403555
0x00403555
0x00403551
0x00403504
0x0040350a
0x0040355c
0x00403566
0x00403594
0x0040359a
0x0040359f
0x004035a6
0x004035b0
0x004035b6
0x004035bd
0x004035c1
0x00403568
0x00403568
0x0040356b
0x0040356d
0x00403570
0x00403573
0x00403575
0x00403584
0x00403589
0x0040358c
0x00403590
0x00403590
0x0040350c
0x0040350f
0x00403512
0x0040351a
0x0040351f
0x00403526
0x0040352a
0x0040352a
0x00403400
0x00403400
0x00403402
0x00403408
0x0040340b
0x00403414
0x00403417
0x0040341a
0x0040341d
0x00403420
0x00403423
0x00403426
0x00403426
0x00403428
0x00403429
0x0040340d
0x0040340d
0x0040340d
0x0040340f
0x00403411
0x00403412
0x00403412
0x0040340b
0x004033fe

APIs

Sleep.KERNEL32(00000000,?,?,00000000,0040304C), ref: 00403472
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,0040304C), ref: 0040348C

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c42a46366db05217e8d4c3ff05f57bb59f7c25d2e7563aabde72f0078aa95261
Instruction ID: 8a3b1117f4a5933337f6a98e515e9c43cff1a278d4390d63e0247294b9bdf338
Opcode Fuzzy Hash: c42a46366db05217e8d4c3ff05f57bb59f7c25d2e7563aabde72f0078aa95261
Instruction Fuzzy Hash: 4261D3716043405FD716CF29CA88B16BFD8AB45316F18827FD4449B3E2D678DD41CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00406D48, Relevance: 4.6, APIs: 3, Instructions: 92
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00406D48() {
				void* _t14;
				int _t21;
				void* _t33;
				void* _t47;
				struct HINSTANCE__* _t54;
				void* _t58;

				if( *0x458004 != 0) {
					E00406C1C();
					E00406CB0(_t47);
					 *0x458004 = 0;
				}
				if( *0x45cb4c != 0 && GetCurrentThreadId() ==  *0x45cb74) {
					E004069B8(0x45cb48);
					E00406C84(0x45cb48);
				}
				if( *0x0045CB40 != 0 ||  *0x45a054 == 0) {
					L8:
					if( *((char*)(0x45cb40)) == 2 &&  *0x458000 == 0) {
						 *0x0045CB24 = 0;
					}
					_t14 = E00404570();
					_t45 = _t14;
					if(_t14 == 0) {
						L13:
						E004069E0();
						if( *((char*)(0x45cb40)) <= 1 ||  *0x458000 != 0) {
							_t57 =  *0x0045CB28;
							if( *0x0045CB28 != 0) {
								E0040A1B8(_t57);
								_t7 =  *((intOrPtr*)(0x45cb28)) + 0x10; // 0x400000
								_t54 =  *_t7;
								_t9 =  *((intOrPtr*)(0x45cb28)) + 4; // 0x400000
								if(_t54 !=  *_t9 && _t54 != 0) {
									FreeLibrary(_t54);
								}
							}
						}
						E004069B8(0x45cb18);
						if( *((char*)(0x45cb40)) == 1) {
							 *0x0045CB3C();
						}
						if( *((char*)(0x45cb40)) != 0) {
							E00406C84(0x45cb18);
						}
						if( *0x45cb18 == 0) {
							if( *0x45a034 != 0) {
								 *0x45a034();
							}
							_t21 =  *0x458000; // 0x0
							ExitProcess(_t21); // executed
						}
						memcpy(0x45cb18,  *0x45cb18, 0xc << 2);
						_t58 = _t58 + 0xc;
						0x45cb18 = 0x45cb18;
						goto L8;
					} else {
						do {
							E0040570C(_t45);
							_t33 = E00404570();
							_t45 = _t33;
						} while (_t33 != 0);
						goto L13;
					}
				} else {
					do {
						 *0x45a054 = 0;
						 *((intOrPtr*)( *0x45a054))();
					} while ( *0x45a054 != 0);
					L8:
					while(1) {
					}
				}
			}

0x00406d5d
0x00406d5f
0x00406d64
0x00406d6b
0x00406d6b
0x00406d77
0x00406d8b
0x00406d95
0x00406d95
0x00406d9e
0x00406db4
0x00406db8
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcd
0x00406dd1
0x00406de5
0x00406de5
0x00406dee
0x00406df9
0x00406dfe
0x00406e02
0x00406e0a
0x00406e0a
0x00406e10
0x00406e13
0x00406e1a
0x00406e1a
0x00406e13
0x00406dfe
0x00406e21
0x00406e2a
0x00406e2c
0x00406e2c
0x00406e33
0x00406e37
0x00406e37
0x00406e3f
0x00406e48
0x00406e4a
0x00406e4a
0x00406e50
0x00406e56
0x00406e56
0x00406e67
0x00406e67
0x00406e69
0x00000000
0x00406dd3
0x00406dd3
0x00406dd5
0x00406dda
0x00406ddf
0x00406de1
0x00000000
0x00406dd3
0x00406da5
0x00406da5
0x00406dab
0x00406dad
0x00406daf
0x00000000
0x00406db4
0x00000000
0x00406db4

APIs

GetCurrentThreadId.KERNEL32 ref: 00406D79
FreeLibrary.KERNEL32(00400000,?,?,?,?,00406E7E,004045BB,00404602,?,?,0040461B), ref: 00406E1A
ExitProcess.KERNEL32(00000000,?,?,?,?,00406E7E,004045BB,00404602,?,?,0040461B), ref: 00406E56

Part of subcall function 00406CB0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69,?,?,?,?,00406E7E,004045BB,00404602), ref: 00406CE9
Part of subcall function 00406CB0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69,?,?,?,?,00406E7E,004045BB,00404602), ref: 00406CEF
Part of subcall function 00406CB0: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69,?,?,?), ref: 00406D0A
Part of subcall function 00406CB0: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69), ref: 00406D10

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 597c0ee9381f91864c1514338d105ea8cc2131478cfe5a74760ac8907fc132b7
Instruction ID: 51c4e82f996f95945f9b8cab1d62ca9a785d7985c835cc21ab9af9c07338cf3a
Opcode Fuzzy Hash: 597c0ee9381f91864c1514338d105ea8cc2131478cfe5a74760ac8907fc132b7
Instruction Fuzzy Hash: 2D31BE306003018BDB30AB69D48971B76E5AF04719F06053FE546A73D2DB7CD8A8CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406D40, Relevance: 4.6, APIs: 3, Instructions: 87
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00406D40() {
				intOrPtr* _t14;
				void* _t17;
				int _t24;
				void* _t36;
				void* _t51;
				struct HINSTANCE__* _t59;
				void* _t65;

				 *((intOrPtr*)(_t14 +  *_t14)) =  *((intOrPtr*)(_t14 +  *_t14)) + _t14 +  *_t14;
				if( *0x458004 != 0) {
					E00406C1C();
					E00406CB0(_t51);
					 *0x458004 = 0;
				}
				if( *0x45cb4c != 0 && GetCurrentThreadId() ==  *0x45cb74) {
					E004069B8(0x45cb48);
					E00406C84(0x45cb48);
				}
				if( *0x0045CB40 != 0 ||  *0x45a054 == 0) {
					L9:
					if( *((char*)(0x45cb40)) == 2 &&  *0x458000 == 0) {
						 *0x0045CB24 = 0;
					}
					_t17 = E00404570();
					_t49 = _t17;
					if(_t17 == 0) {
						L14:
						E004069E0();
						if( *((char*)(0x45cb40)) <= 1 ||  *0x458000 != 0) {
							_t64 =  *0x0045CB28;
							if( *0x0045CB28 != 0) {
								E0040A1B8(_t64);
								_t7 =  *((intOrPtr*)(0x45cb28)) + 0x10; // 0x400000
								_t59 =  *_t7;
								_t9 =  *((intOrPtr*)(0x45cb28)) + 4; // 0x400000
								if(_t59 !=  *_t9 && _t59 != 0) {
									FreeLibrary(_t59);
								}
							}
						}
						E004069B8(0x45cb18);
						if( *((char*)(0x45cb40)) == 1) {
							 *0x0045CB3C();
						}
						if( *((char*)(0x45cb40)) != 0) {
							E00406C84(0x45cb18);
						}
						if( *0x45cb18 == 0) {
							if( *0x45a034 != 0) {
								 *0x45a034();
							}
							_t24 =  *0x458000; // 0x0
							ExitProcess(_t24); // executed
						}
						memcpy(0x45cb18,  *0x45cb18, 0xc << 2);
						_t65 = _t65 + 0xc;
						0x45cb18 = 0x45cb18;
						goto L9;
					} else {
						do {
							E0040570C(_t49);
							_t36 = E00404570();
							_t49 = _t36;
						} while (_t36 != 0);
						goto L14;
					}
				} else {
					do {
						 *0x45a054 = 0;
						 *((intOrPtr*)( *0x45a054))();
					} while ( *0x45a054 != 0);
					L9:
					while(1) {
					}
				}
			}

0x00406d42
0x00406d5d
0x00406d5f
0x00406d64
0x00406d6b
0x00406d6b
0x00406d77
0x00406d8b
0x00406d95
0x00406d95
0x00406d9e
0x00406db4
0x00406db8
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcd
0x00406dd1
0x00406de5
0x00406de5
0x00406dee
0x00406df9
0x00406dfe
0x00406e02
0x00406e0a
0x00406e0a
0x00406e10
0x00406e13
0x00406e1a
0x00406e1a
0x00406e13
0x00406dfe
0x00406e21
0x00406e2a
0x00406e2c
0x00406e2c
0x00406e33
0x00406e37
0x00406e37
0x00406e3f
0x00406e48
0x00406e4a
0x00406e4a
0x00406e50
0x00406e56
0x00406e56
0x00406e67
0x00406e67
0x00406e69
0x00000000
0x00406dd3
0x00406dd3
0x00406dd5
0x00406dda
0x00406ddf
0x00406de1
0x00000000
0x00406dd3
0x00406da5
0x00406da5
0x00406dab
0x00406dad
0x00406daf
0x00000000
0x00406db4
0x00000000
0x00406db4

APIs

GetCurrentThreadId.KERNEL32 ref: 00406D79
FreeLibrary.KERNEL32(00400000,?,?,?,?,00406E7E,004045BB,00404602,?,?,0040461B), ref: 00406E1A
ExitProcess.KERNEL32(00000000,?,?,?,?,00406E7E,004045BB,00404602,?,?,0040461B), ref: 00406E56

Part of subcall function 00406CB0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69,?,?,?,?,00406E7E,004045BB,00404602), ref: 00406CE9
Part of subcall function 00406CB0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69,?,?,?,?,00406E7E,004045BB,00404602), ref: 00406CEF
Part of subcall function 00406CB0: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69,?,?,?), ref: 00406D0A
Part of subcall function 00406CB0: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69), ref: 00406D10

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 69fc96ce27c8194f6d5a84174052bb46b6ab76e4ff137658cbd3aeb99f694c4d
Instruction ID: 4929b9cacf4ed3c18e0fbb254ea7222140edc6bb7e8c552654c7641b89d5213a
Opcode Fuzzy Hash: 69fc96ce27c8194f6d5a84174052bb46b6ab76e4ff137658cbd3aeb99f694c4d
Instruction Fuzzy Hash: C33169306003418FDB31AB69D48931B76E1AF05709F06453FE546A72D2DB7CE8A8CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402E62, Relevance: 4.6, APIs: 3, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00402E62(void* __eax, void* __edx) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				void* __edi;
				void* __ebp;
				void* _t13;
				int _t20;
				void* _t22;
				signed int _t27;
				signed int _t30;
				signed int _t31;
				void* _t35;
				intOrPtr _t36;
				signed int _t40;
				void* _t42;
				void* _t43;

				_push(_t30);
				_t43 = _t42 + 0xffffffdc;
				_t35 = __eax - 0x10;
				E00402DB8(__eax, __edx, _t30);
				_t13 = _t35;
				 *_t43 =  *_t13;
				_v48 =  *((intOrPtr*)(_t13 + 4));
				_t27 =  *(_t13 + 0xc);
				if((_t27 & 0x00000008) != 0) {
					_t22 = _t35;
					_t40 = _t27 & 0xfffffff0;
					_t31 = 0;
					while(1) {
						VirtualQuery(_t22,  &_v44, 0x1c);
						if(VirtualFree(_t22, 0, 0x8000) == 0) {
							break;
						}
						_t36 = _v44.RegionSize;
						if(_t40 > _t36) {
							_t40 = _t40 - _t36;
							_t22 = _t22 + _t36;
							continue;
						}
						goto L10;
					}
					_t31 = _t31 | 0xffffffff;
				} else {
					_t20 = VirtualFree(_t35, 0, 0x8000); // executed
					if(_t20 == 0) {
						_t31 = _t30 | 0xffffffff;
					} else {
						_t31 = 0;
					}
				}
				L10:
				if(_t31 == 0) {
					 *_v48 =  *_t43;
					 *( *_t43 + 4) = _v48;
				}
				 *0x45caf8 = 0;
				return _t31;
			}

0x00402e66
0x00402e68
0x00402e6d
0x00402e70
0x00402e75
0x00402e79
0x00402e7f
0x00402e83
0x00402e89
0x00402ea5
0x00402ea9
0x00402eac
0x00402eae
0x00402eb6
0x00402eca
0x00000000
0x00000000
0x00402ed1
0x00402ed7
0x00402ed9
0x00402edb
0x00000000
0x00402edb
0x00000000
0x00402ed7
0x00402ecc
0x00402e8b
0x00402e93
0x00402e9a
0x00402ea0
0x00402e9c
0x00402e9c
0x00402e9c
0x00402e9a
0x00402edf
0x00402ee1
0x00402eea
0x00402ef3
0x00402ef3
0x00402ef6
0x00402f06

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00402E93
VirtualQuery.KERNEL32(?,?,0000001C), ref: 00402EB6
VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00402EC3

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: Virtual$Free$Query
String ID:
API String ID: 778034434-0
Opcode ID: c878f221a1cee6844763b9f78f45944839d7f43b0250e969bdb006fc1b73756d
Instruction ID: 2255de812237d45d2e8f64cfce0174243e54c7c6553f8d79e5f8c6a488c41b72
Opcode Fuzzy Hash: c878f221a1cee6844763b9f78f45944839d7f43b0250e969bdb006fc1b73756d
Instruction Fuzzy Hash: 8A119031384700ABD310E629CE89B1B77D9AF84724F158236E9A8A73D1E6F8DC0157DA

Uniqueness

Uniqueness Score: -1.00%

Function 00407100, Relevance: 4.5, APIs: 3, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00407100(signed char __eax, void* __ecx, void* __edx) {
				intOrPtr _v8;
				signed char _v13;
				void* _t5;
				void* _t11;

				if(__ecx == 0) {
					_t11 =  *__eax;
					if(_t11 != 0) {
						 *__eax = 0;
						_push(__eax);
						L004028FC(); // executed
						_t5 = _t11;
						return _t5;
					}
					return __eax;
				} else {
					_push(__eax);
					_push(__ecx);
					L004028EC(); // executed
					__edx = __edx;
					if(__eax == 0) {
						_push(__ecx);
						_v13 = __eax;
						return E004045BC(_v13 & 0x000000ff, _v8);
					} else {
						_push( *__edx);
						 *__edx = __eax;
						L004028FC();
						return __eax;
					}
				}
			}

0x00407102
0x00406f90
0x00406f94
0x00406f96
0x00406f9c
0x00406f9e
0x00406fa3
0x00000000
0x00406fa3
0x00406fa4
0x00407108
0x00407108
0x00407109
0x0040710b
0x00407112
0x00407113
0x0040460b
0x0040460c
0x0040461d
0x00407119
0x00407119
0x0040711b
0x0040711d
0x00407122
0x00407122
0x00407113

APIs

SysFreeString.OLEAUT32(?), ref: 00406F9E
SysAllocStringLen.OLEAUT32 ref: 0040710B
SysFreeString.OLEAUT32 ref: 0040711D

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 1d51f169246ed0332ea55dc57ed08ced13a624deaf2b732a46fee75f2ef37196
Instruction ID: 135d6be2966b7f0c8c2630a1d7543a227a2aba661bad37ab3b383f95e5ee5edb
Opcode Fuzzy Hash: 1d51f169246ed0332ea55dc57ed08ced13a624deaf2b732a46fee75f2ef37196
Instruction Fuzzy Hash: 80E08CB91053025DEE40BF219D04B372768AF82300B25857FB401BA2D4DA7D98017628

Uniqueness

Uniqueness Score: -1.00%

Function 00409ED0, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00409ED0(intOrPtr __eax, void* __ebx, signed int* __ecx, signed int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _t37;
				signed short _t39;
				signed short _t42;
				signed int _t59;
				intOrPtr _t72;
				void* _t79;
				signed int* _t81;
				intOrPtr _t84;

				_t79 = __edi;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t81 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E0040702C(_v8);
				E0040702C(_v12);
				_push(_t84);
				_push(0x409fdd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E00406F48(__ecx);
				E00407370( &_v20, _v12);
				_t37 = _v12;
				if(_t37 != 0) {
					_t37 =  *(_t37 - 4);
				}
				_t59 = _t37;
				if(_t59 < 1) {
					L6:
					_t39 = E00409C18(_v8, _t59,  &_v16, _t81); // executed
					_t89 = _v16;
					if(_v16 == 0) {
						L00402874();
						E004095C4(_t39, _t59,  &_v24, _t79, _t81);
						_t42 = E00409D38(_v20, _t59, _t81, _v24, _t79, _t81, __eflags); // executed
						__eflags =  *_t81;
						if( *_t81 == 0) {
							__eflags =  *0x45cb84;
							if( *0x45cb84 == 0) {
								L0040287C();
								E004095C4(_t42, _t59,  &_v28, _t79, _t81);
								E00409D38(_v20, _t59, _t81, _v28, _t79, _t81, __eflags);
							}
						}
						__eflags =  *_t81;
						if(__eflags == 0) {
							E00409E04(_v20, _t59, _t81, __eflags); // executed
						}
					} else {
						E00409D38(_v20, _t59, _t81, _v16, _t79, _t81, _t89);
					}
					_pop(_t72);
					 *[fs:eax] = _t72;
					_push(E00409FE4);
					return E00406FA8( &_v28, 6);
				} else {
					while( *((short*)(_v12 + _t59 * 2 - 2)) != 0x2e) {
						_t59 = _t59 - 1;
						__eflags = _t59;
						if(_t59 != 0) {
							continue;
						}
						goto L6;
					}
					E00407F5C(_v12, _t59, 1,  &_v20);
					goto L6;
				}
			}

0x00409ed0
0x00409ed3
0x00409ed5
0x00409ed7
0x00409ed9
0x00409edb
0x00409edd
0x00409edf
0x00409ee0
0x00409ee1
0x00409ee3
0x00409ee6
0x00409eec
0x00409ef4
0x00409efb
0x00409efc
0x00409f01
0x00409f04
0x00409f09
0x00409f14
0x00409f19
0x00409f1e
0x00409f23
0x00409f23
0x00409f25
0x00409f2a
0x00409f51
0x00409f57
0x00409f5c
0x00409f60
0x00409f71
0x00409f79
0x00409f86
0x00409f8b
0x00409f8e
0x00409f90
0x00409f97
0x00409f99
0x00409fa1
0x00409fae
0x00409fae
0x00409f97
0x00409fb3
0x00409fb6
0x00409fbd
0x00409fbd
0x00409f62
0x00409f6a
0x00409f6a
0x00409fc4
0x00409fc7
0x00409fca
0x00409fdc
0x00409f2c
0x00409f2c
0x00409f4c
0x00409f4d
0x00409f4f
0x00000000
0x00000000
0x00000000
0x00409f4f
0x00409f45
0x00000000
0x00409f45

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,00409FDD,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040A066,00000000,?,00000105), ref: 00409F71
GetSystemDefaultUILanguage.KERNEL32(00000000,00409FDD,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040A066,00000000,?,00000105), ref: 00409F99

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: e1a64b32d8c73f1235397de0fecc9c001fefab2956a3a070bd06624350d6620e
Instruction ID: 3598bae12981bb2611c0776d053a57f4d0360bb7a151442cb3bb52969bcb3175
Opcode Fuzzy Hash: e1a64b32d8c73f1235397de0fecc9c001fefab2956a3a070bd06624350d6620e
Instruction Fuzzy Hash: A4314F70E1420A9FDB10EB95C881AAEB7B5EF44304F10857BE500F32D2D7B8AD41CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409FEC, Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00409FEC(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				short _v530;
				char _v536;
				char _v540;
				void* _t44;
				intOrPtr _t45;
				void* _t49;
				void* _t52;

				_v536 = 0;
				_v540 = 0;
				_v8 = 0;
				_t49 = __eax;
				_push(_t52);
				_push(0x40a0a6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t52 + 0xfffffde8;
				GetModuleFileNameW(0,  &_v530, 0x105);
				E00407C00( &_v536, _t49);
				_push(_v536);
				E00407C3C( &_v540, 0x105,  &_v530);
				_pop(_t44); // executed
				E00409ED0(_v540, 0,  &_v8, _t44, __edi, _t49); // executed
				if(_v8 != 0) {
					LoadLibraryExW(E00407BA8(_v8), 0, 2);
				}
				_pop(_t45);
				 *[fs:eax] = _t45;
				_push(E0040A0AD);
				E00406FA8( &_v540, 2);
				return E00406F48( &_v8);
			}

0x00409ff9
0x00409fff
0x0040a005
0x0040a008
0x0040a00c
0x0040a00d
0x0040a012
0x0040a015
0x0040a028
0x0040a035
0x0040a040
0x0040a052
0x0040a060
0x0040a061
0x0040a06a
0x0040a079
0x0040a07e
0x0040a082
0x0040a085
0x0040a088
0x0040a098
0x0040a0a5

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040A0A6,?,?,00000000), ref: 0040A028
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040A0A6,?,?,00000000), ref: 0040A079

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 6df0284b3f21ac0b3a16c9a75c210fef337fdfed43d3ecd2e193fb38d22d4668
Instruction ID: ad2cfdc96b2da7b923a988944e41f1c63609f79036eb9cea3d4f4da3d94f04dd
Opcode Fuzzy Hash: 6df0284b3f21ac0b3a16c9a75c210fef337fdfed43d3ecd2e193fb38d22d4668
Instruction Fuzzy Hash: 93115171A4421C9BDB20EF60DD86BDEB3B8DB14304F5141BBF508B32D1DA785F858A9A

Uniqueness

Uniqueness Score: -1.00%

Function 004073A0, Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E004073A0(signed char __eax, void* __edx) {
				intOrPtr _v12;
				signed char _v17;
				void* _t6;
				void* _t12;

				_t5 = __eax;
				if(__edx == 0) {
					L3:
					_t12 =  *_t5;
					if(_t12 != 0) {
						 *_t5 = 0;
						_push(_t5);
						L004028FC(); // executed
						_t6 = _t12;
						return _t6;
					}
					return _t5;
				} else {
					__ecx =  *(__edx - 4);
					__ecx =  *(__edx - 4) >> 1;
					if(__ecx == 0) {
						goto L3;
					} else {
						_push(__ecx);
						_push(__edx);
						_push(__eax); // executed
						L004028F4(); // executed
						if(__eax == 0) {
							_v17 = __eax;
							return E004045BC(_v17 & 0x000000ff, _v12);
						} else {
							return __eax;
						}
					}
				}
			}

0x004073a0
0x004073a2
0x00406f90
0x00406f90
0x00406f94
0x00406f96
0x00406f9c
0x00406f9e
0x00406fa3
0x00000000
0x00406fa3
0x00406fa4
0x004073a8
0x004073a8
0x004073ab
0x004073ad
0x00000000
0x004073b3
0x004073b3
0x004073b4
0x004073b5
0x004073b6
0x004073bd
0x0040460c
0x0040461d
0x004073c3
0x004073c3
0x004073c3
0x004073bd
0x004073ad

APIs

SysFreeString.OLEAUT32(?), ref: 00406F9E
SysReAllocStringLen.OLEAUT32(?,?,?), ref: 004073B6

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: feb13993c9ff4b3eeb94c7d43c4c0a5d557b848b01bfa8496a933ed181b3452e
Instruction ID: 901812de00d968f65791904df4be351538c430c95a4ba65e6484f0353d3ee508
Opcode Fuzzy Hash: feb13993c9ff4b3eeb94c7d43c4c0a5d557b848b01bfa8496a933ed181b3452e
Instruction Fuzzy Hash: 0ED012F85002025DEA54AA159905B372769AFC1704B6AC67F74027B2D8DF7DAC11A638

Uniqueness

Uniqueness Score: -1.00%

Function 004043B0, Relevance: 2.6, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004043B0() {
				intOrPtr _t13;
				intOrPtr* _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;
				void* _t26;
				void* _t28;
				void* _t31;

				_t28 =  *0x0045AA5C;
				while(_t28 != 0x45aa58) {
					_t2 = _t28 + 4; // 0x45aa58
					VirtualFree(_t28, 0, 0x8000); // executed
					_t28 =  *_t2;
				}
				_t25 = 0x37;
				_t13 = 0x458074;
				do {
					 *((intOrPtr*)(_t13 + 0xc)) = _t13;
					 *((intOrPtr*)(_t13 + 8)) = _t13;
					 *((intOrPtr*)(_t13 + 0x10)) = 1;
					 *((intOrPtr*)(_t13 + 0x14)) = 0;
					_t13 = _t13 + 0x20;
					_t25 = _t25 - 1;
				} while (_t25 != 0);
				 *0x45aa58 = 0x45aa58;
				 *0x0045AA5C = 0x45aa58;
				_t26 = 0x400;
				_t23 = 0x45aaf8;
				do {
					_t14 = _t23;
					 *_t14 = _t14;
					_t8 = _t14 + 4; // 0x45aaf8
					 *_t8 = _t14;
					_t23 = _t23 + 8;
					_t26 = _t26 - 1;
				} while (_t26 != 0);
				 *0x45aa74 = 0;
				E00404DB4(0x45aa78, 0x80);
				_t18 = 0;
				 *0x45aa70 = 0;
				_t31 =  *0x0045CB00;
				while(_t31 != 0x45cafc) {
					_t10 = _t31 + 4; // 0x45cafc
					_t18 = VirtualFree(_t31, 0, 0x8000);
					_t31 =  *_t10;
				}
				 *0x45cafc = 0x45cafc;
				 *0x0045CB00 = 0x45cafc;
				return _t18;
			}

0x004043be
0x004043d5
0x004043c3
0x004043ce
0x004043d3
0x004043d3
0x004043d9
0x004043de
0x004043e3
0x004043e5
0x004043ea
0x004043ed
0x004043f6
0x004043f9
0x004043fc
0x004043fc
0x004043ff
0x00404401
0x00404404
0x00404409
0x0040440e
0x0040440e
0x00404410
0x00404412
0x00404412
0x00404415
0x00404418
0x00404418
0x0040441d
0x0040442e
0x00404433
0x00404435
0x0040443a
0x00404451
0x0040443f
0x0040444a
0x0040444f
0x0040444f
0x00404455
0x00404457
0x0040445e

APIs

VirtualFree.KERNEL32(0045AA58,00000000,00008000), ref: 004043CE
VirtualFree.KERNEL32(0045CAFC,00000000,00008000), ref: 0040444A

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 8d2994ec39eb40cc39d4c7ccecf803636bb7a6a7001b0fc23884896d2fb43ef3
Instruction ID: 3d3c5bbee805edfab7e0d138dcc467b03b5a262a2aaf075a23b4cee3cae91e6f
Opcode Fuzzy Hash: 8d2994ec39eb40cc39d4c7ccecf803636bb7a6a7001b0fc23884896d2fb43ef3
Instruction Fuzzy Hash: DC11B2B17002108FC7648F188940B167AD0EB88710F11C17FEA49EB392DB78EC11CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 0040B41A, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B45B

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ab068e6a14e2c8ea8f4ce41aac0a214f8f62bce815132915536ade01f0905f44
Instruction ID: 8bffa950da6ccf8e9d68115b3a6ee38b3c6b7003a5f786c7cfb0dde57d8959c8
Opcode Fuzzy Hash: ab068e6a14e2c8ea8f4ce41aac0a214f8f62bce815132915536ade01f0905f44
Instruction Fuzzy Hash: 2BF074B6700158BF9B40DE9DDC81D9B77ECEB8C264B054529BA08D3201D634ED108BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00408DA8, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 00408DC6

Part of subcall function 00409FEC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040A0A6,?,?,00000000), ref: 0040A028
Part of subcall function 00409FEC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040A0A6,?,?,00000000), ref: 0040A079

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: a4f943427d6c15ff19a55d6586e8759d67d6134fb03fea4ad23bbb802e798a21
Instruction ID: 2b3792a4b1dc60e46a66f7ef244482b2543de5494b205b85215521d4bfe0cd67
Opcode Fuzzy Hash: a4f943427d6c15ff19a55d6586e8759d67d6134fb03fea4ad23bbb802e798a21
Instruction Fuzzy Hash: B2E03971A003108BCB14EE58C9C5A563398AF08714F044666BC54DF3C6D374CD1087D5

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(?,?), ref: 0040705A

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 16babeede66944311f6e0df2b414e5d3b47cea53d27240e4525f174b2cd611bf
Instruction ID: 521c1b5f768b699ab125e90a01b1e4ab36393b7829fdf46fa2c319fda676c47c
Opcode Fuzzy Hash: 16babeede66944311f6e0df2b414e5d3b47cea53d27240e4525f174b2cd611bf
Instruction Fuzzy Hash: 54D022F42001034ED744AE28E85083B776A6BC2300324C37FA002BF3C4EB39D801EB24

Uniqueness

Uniqueness Score: -1.00%

Function 00407008, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0040701B

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 4cf0a83ff36956a515eac7eb73c08a37bd4d852cd297a7e06ceb0178c6838f5a
Instruction ID: f77538cef8f84c1bd5edb082dd2576eeb3805c9f22ead7ab868353bef42dccd9
Opcode Fuzzy Hash: 4cf0a83ff36956a515eac7eb73c08a37bd4d852cd297a7e06ceb0178c6838f5a
Instruction Fuzzy Hash: 47C012B2A5032007FB71A6599CC075362CC9B09364F1401B3A504F7380E2B8EC005295

Uniqueness

Uniqueness Score: -1.00%

Function 00406F90, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00406F9E

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 471d2ff2594150b78ca6c9d41656be4253a4a1085d03196ac1dbf8d1541dd155
Instruction ID: 89bf236701077f683077845decda5aadd05ea4a3446af6ed9eb91949d41ba639
Opcode Fuzzy Hash: 471d2ff2594150b78ca6c9d41656be4253a4a1085d03196ac1dbf8d1541dd155
Instruction Fuzzy Hash: 3CB092F91012015EEA50AB15A940B23336AAFC1710F39C5AAB400AB1A8CBBC9800A628

Uniqueness

Uniqueness Score: -1.00%

Function 0040A860, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0040A864

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 061f33c74fbd3a8d12d99ac730462816d9650d909b5116e36f914e29ba85aaf6
Instruction ID: d6bccd244c40ba3431a3becacedfdf5b7a54d22225aaa3a95c66c6ebb6932839
Opcode Fuzzy Hash: 061f33c74fbd3a8d12d99ac730462816d9650d909b5116e36f914e29ba85aaf6
Instruction Fuzzy Hash: 6FA0121480C4001AC808F7194D4340B32801940214FC40324745CA52C2E62985A843DB

Uniqueness

Uniqueness Score: -1.00%

Function 00402D40, Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004), ref: 00402D56

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 024d5869aee8cc5e0066f59b7bbe62c916f8b3e72f1fb50b144aeac3fa107d94
Instruction ID: 7207d1b74ac269641ab438553269f1b09c707aea7dad436dca93dc9b85709a22
Opcode Fuzzy Hash: 024d5869aee8cc5e0066f59b7bbe62c916f8b3e72f1fb50b144aeac3fa107d94
Instruction Fuzzy Hash: A1F04FF1B013004BEB088F798E457067AD1A789305F10823EE509EB7D9D7748816CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00402E00, Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 00402E20

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b79692297b5bf3f8c0cdbdd34c1567a956225141c18b667eea4df64c00c8653b
Instruction ID: dc0fed2b55bf8e47ea98f1396532cc0d907e2004168205748f31cb656931c14a
Opcode Fuzzy Hash: b79692297b5bf3f8c0cdbdd34c1567a956225141c18b667eea4df64c00c8653b
Instruction Fuzzy Hash: 27F0B4B6A007556FD3219F5AACC4B46BB94FB01715F41413AF948B7381D7B4AC00C7D8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409708, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 151
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00409708(WCHAR* __eax, int __edx) {
				WCHAR* _v8;
				int _v12;
				WCHAR* _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				short _v1134;
				signed int _t50;
				signed int _t51;
				signed int _t56;
				signed int _t57;
				signed int _t101;
				signed int _t102;
				intOrPtr* _t103;
				WCHAR* _t110;
				struct HINSTANCE__* _t111;
				WCHAR* _t113;
				short* _t114;
				void* _t115;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t111 = GetModuleHandleW(L"kernel32.dll");
				if(_t111 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t113 =  &(_v8[2]);
						goto L10;
					} else {
						if(_v8[1] == 0x5c) {
							_t114 = E004096E4( &(_v8[2]));
							if( *_t114 != 0) {
								_t14 = _t114 + 2; // 0x2
								_t113 = E004096E4(_t14);
								if( *_t113 != 0) {
									L10:
									_t101 = _t113 - _v8;
									_t102 = _t101 >> 1;
									if(_t101 < 0) {
										asm("adc ebx, 0x0");
									}
									lstrcpynW( &_v1134, _v8, _t102 + 1);
									while( *_t113 != 0) {
										_t110 = E004096E4( &(_t113[1]));
										_t50 = _t110 - _t113;
										_t51 = _t50 >> 1;
										if(_t50 < 0) {
											asm("adc eax, 0x0");
										}
										if(_t51 + _t102 + 1 <= 0x105) {
											_t56 = _t110 - _t113;
											_t57 = _t56 >> 1;
											if(_t56 < 0) {
												asm("adc eax, 0x0");
											}
											lstrcpynW( &_v1134 + _t102 + _t102, _t113, _t57 + 1);
											_v20 = FindFirstFileW( &_v1134,  &_v612);
											if(_v20 != 0xffffffff) {
												FindClose(_v20);
												if(lstrlenW( &(_v612.cFileName)) + _t102 + 1 + 1 <= 0x105) {
													 *((short*)(_t115 + _t102 * 2 - 0x46a)) = 0x5c;
													lstrcpynW( &(( &_v1134 + _t102 + _t102)[1]),  &(_v612.cFileName), 0x105 - _t102 - 1);
													_t102 = _t102 + lstrlenW( &(_v612.cFileName)) + 1;
													_t113 = _t110;
													continue;
												}
											}
										}
										goto L23;
									}
									lstrcpynW(_v8,  &_v1134, _v12);
								}
							}
						}
					}
				} else {
					_t103 = GetProcAddress(_t111, "GetLongPathNameW");
					if(_t103 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v1134);
						_push(_v8);
						if( *_t103() == 0) {
							goto L4;
						} else {
							lstrcpynW(_v8,  &_v1134, _v12);
						}
					}
				}
				L23:
				return _v16;
			}

0x00409714
0x00409717
0x0040971d
0x0040972a
0x0040972e
0x00409770
0x00409777
0x004097b7
0x00000000
0x00409779
0x00409781
0x00409792
0x00409798
0x0040979e
0x004097a6
0x004097ac
0x004097ba
0x004097bc
0x004097bf
0x004097c1
0x004097c3
0x004097c3
0x004097d5
0x004098a4
0x004097e7
0x004097eb
0x004097ed
0x004097ef
0x004097f1
0x004097f1
0x004097fc
0x00409804
0x00409806
0x00409808
0x0040980a
0x0040980a
0x0040981d
0x00409835
0x0040983c
0x00409846
0x00409862
0x00409864
0x0040988e
0x004098a0
0x004098a2
0x00000000
0x004098a2
0x00409862
0x0040983c
0x00000000
0x004097fc
0x004098bd
0x004098bd
0x004097ac
0x00409798
0x00409781
0x00409730
0x0040973b
0x0040973f
0x00000000
0x00409741
0x00409741
0x0040974c
0x00409750
0x00409755
0x00000000
0x00409757
0x00409766
0x00409766
0x00409755
0x0040973f
0x004098c2
0x004098cb

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 00409725
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 00409736
lstrcpynW.KERNEL32(?,?,?,?,?,?), ref: 00409766
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 004097D5
lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 0040981D
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00409830
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00409846
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00409852
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?), ref: 0040988E
lstrlenW.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll), ref: 0040989A
lstrcpynW.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 004098BD

Strings

\, xrefs: 00409864
GetLongPathNameW, xrefs: 00409730
kernel32.dll, xrefs: 00409720

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 3245196872-3908791685
Opcode ID: ccb63d4510d81ad6662cdb73e39ee66b20d823d4fc0582c4e8ab57075e3b5641
Instruction ID: d8b81b4d9d92e47e217235aa57dc772448e112e3b730a3cfe8015ecd17f718d2
Opcode Fuzzy Hash: ccb63d4510d81ad6662cdb73e39ee66b20d823d4fc0582c4e8ab57075e3b5641
Instruction Fuzzy Hash: AE5182B2E10119ABCB10EEA8CD85ADEB3B8AF05310F1445B7A554F72C2E778DE44CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00404A90, Relevance: 19.7, APIs: 13, Instructions: 189
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A90(void** __eax, void* __ecx) {
				long _v16;
				void* _t40;
				long _t41;
				void* _t43;
				void* _t47;
				void** _t63;
				void* _t84;
				void** _t86;
				long _t88;
				void* _t91;
				void* _t92;
				long _t93;
				long _t94;
				void* _t95;
				long _t96;
				long _t97;

				_t86 = __eax;
				_t97 = 0;
				 *((intOrPtr*)(__eax + 0xc)) = 0;
				 *((intOrPtr*)(__eax + 0x10)) = 0;
				_t40 = ( *(__eax + 4) & 0x0000ffff) - 0xd7b1;
				if(_t40 == 0) {
					_t41 = 0x80000000;
					_t88 = 3;
					 *((intOrPtr*)(__eax + 0x1c)) = 0x4049c8;
					L7:
					_t86[8] = E00404A04;
					if(_t86[0x12] != 0) {
						_t86[9] = E00404A58;
						_t43 = CreateFileW( &(_t86[0x12]), _t41, 1, 0, _t88, 0x80, 0);
						if(_t43 != 0xffffffff) {
							 *_t86 = _t43;
							if(_t86[1] != 0xd7b3) {
								L41:
								if(_t86[0xb4] == 0) {
									_t86[0xb4] =  *0x45a8fc & 0x0000ffff;
								}
								goto L43;
							}
							_t86[1] = 0xd7b2;
							_t93 = GetFileSize( *_t86, 0);
							if(_t93 != 0xffffffff) {
								_t94 = _t93 - 0x80;
								if(_t94 < 0) {
									_t94 = 0;
								}
								if(SetFilePointer( *_t86, _t94, 0, 0) + 1 == 0 || ReadFile( *_t86,  &(_t86[0x94]), 0x80,  &_v16, 0) == 0) {
									_t97 = E00404A78(_t86);
									goto L49;
								} else {
									if((_t86[1] & 0x00000001) == 0 || _v16 <= 0) {
										goto L41;
									} else {
										_t91 = _v16 - 1;
										if(_t91 < 0) {
											goto L41;
										}
										_t92 = _t91 + 1;
										_t95 = 0;
										_t63 =  &(_t86[0x94]);
										while( *_t63 != 0x1a) {
											_t95 = _t95 + 1;
											_t63 =  &(_t63[0]);
											_t92 = _t92 - 1;
											if(_t92 != 0) {
												continue;
											}
											goto L41;
										}
										if(SetFilePointer( *_t86, _t95 - _v16, 0, 2) + 1 == 0 || SetEndOfFile( *_t86) == 0) {
											_t97 = E00404A78(_t86);
											goto L49;
										} else {
											goto L41;
										}
									}
								}
							}
							_t97 = E00404A78(_t86);
							goto L49;
						}
						_t86[1] = 0xd7b0;
						_t97 = GetLastError();
						goto L49;
					} else {
						if(_t86[5] == 0) {
							_t86[5] =  &(_t86[0x94]);
							_t86[2] = 0x80;
						}
						_t86[9] = E00404A04;
						if(_t86[1] != 0xd7b2) {
							 *_t86 = GetStdHandle(0xfffffff6);
						} else {
							if(_t86 != 0x45a61c) {
								_t96 = 0xfffffff5;
							} else {
								_t96 = 0xfffffff4;
							}
							 *_t86 = GetStdHandle(_t96);
						}
						if(_t86[0xb4] == 0) {
							if(GetFileType( *_t86) != 2) {
								_t86[0xb4] =  *0x45a8fc & 0x0000ffff;
							} else {
								if(_t86[1] != 0xd7b2) {
									_t86[0xb4] = GetConsoleCP();
								} else {
									_t86[0xb4] = GetConsoleOutputCP();
								}
							}
						}
						L43:
						if(_t86[1] != 0xd7b1) {
							_t47 = GetFileType( *_t86) - 1;
							if(_t47 < 0) {
								E00404A78(_t86);
								_t97 = 0x69;
							} else {
								if(_t47 == 1) {
									_t86[8] = E00404A08;
								}
							}
						}
						L49:
						return _t97;
					}
				}
				_t84 = _t40 - 1;
				if(_t84 == 0) {
					_t41 = 0x40000000;
					_t88 = 2;
					 *((intOrPtr*)(__eax + 0x1c)) = E00404A08;
					goto L7;
				}
				if(_t84 == 1) {
					_t41 = 0xc0000000;
					_t88 = 3;
					 *((intOrPtr*)(__eax + 0x1c)) = E00404A08;
					goto L7;
				} else {
					goto L49;
				}
			}

0x00404a94
0x00404a96
0x00404a9a
0x00404a9f
0x00404aa6
0x00404aaa
0x00404abb
0x00404ac0
0x00404ac5
0x00404af2
0x00404af2
0x00404afe
0x00404ba8
0x00404bc0
0x00404bc8
0x00404bdc
0x00404be4
0x00404cac
0x00404cb4
0x00404cbd
0x00404cbd
0x00000000
0x00404cb4
0x00404bea
0x00404bfa
0x00404bff
0x00404c0f
0x00404c17
0x00404c19
0x00404c19
0x00404c29
0x00404c51
0x00000000
0x00404c58
0x00404c5c
0x00000000
0x00404c64
0x00404c67
0x00404c6a
0x00000000
0x00000000
0x00404c6c
0x00404c6d
0x00404c6f
0x00404c75
0x00404ca7
0x00404ca8
0x00404ca9
0x00404caa
0x00000000
0x00000000
0x00000000
0x00404caa
0x00404c8e
0x00404ca3
0x00000000
0x00000000
0x00000000
0x00000000
0x00404c8e
0x00404c5c
0x00404c29
0x00404c08
0x00000000
0x00404c08
0x00404bca
0x00404bd5
0x00000000
0x00404b04
0x00404b08
0x00404b10
0x00404b13
0x00404b13
0x00404b1a
0x00404b27
0x00404b4e
0x00404b29
0x00404b2f
0x00404b38
0x00404b31
0x00404b31
0x00404b31
0x00404b43
0x00404b43
0x00404b58
0x00404b69
0x00404b9c
0x00404b6b
0x00404b71
0x00404b89
0x00404b73
0x00404b78
0x00404b78
0x00404b71
0x00404b69
0x00404cc4
0x00404cca
0x00404cd4
0x00404cd7
0x00404ce0
0x00404ce5
0x00404cd9
0x00404cda
0x00404cec
0x00404cec
0x00404cda
0x00404cd7
0x00404cf3
0x00404cf9
0x00404cf9
0x00404afe
0x00404aac
0x00404aaf
0x00404ace
0x00404ad3
0x00404ad8
0x00000000
0x00404ad8
0x00404ab4
0x00404ae1
0x00404ae6
0x00404aeb
0x00000000
0x00404ab6
0x00000000
0x00404ab6

APIs

GetStdHandle.KERNEL32(FFFFFFF5), ref: 00404B3E
GetStdHandle.KERNEL32(000000F6), ref: 00404B49
GetFileType.KERNEL32(00000000), ref: 00404B61
GetConsoleOutputCP.KERNEL32(00000000), ref: 00404B73
GetConsoleCP.KERNEL32(00000000), ref: 00404B84
GetFileType.KERNEL32(00000000), ref: 00404CCF

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: ConsoleFileHandleType$Output
String ID:
API String ID: 393880136-0
Opcode ID: e3141ae4794dbc23e1ed0a4f525c76de6ecc5874af5ba3a129f266a72dba5418
Instruction ID: 9b11e073988baa7b901c01109213c0b6e2663ad461211557b3a688b5ec612b7a
Opcode Fuzzy Hash: e3141ae4794dbc23e1ed0a4f525c76de6ecc5874af5ba3a129f266a72dba5418
Instruction Fuzzy Hash: 8951D7F060524096EF20EF65898872636A4ABC5314F16867BEE05BF2D6D3BCCC41976E

Uniqueness

Uniqueness Score: -1.00%

Function 004095C4, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 76
stringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E004095C4(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v8;
				void* _t17;
				signed short _t27;
				intOrPtr _t32;
				intOrPtr _t44;

				_t39 = __edi;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t41 = __edx;
				_t27 = __eax;
				_push(_t44);
				_push(0x4096c7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t44;
				_push(0x45cb88);
				L004027BC();
				if(__eax !=  *0x45cba0) {
					_push(0x45cb88);
					L004027C4();
					E00406F48(__edx);
					if(IsValidLocale(_t27 & 0x0000ffff, 2) != 0) {
						if( *0x45cb84 == 0) {
							_t17 = E004092AC(_t27, _t27, _t41, __edi, _t41);
							L0040287C();
							if(_t27 != _t17) {
								if( *_t41 != 0) {
									_t17 = E00407D94(_t41, E004096E0);
								}
								L0040287C();
								E004092AC(_t17, _t27,  &_v8, _t39, _t41);
								E00407D94(_t41, _v8);
							}
						} else {
							E004094A8(_t27, _t41);
						}
					}
					_push(0x45cb88);
					L004027BC();
					 *0x45cba0 = _t27;
					lstrcpynW(L"en-US,en,", E00407BA8( *_t41), 0xaa);
					_push(0x45cb88);
					L004027C4();
				} else {
					E00407C3C(__edx, 0x55, L"en-US,en,");
					_push(0x45cb88);
					L004027C4();
				}
				_pop(_t32);
				 *[fs:eax] = _t32;
				_push(E004096CE);
				return E00406F48( &_v8);
			}

0x004095c4
0x004095c7
0x004095c9
0x004095ca
0x004095cb
0x004095cd
0x004095d1
0x004095d2
0x004095d7
0x004095da
0x004095dd
0x004095e2
0x004095ee
0x00409610
0x00409615
0x0040961c
0x0040962e
0x00409637
0x00409648
0x0040964d
0x00409655
0x0040965a
0x00409663
0x00409663
0x00409668
0x00409670
0x0040967a
0x0040967a
0x00409639
0x0040963d
0x0040963d
0x00409637
0x0040967f
0x00409684
0x00409689
0x004096a2
0x004096a7
0x004096ac
0x004095f0
0x004095fc
0x00409601
0x00409606
0x00409606
0x004096b3
0x004096b6
0x004096b9
0x004096c6

APIs

RtlEnterCriticalSection.NTDLL(0045CB88), ref: 004095E2
RtlLeaveCriticalSection.NTDLL(0045CB88), ref: 00409606
RtlLeaveCriticalSection.NTDLL(0045CB88), ref: 00409615
IsValidLocale.KERNEL32(00000000,00000002,0045CB88,0045CB88,00000000,004096C7,?,?,?,00000000,?,00409F7E,00000000,00409FDD), ref: 00409627
RtlEnterCriticalSection.NTDLL(0045CB88), ref: 00409684
lstrcpynW.KERNEL32(en-US,en,,00000000,000000AA,0045CB88,00000000,00000002,0045CB88,0045CB88,00000000,004096C7,?,?,?,00000000,?,00409F7E), ref: 004096A2
RtlLeaveCriticalSection.NTDLL(0045CB88), ref: 004096AC

Strings

en-US,en,, xrefs: 004095F2, 0040969D

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValidlstrcpyn
String ID: en-US,en,
API String ID: 1058953229-3579323720
Opcode ID: 58668feda9753c0b78899ffd5d5b358cc16d236fa6557afa219fb05d9e8e63aa
Instruction ID: e691f586027c4948590b9189270a4bcac96f8322a1b778a44ed6bfc63ae68420
Opcode Fuzzy Hash: 58668feda9753c0b78899ffd5d5b358cc16d236fa6557afa219fb05d9e8e63aa
Instruction Fuzzy Hash: CE2166247543046FD611B7B69D57B2A31589F44B19F60487FB440B72D3CABEAC01C66E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAB9, Relevance: 13.8, APIs: 9, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0040AAB9(void* __eflags) {
				signed int _t104;
				signed int _t106;
				signed int _t108;
				_Unknown_base(*)()* _t110;
				long _t113;
				intOrPtr* _t119;
				void* _t124;
				void _t126;
				long _t128;
				struct HINSTANCE__* _t141;
				long _t166;
				signed int* _t191;
				_Unknown_base(*)()* _t192;
				void* _t197;
				intOrPtr _t199;
				void* _t201;
				void* _t203;

				_t201 = _t203;
				_push( *((intOrPtr*)(_t201 + 8)));
				memcpy(_t201 - 0x34, 0x458c30, 8 << 2);
				_pop(_t197);
				 *(_t201 - 0x34) =  *0x458c30;
				 *(_t201 - 0x30) = E0040AF68( *0x00458C34);
				 *(_t201 - 0x2c) = E0040AF78( *0x00458C38);
				 *((intOrPtr*)(_t201 - 0x28)) = E0040AF88( *0x00458C3C);
				 *((intOrPtr*)(_t201 - 0x24)) = E0040AF98( *0x00458C40);
				 *((intOrPtr*)(_t201 - 0x20)) = E0040AF98( *0x00458C44);
				 *((intOrPtr*)(_t201 - 0x1c)) = E0040AF98( *0x00458C48);
				 *((intOrPtr*)(_t201 - 0x18)) =  *0x00458C4C;
				memcpy(_t201 - 0x58, 0x458c50, 9 << 2);
				_t199 = _t197;
				 *(_t201 - 0x54) = 0x458c50;
				 *((intOrPtr*)(_t201 - 0x50)) =  *((intOrPtr*)(_t201 + 0xc));
				 *(_t201 - 0x4c) =  *(_t201 - 0x30);
				if(( *(_t201 - 0x34) & 0x00000001) != 0) {
					_t104 =  *((intOrPtr*)(_t201 + 0xc)) -  *((intOrPtr*)(_t201 - 0x28));
					_t141 =  *( *(_t201 - 0x2c));
					if(_t104 < 0) {
						_t104 = _t104 + 3;
					}
					 *(_t201 - 8) = _t104 >> 2;
					_t106 =  *(_t201 - 8);
					_t191 = (_t106 << 2) +  *((intOrPtr*)(_t201 - 0x24));
					_t108 = (_t106 & 0xffffff00 | (_t191[0] & 0x00000080) == 0x00000000) & 0x00000001;
					 *(_t201 - 0x48) = _t108;
					if(_t108 == 0) {
						 *(_t201 - 0x44) =  *_t191 & 0x0000ffff;
					} else {
						 *(_t201 - 0x44) = E0040AFA8( *_t191) + 2;
					}
					_t192 = 0;
					if( *0x45cc58 == 0) {
						L10:
						if(_t141 != 0) {
							L25:
							 *(_t201 - 0x40) = _t141;
							if( *0x45cc58 != 0) {
								_t192 =  *0x45cc58(2, _t201 - 0x58);
							}
							if(_t192 != 0) {
								L36:
								if(_t192 == 0) {
									 *((intOrPtr*)(_t201 - 0x38)) = GetLastError();
									if( *0x45cc5c != 0) {
										_t192 =  *0x45cc5c(4, _t201 - 0x58);
									}
									if(_t192 == 0) {
										_t113 =  *0x458c7c; // 0x0
										 *(_t201 - 0x14) = _t113;
										 *(_t201 - 0x14) = _t201 - 0x58;
										RaiseException(0xc06d007f, 0, 1, _t201 - 0x14);
										_t192 =  *((intOrPtr*)(_t201 - 0x3c));
									}
								}
								goto L41;
							} else {
								if( *((intOrPtr*)(_t199 + 0x14)) == 0 ||  *((intOrPtr*)(_t199 + 0x1c)) == 0) {
									L35:
									_t192 = GetProcAddress(_t141,  *(_t201 - 0x44));
									goto L36;
								} else {
									_t119 =  *((intOrPtr*)(_t141 + 0x3c)) + _t141;
									if( *_t119 != 0x4550 ||  *((intOrPtr*)(_t119 + 8)) !=  *((intOrPtr*)(_t201 - 0x18)) || (( *(_t119 + 0x34) & 0xffffff00 |  *(_t119 + 0x34) == _t141) & 0x00000001) == 0) {
										goto L35;
									} else {
										_t192 =  *((intOrPtr*)( *((intOrPtr*)(_t201 - 0x20)) +  *(_t201 - 8) * 4));
										if(_t192 == 0) {
											goto L35;
										}
										L41:
										 *((intOrPtr*)( *((intOrPtr*)(_t201 + 0xc)))) = _t192;
										goto L42;
									}
								}
							}
						}
						if( *0x45cc58 != 0) {
							_t141 =  *0x45cc58(1, _t201 - 0x58);
						}
						if(_t141 == 0) {
							_t141 = LoadLibraryA( *(_t201 - 0x4c));
						}
						if(_t141 != 0) {
							L20:
							if(_t141 == E0040A960( *(_t201 - 0x2c), _t141)) {
								FreeLibrary(_t141);
							} else {
								if( *((intOrPtr*)(_t199 + 0x18)) != 0) {
									_t124 = LocalAlloc(0x40, 8);
									 *(_t201 - 0x10) = _t124;
									if(_t124 != 0) {
										 *((intOrPtr*)( *(_t201 - 0x10) + 4)) = _t199;
										_t126 =  *0x458c2c; // 0x0
										 *( *(_t201 - 0x10)) = _t126;
										 *0x458c2c =  *(_t201 - 0x10);
									}
								}
							}
							goto L25;
						} else {
							 *((intOrPtr*)(_t201 - 0x38)) = GetLastError();
							if( *0x45cc5c != 0) {
								_t141 =  *0x45cc5c(3, _t201 - 0x58);
							}
							if(_t141 != 0) {
								goto L20;
							} else {
								_t128 =  *0x458c78; // 0x0
								 *(_t201 - 0xc) = _t128;
								 *(_t201 - 0xc) = _t201 - 0x58;
								RaiseException(0xc06d007e, 0, 1, _t201 - 0xc);
								_t110 =  *((intOrPtr*)(_t201 - 0x3c));
								goto L45;
							}
						}
					} else {
						_t192 =  *0x45cc58(0, _t201 - 0x58);
						if(_t192 == 0) {
							goto L10;
						} else {
							L42:
							if( *0x45cc58 != 0) {
								 *((intOrPtr*)(_t201 - 0x38)) = 0;
								 *(_t201 - 0x40) = _t141;
								 *((intOrPtr*)(_t201 - 0x3c)) = _t192;
								 *0x45cc58(5, _t201 - 0x58);
							}
							_t110 = _t192;
							goto L45;
						}
					}
				} else {
					_t166 =  *0x458c74; // 0x0
					 *(_t201 - 4) = _t166;
					 *(_t201 - 4) = _t201 - 0x58;
					RaiseException(0xc06d0057, 0, 1, _t201 - 4);
					_t110 = 0;
					L45:
					return _t110;
				}
			}

0x0040aab9
0x0040aacc
0x0040aad2
0x0040aad4
0x0040aad7
0x0040aae4
0x0040aaf1
0x0040aafe
0x0040ab0b
0x0040ab18
0x0040ab25
0x0040ab2e
0x0040ab3c
0x0040ab3e
0x0040ab3f
0x0040ab45
0x0040ab4b
0x0040ab52
0x0040ab82
0x0040ab87
0x0040ab89
0x0040ab8b
0x0040ab8b
0x0040ab91
0x0040ab94
0x0040ab9c
0x0040aba6
0x0040aba9
0x0040abae
0x0040abc9
0x0040abb0
0x0040abbc
0x0040abbc
0x0040abcc
0x0040abd5
0x0040abee
0x0040abf0
0x0040acb2
0x0040acb2
0x0040acbc
0x0040acca
0x0040acca
0x0040acce
0x0040ad1b
0x0040ad1d
0x0040ad24
0x0040ad2e
0x0040ad3c
0x0040ad3c
0x0040ad40
0x0040ad42
0x0040ad47
0x0040ad4d
0x0040ad5d
0x0040ad62
0x0040ad62
0x0040ad40
0x00000000
0x0040acd0
0x0040acd4
0x0040ad0f
0x0040ad19
0x00000000
0x0040acdc
0x0040acdf
0x0040ace7
0x00000000
0x0040ad00
0x0040ad06
0x0040ad0b
0x00000000
0x00000000
0x0040ad65
0x0040ad68
0x00000000
0x0040ad68
0x0040ace7
0x0040acd4
0x0040acce
0x0040abfd
0x0040ac0b
0x0040ac0b
0x0040ac0f
0x0040ac1a
0x0040ac1a
0x0040ac1e
0x0040ac6b
0x0040ac77
0x0040acad
0x0040ac79
0x0040ac7d
0x0040ac83
0x0040ac88
0x0040ac8d
0x0040ac94
0x0040ac9a
0x0040ac9f
0x0040aca4
0x0040aca4
0x0040ac8d
0x0040ac7d
0x00000000
0x0040ac20
0x0040ac25
0x0040ac2f
0x0040ac3d
0x0040ac3d
0x0040ac41
0x00000000
0x0040ac43
0x0040ac43
0x0040ac48
0x0040ac4e
0x0040ac5e
0x0040ac63
0x00000000
0x0040ac63
0x0040ac41
0x0040abd7
0x0040abe3
0x0040abe7
0x00000000
0x0040abe9
0x0040ad6a
0x0040ad71
0x0040ad75
0x0040ad78
0x0040ad7b
0x0040ad84
0x0040ad84
0x0040ad8a
0x00000000
0x0040ad8a
0x0040abe7
0x0040ab54
0x0040ab54
0x0040ab5a
0x0040ab60
0x0040ab70
0x0040ab75
0x0040ad8c
0x0040ad92
0x0040ad92

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040AB70

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b2fe304eff160e06df94bd44883ba68fc7d934a530b1ddaf75dc7c4c8f16659d
Instruction ID: 9264473c5b9667787e6bc1496f8e72f41bdf7ef84a87389aa7b139743c16dd27
Opcode Fuzzy Hash: b2fe304eff160e06df94bd44883ba68fc7d934a530b1ddaf75dc7c4c8f16659d
Instruction Fuzzy Hash: E9A170B5A003099FDB11DFA8D880BAEB7B5AF48311F14413AE505B73C1DB78E954CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403E44, Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 285
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00403E44(void* __eax, void* __fp0) {
				void* _v8;
				char _v110600;
				char _v112644;
				char _v112645;
				signed int _v112652;
				char _v112653;
				char _v112654;
				char _v112660;
				intOrPtr _v112664;
				intOrPtr _v112668;
				intOrPtr _v112672;
				signed short* _v112676;
				void* _v112680;
				char _v129064;
				char _v131113;
				char _v161832;
				void* __ebx;
				void* _t74;
				int _t80;
				intOrPtr _t83;
				intOrPtr _t94;
				CHAR* _t98;
				intOrPtr _t100;
				void* _t112;
				intOrPtr _t113;
				intOrPtr _t119;
				intOrPtr _t124;
				void* _t134;
				intOrPtr _t135;
				intOrPtr _t139;
				signed int _t149;
				int _t153;
				intOrPtr _t154;
				char* _t156;
				char* _t157;
				char* _t158;
				char* _t159;
				char* _t160;
				char* _t161;
				char* _t163;
				char* _t164;
				char* _t169;
				char* _t170;
				intOrPtr _t201;
				void* _t203;
				void* _t204;
				intOrPtr* _t207;
				void* _t209;
				void* _t210;
				signed int _t215;
				void* _t218;
				void* _t219;
				void* _t232;

				_push(__eax);
				_t74 = 0x27;
				goto L1;
				L12:
				while(_t201 != 0x45aa58) {
					_t80 = E00403944(_t201, _t153, _t186);
					_t153 = _t80;
					__eflags = _t153;
					if(_t153 == 0) {
						L11:
						_t20 = _t201 + 4; // 0x45aa58
						_t201 =  *_t20;
						continue;
					} else {
						goto L4;
					}
					do {
						L4:
						_t215 =  *(_t153 - 4);
						__eflags = _t215 & 0x00000001;
						if((_t215 & 0x00000001) == 0) {
							__eflags = _t215 & 0x00000004;
							if(__eflags == 0) {
								__eflags = _v112652 - 0x1000;
								if(_v112652 < 0x1000) {
									_v112664 = (_t215 & 0xfffffff0) - 4;
									_t149 = E00403C30(_t153);
									__eflags = _t149;
									if(_t149 == 0) {
										_v112645 = 0;
										_t186 = _v112664;
										 *((intOrPtr*)(_t218 + _v112652 * 4 - 0x1f824)) = _v112664;
										_t18 =  &_v112652;
										 *_t18 = _v112652 + 1;
										__eflags =  *_t18;
									}
								}
							} else {
								E00403C88(_t153, __eflags, _t218);
							}
						}
						_t80 = E00403920(_t153);
						_t153 = _t80;
						__eflags = _t153;
					} while (_t153 != 0);
					goto L11;
				}
				_t154 =  *0x45cb00; // 0x45cafc
				while(_t154 != 0x45cafc && _v112652 < 0x1000) {
					_t80 = E00403C30(_t154 + 0x10);
					__eflags = _t80;
					if(_t80 == 0) {
						_v112645 = 0;
						_t22 = _t154 + 0xc; // 0x0
						_t80 = _v112652;
						 *((intOrPtr*)(_t218 + _t80 * 4 - 0x1f824)) = ( *_t22 & 0xfffffff0) - 0xfffffffffffffff4;
						_t27 =  &_v112652;
						 *_t27 = _v112652 + 1;
						__eflags =  *_t27;
					}
					_t29 = _t154 + 4; // 0x45cafc
					_t154 =  *_t29;
				}
				if(_v112645 != 0) {
					L54:
					return _t80;
				}
				_v112653 = 0;
				_v112668 = 0;
				_t83 =  *0x458050; // 0x4029c8
				_t156 = E00403A10(E00407458(_t83),  &_v161832);
				_v112660 = 0x37;
				_v112676 = 0x458076;
				_v112680 =  &_v110600;
				do {
					_v112672 = ( *_v112676 & 0x0000ffff) - 4;
					_v112654 = 0;
					_t203 = 0xff;
					_t207 = _v112680;
					while(_t156 <=  &_v131113) {
						if( *_t207 > 0) {
							if(_v112653 == 0) {
								_t139 =  *0x458054; // 0x4029f4
								_t156 = E00403A10(E00407458(_t139), _t156);
								_v112653 = 1;
							}
							if(_v112654 != 0) {
								 *_t156 = 0x2c;
								_t161 = _t156 + 1;
								 *_t161 = 0x20;
								_t162 = _t161 + 1;
								__eflags = _t161 + 1;
							} else {
								 *_t156 = 0xd;
								 *((char*)(_t156 + 1)) = 0xa;
								_t169 = E004039C0(_v112668 + 1, _t156 + 2);
								 *_t169 = 0x20;
								_t170 = _t169 + 1;
								 *_t170 = 0x2d;
								 *((char*)(_t170 + 1)) = 0x20;
								_t134 = E004039C0(_v112672, _t170 + 2);
								_t135 =  *0x45805c; // 0x402a5c
								_t162 = E00403A10(E00407458(_t135), _t134);
								_v112654 = 1;
							}
							_t112 = _t203 - 1;
							_t232 = _t112;
							if(_t232 < 0) {
								_t113 =  *0x458060; // 0x402a68
								_t163 = E00403A10(E00407458(_t113), _t162);
							} else {
								if(_t232 == 0) {
									_t119 =  *0x458064; // 0x402a70
									_t163 = E00403A10(E00407458(_t119), _t162);
								} else {
									if(_t112 == 1) {
										_t124 =  *0x458068; // 0x402a7c
										_t163 = E00403A10(E00407458(_t124), _t162);
									} else {
										_t163 = E00403A28( *((intOrPtr*)(_t207 - 4)), _t162);
									}
								}
							}
							 *_t163 = 0x20;
							_t164 = _t163 + 1;
							 *_t164 = 0x78;
							 *((char*)(_t164 + 1)) = 0x20;
							_t156 = E004039C0( *_t207, _t164 + 2);
						}
						_t203 = _t203 - 1;
						_t207 = _t207 - 8;
						if(_t203 != 0xffffffff) {
							continue;
						} else {
							goto L39;
						}
					}
					L39:
					if(_v112654 != 0 ||  *0x45aa56 == 0 || (_v112672 + 0x00000004 & 0x0000000f) == 0) {
						_v112668 = _v112672;
					}
					_v112680 = _v112680 + 0x800;
					_v112676 =  &(_v112676[0x10]);
					_t61 =  &_v112660;
					 *_t61 = _v112660 - 1;
				} while ( *_t61 != 0);
				if(_v112652 <= 0) {
					L53:
					_t94 =  *0x45806c; // 0x402a8c
					E00403A10(E00407458(_t94), _t156);
					_t98 =  *0x458070; // 0x402a90
					_t80 = MessageBoxA(0,  &_v161832, _t98, 0x2010);
					goto L54;
				}
				if(_v112653 != 0) {
					 *_t156 = 0xd;
					_t158 = _t156 + 1;
					 *_t158 = 0xa;
					_t159 = _t158 + 1;
					 *_t159 = 0xd;
					_t160 = _t159 + 1;
					 *_t160 = 0xa;
					_t156 = _t160 + 1;
				}
				_t100 =  *0x458058; // 0x402a1c
				_t156 = E00403A10(E00407458(_t100), _t156);
				_t209 = _v112652 - 1;
				if(_t209 >= 0) {
					_t210 = _t209 + 1;
					_t204 = 0;
					_v112680 =  &_v129064;
					L49:
					L49:
					if(_t204 != 0) {
						 *_t156 = 0x2c;
						_t157 = _t156 + 1;
						 *_t157 = 0x20;
						_t156 = _t157 + 1;
					}
					_t156 = E004039C0( *_v112680, _t156);
					if(_t156 >  &_v131113) {
						goto L53;
					}
					_t204 = _t204 + 1;
					_v112680 = _v112680 + 4;
					_t210 = _t210 - 1;
					if(_t210 != 0) {
						goto L49;
					}
				}
				L1:
				_t219 = _t219 + 0xfffff004;
				_push(_t74);
				_t74 = _t74 - 1;
				if(_t74 != 0) {
					goto L1;
				} else {
					_push(_t153);
					E00404DB4( &_v112644, 0x1b800);
					_t186 = 0x4000;
					E00404DB4( &_v129064, 0x4000);
					_t80 = 0;
					_v112652 = 0;
					_v112645 = 1;
					_t201 =  *0x45aa5c; // 0x45aa58
					goto L12;
				}
			}

0x00403e47
0x00403e48
0x00403e48
0x00000000
0x00403f23
0x00403ea3
0x00403ea8
0x00403eaa
0x00403eac
0x00403f20
0x00403f20
0x00403f20
0x00000000
0x00000000
0x00000000
0x00000000
0x00403eae
0x00403eae
0x00403eb3
0x00403eb5
0x00403ebb
0x00403ebd
0x00403ec3
0x00403ed0
0x00403eda
0x00403ee2
0x00403eea
0x00403eef
0x00403ef1
0x00403ef3
0x00403f00
0x00403f06
0x00403f0d
0x00403f0d
0x00403f0d
0x00403f0d
0x00403ef1
0x00403ec5
0x00403ec8
0x00403ecd
0x00403ec3
0x00403f15
0x00403f1a
0x00403f1c
0x00403f1c
0x00000000
0x00403eae
0x00403f2f
0x00403f6e
0x00403f3c
0x00403f41
0x00403f43
0x00403f45
0x00403f4c
0x00403f58
0x00403f5e
0x00403f65
0x00403f65
0x00403f65
0x00403f65
0x00403f6b
0x00403f6b
0x00403f6b
0x00403f89
0x0040423d
0x00404243
0x00404243
0x00403f8f
0x00403f98
0x00403f9e
0x00403fba
0x00403fbc
0x00403fc6
0x00403fd6
0x00403fdc
0x00403fe8
0x00403fee
0x00403ff5
0x00404000
0x00404002
0x00404013
0x00404020
0x00404022
0x0040403a
0x0040403c
0x0040403c
0x0040404a
0x004040a2
0x004040a5
0x004040a6
0x004040a9
0x004040a9
0x0040404c
0x0040404c
0x00404050
0x00404062
0x00404064
0x00404067
0x00404068
0x0040406c
0x00404078
0x0040407f
0x00404097
0x00404099
0x00404099
0x004040ac
0x004040ac
0x004040af
0x004040b8
0x004040d0
0x004040b1
0x004040b1
0x004040d4
0x004040ec
0x004040b3
0x004040b4
0x004040f0
0x00404108
0x004040b6
0x00404116
0x00404116
0x004040b4
0x004040b1
0x00404118
0x0040411b
0x0040411c
0x00404120
0x0040412d
0x0040412d
0x0040412f
0x00404130
0x00404136
0x00000000
0x00000000
0x00000000
0x00000000
0x00404136
0x0040413c
0x00404143
0x00404161
0x00404161
0x00404167
0x00404171
0x00404178
0x00404178
0x00404178
0x0040418b
0x0040420c
0x0040420c
0x0040421f
0x00404229
0x00404238
0x00000000
0x00404238
0x00404194
0x00404196
0x00404199
0x0040419a
0x0040419d
0x0040419e
0x004041a1
0x004041a2
0x004041a5
0x004041a5
0x004041a6
0x004041be
0x004041c6
0x004041c9
0x004041cb
0x004041cc
0x004041d4
0x00000000
0x004041da
0x004041dc
0x004041de
0x004041e1
0x004041e2
0x004041e5
0x004041e5
0x004041f5
0x004041ff
0x00000000
0x00000000
0x00404201
0x00404202
0x00404209
0x0040420a
0x00000000
0x00000000
0x0040420a
0x00403e4d
0x00403e4d
0x00403e53
0x00403e54
0x00403e55
0x00000000
0x00403e57
0x00403e60
0x00403e70
0x00403e7d
0x00403e82
0x00403e87
0x00403e89
0x00403e8f
0x00403e96
0x00000000
0x00403e96

APIs

MessageBoxA.USER32(00000000,?,00402A90,00002010), ref: 00404238

Strings

, xrefs: 00404171
\*@, xrefs: 0040407F, 0040408D
p*@, xrefs: 004040D4, 004040E2
h*@, xrefs: 004040B8, 004040C6
7, xrefs: 00403FBC
|*@, xrefs: 004040F0, 004040FE

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: Message
String ID: $7$\*@$h*@$p*@$|*@
API String ID: 2030045667-1794093018
Opcode ID: e8cb8c85448a82b7dec65ed3eafb0fa5cb25d6073847a35959198071718bde22
Instruction ID: bb3347da14cb2b01ca166337111252545d07054d3d8805d36a910ef66027ae92
Opcode Fuzzy Hash: e8cb8c85448a82b7dec65ed3eafb0fa5cb25d6073847a35959198071718bde22
Instruction Fuzzy Hash: 4EB1A470B042548BDB20EB2DC884B997BE8AB49705F0441FAE549FB3C2CF789D85CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00406CB0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00406CB0(void* __ecx) {
				long _v4;
				int _t3;
				void* _t9;

				if( *0x45a058 == 0) {
					if( *0x45802e == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x45a344 == 0xd7b2 &&  *0x45a34c > 0) {
						 *0x45a35c();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1d,  &_v4, 0);
					_t9 = E004077C0(0x406d44);
					return WriteFile(GetStdHandle(0xfffffff5), _t9, 2,  &_v4, 0);
				}
			}

0x00406cb8
0x00406d1e
0x00406d2e
0x00406d2e
0x00406d34
0x00406cba
0x00406cc3
0x00406cd3
0x00406cd3
0x00406cef
0x00406d02
0x00406d16
0x00406d16

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69,?,?,?,?,00406E7E,004045BB,00404602), ref: 00406CE9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69,?,?,?,?,00406E7E,004045BB,00404602), ref: 00406CEF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69,?,?,?), ref: 00406D0A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D69), ref: 00406D10
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00406D2E

Strings

Runtime error at 00000000, xrefs: 00406CE2, 00406D27
Error, xrefs: 00406D22

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 8efc43f8e30ec1997838b64e481900a0c1c759a9c8881dde3b45258960399604
Instruction ID: fe01dd67d756f7db6c6824465d8ae9be5c63675615751d6c8da0d5b36d3669a8
Opcode Fuzzy Hash: 8efc43f8e30ec1997838b64e481900a0c1c759a9c8881dde3b45258960399604
Instruction Fuzzy Hash: 11F0C8A064434075F61073A45D4EF2626484B44B1AF10423FB911750D3CAFC9494962F

Uniqueness

Uniqueness Score: -1.00%

Function 004035D4, Relevance: 10.9, APIs: 7, Instructions: 363
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E004035D4(signed int __eax, intOrPtr __edx, void* __edi) {
				signed int __ebx;
				void* __esi;
				signed int _t69;
				signed int _t78;
				signed int _t93;
				long _t94;
				void* _t100;
				signed int _t102;
				signed int _t109;
				signed int _t115;
				signed int _t123;
				signed int _t129;
				void* _t131;
				signed int _t140;
				unsigned int _t148;
				signed int _t150;
				long _t152;
				signed int _t156;
				intOrPtr _t161;
				signed int _t166;
				signed int _t170;
				unsigned int _t171;
				intOrPtr _t174;
				intOrPtr _t193;
				signed int _t196;
				signed int _t197;
				signed int _t198;
				void* _t206;
				unsigned int _t208;
				intOrPtr _t214;
				void* _t226;
				intOrPtr _t228;
				void* _t229;
				signed int _t231;
				void* _t233;
				signed int _t234;
				signed int _t235;
				signed int _t239;
				signed int _t242;
				void* _t244;
				intOrPtr* _t245;

				_t176 = __edx;
				_t66 = __eax;
				_t166 =  *(__eax - 4);
				_t218 = __eax;
				if((_t166 & 0x00000007) != 0) {
					__eflags = _t166 & 0x00000005;
					if((_t166 & 0x00000005) != 0) {
						_pop(_t218);
						_pop(_t145);
						__eflags = _t166 & 0x00000003;
						if((_t166 & 0x00000003) == 0) {
							_push(_t145);
							_push(__eax);
							_push(__edi);
							_push(_t226);
							_t245 = _t244 + 0xffffffe0;
							_t219 = __edx;
							_t203 = __eax;
							_t69 =  *(__eax - 4);
							_t148 = (0xfffffff0 & _t69) - 0x14;
							if(0xfffffff0 >= __edx) {
								__eflags = __edx - _t148 >> 1;
								if(__edx < _t148 >> 1) {
									_t150 = E00403058(__edx);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t219 - 0x40a2c;
										if(_t219 > 0x40a2c) {
											_t78 = _t203 - 0x10;
											__eflags = _t78;
											 *((intOrPtr*)(_t78 + 8)) = _t219;
										}
										E00402C18(_t203, _t219, _t150);
										E004033DC(_t203, _t203, _t226);
									}
								} else {
									_t150 = __eax;
									 *((intOrPtr*)(__eax - 0x10 + 8)) = __edx;
								}
							} else {
								if(0xfffffff0 <= __edx) {
									_t228 = __edx;
								} else {
									_t228 = 0xbadb9d;
								}
								 *_t245 = _t203 - 0x10 + (_t69 & 0xfffffff0);
								VirtualQuery( *(_t245 + 8), _t245 + 8, 0x1c);
								if( *((intOrPtr*)(_t245 + 0x14)) != 0x10000) {
									L12:
									_t150 = E00403058(_t228);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t228 - 0x40a2c;
										if(_t228 > 0x40a2c) {
											_t93 = _t150 - 0x10;
											__eflags = _t93;
											 *((intOrPtr*)(_t93 + 8)) = _t219;
										}
										E00402BE8(_t203,  *((intOrPtr*)(_t203 - 0x10 + 8)), _t150);
										E004033DC(_t203, _t203, _t228);
									}
								} else {
									 *(_t245 + 0x10) =  *(_t245 + 0x10) & 0xffff0000;
									_t94 =  *(_t245 + 0x10);
									if(_t219 - _t148 >= _t94) {
										goto L12;
									} else {
										_t152 = _t228 - _t148 + 0x00010000 - 0x00000001 & 0xffff0000;
										if(_t94 < _t152) {
											_t152 = _t94;
										}
										if(VirtualAlloc( *(_t245 + 0xc), _t152, 0x2000, 4) == 0 || VirtualAlloc( *(_t245 + 0xc), _t152, 0x1000, 4) == 0) {
											goto L12;
										} else {
											_t100 = _t203 - 0x10;
											 *((intOrPtr*)(_t100 + 8)) = _t219;
											 *(_t100 + 0xc) = _t152 +  *(_t100 + 0xc) | 0x00000008;
											_t150 = _t203;
										}
									}
								}
							}
							return _t150;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t170 = _t166 & 0xfffffff0;
						_push(__edi);
						_t206 = _t170 + __eax;
						_t171 = _t170 - 4;
						_t156 = _t166 & 0x0000000f;
						__eflags = __edx - _t171;
						_push(_t226);
						if(__edx > _t171) {
							_t102 =  *(_t206 - 4);
							__eflags = _t102 & 0x00000001;
							if((_t102 & 0x00000001) == 0) {
								L75:
								asm("adc edi, 0xffffffff");
								_t229 = ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176;
								_t208 = _t171;
								_t109 = E00403058(((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176);
								_t193 = _t176;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L73;
								} else {
									__eflags = _t229 - 0x40a2c;
									if(_t229 > 0x40a2c) {
										 *((intOrPtr*)(_t109 - 8)) = _t193;
									}
									_t231 = _t109;
									E00402BE8(_t218, _t208, _t109);
									E004033DC(_t218, _t208, _t231);
									return _t231;
								}
							} else {
								_t115 = _t102 & 0xfffffff0;
								_t233 = _t171 + _t115;
								__eflags = __edx - _t233;
								if(__edx > _t233) {
									goto L75;
								} else {
									__eflags =  *0x45a059;
									if(__eflags == 0) {
										L66:
										__eflags = _t115 - 0xb30;
										if(_t115 >= 0xb30) {
											E00402C34(_t206);
											_t176 = _t176;
											_t171 = _t171;
										}
										asm("adc edi, 0xffffffff");
										_t123 = (_t176 + ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + 0x000000d3 & 0xffffff00) + 0x30;
										_t196 = _t233 + 4 - _t123;
										__eflags = _t196;
										if(_t196 > 0) {
											 *(_t218 + _t233 - 4) = _t196;
											 *((intOrPtr*)(_t218 - 4 + _t123)) = _t196 + 3;
											_t234 = _t123;
											__eflags = _t196 - 0xb30;
											if(_t196 >= 0xb30) {
												__eflags = _t123 + _t218;
												E00402C74(_t123 + _t218, _t171, _t196);
											}
										} else {
											 *(_t218 + _t233) =  *(_t218 + _t233) & 0xfffffff7;
											_t234 = _t233 + 4;
										}
										_t235 = _t234 | _t156;
										__eflags = _t235;
										 *(_t218 - 4) = _t235;
										 *0x45aa68 = 0;
										_t109 = _t218;
										L73:
										return _t109;
									} else {
										while(1) {
											asm("lock cmpxchg [0x45aa68], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x45a909;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t176 = _t176;
												_t171 = _t171;
												asm("lock cmpxchg [0x45aa68], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t176 = _t176;
													_t171 = _t171;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t218 - 4);
										_t129 =  *(_t206 - 4);
										__eflags = _t129 & 0x00000001;
										if((_t129 & 0x00000001) == 0) {
											L74:
											 *0x45aa68 = 0;
											goto L75;
										} else {
											_t115 = _t129 & 0xfffffff0;
											_t233 = _t171 + _t115;
											__eflags = _t176 - _t233;
											if(_t176 > _t233) {
												goto L74;
											} else {
												goto L66;
											}
										}
									}
								}
							}
						} else {
							__eflags = __edx + __edx - _t171;
							if(__edx + __edx < _t171) {
								__eflags = __edx - 0xb2c;
								if(__edx >= 0xb2c) {
									L41:
									_t239 = (_t176 + 0x000000d3 & 0xffffff00) + 0x30;
									_t174 = _t171 + 4 - _t239;
									__eflags =  *0x45a059;
									if(__eflags != 0) {
										while(1) {
											asm("lock cmpxchg [0x45aa68], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x45a909;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t174 = _t174;
												asm("lock cmpxchg [0x45aa68], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t174 = _t174;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t218 - 4);
										__eflags = 0xf;
									}
									 *(_t218 - 4) = _t156 | _t239;
									_t161 = _t174;
									_t197 =  *(_t206 - 4);
									__eflags = _t197 & 0x00000001;
									if((_t197 & 0x00000001) != 0) {
										_t131 = _t206;
										_t198 = _t197 & 0xfffffff0;
										_t161 = _t161 + _t198;
										_t206 = _t206 + _t198;
										__eflags = _t198 - 0xb30;
										if(_t198 >= 0xb30) {
											E00402C34(_t131);
										}
									} else {
										 *(_t206 - 4) = _t197 | 0x00000008;
									}
									 *((intOrPtr*)(_t206 - 8)) = _t161;
									 *((intOrPtr*)(_t218 + _t239 - 4)) = _t161 + 3;
									__eflags = _t161 - 0xb30;
									if(_t161 >= 0xb30) {
										E00402C74(_t218 + _t239, _t174, _t161);
									}
									 *0x45aa68 = 0;
									return _t218;
								} else {
									__eflags = __edx - 0x2cc;
									if(__edx < 0x2cc) {
										_t214 = __edx;
										_t140 = E00403058(__edx);
										__eflags = _t140;
										if(_t140 != 0) {
											_t242 = _t140;
											E00402C18(_t218, _t214, _t140);
											E004033DC(_t218, _t214, _t242);
											_t140 = _t242;
										}
										return _t140;
									} else {
										_t176 = 0xb2c;
										__eflags = _t171 - 0xb2c;
										if(_t171 <= 0xb2c) {
											goto L37;
										} else {
											goto L41;
										}
									}
								}
							} else {
								L37:
								return _t66;
							}
						}
					}
				} else {
					__ebx =  *__ecx;
					__ecx =  *(__ebx + 2) & 0x0000ffff;
					__ecx = ( *(__ebx + 2) & 0x0000ffff) - 4;
					__eflags = __ecx - __edx;
					if(__ecx < __edx) {
						__ecx = __ecx + __ecx + 0x20;
						_push(__edi);
						__edi = __edx;
						__eax = 0;
						__ecx = __ecx - __edx;
						asm("adc eax, 0xffffffff");
						__eax = 0 & __ecx;
						__eax = (0 & __ecx) + __edx;
						__eax = E00403058((0 & __ecx) + __edx);
						__eflags = __eax;
						if(__eax != 0) {
							__eflags = __edi - 0x40a2c;
							if(__edi > 0x40a2c) {
								 *(__eax - 8) = __edi;
							}
							 *(__ebx + 2) & 0x0000ffff = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__eflags = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__edx = __eax;
							__edi = __eax;
							 *((intOrPtr*)(__ebx + 0x1c))() = E004033DC(__esi, __edi, __ebp);
							__eax = __edi;
						}
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						return __eax;
					} else {
						__ebx = 0x40 + __edx * 4;
						__eflags = 0x40 + __edx * 4 - __ecx;
						if(0x40 + __edx * 4 < __ecx) {
							__ebx = __edx;
							__eax = __edx;
							__eax = E00403058(__edx);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = __ebx;
								__edx = __eax;
								__ebx = __eax;
								__esi = E004033DC(__esi, __edi, __ebp);
								__eax = __ebx;
							}
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						} else {
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x004035d4
0x004035d4
0x004035d4
0x004035dc
0x004035de
0x0040366c
0x0040366f
0x004038dc
0x004038dd
0x004038de
0x004038e1
0x00402f08
0x00402f09
0x00402f0a
0x00402f0b
0x00402f0c
0x00402f0f
0x00402f11
0x00402f18
0x00402f21
0x00402f26
0x0040300f
0x00403011
0x00403024
0x00403026
0x00403028
0x0040302a
0x00403030
0x00403034
0x00403034
0x00403037
0x00403037
0x00403040
0x00403047
0x00403047
0x00403013
0x00403013
0x00403018
0x00403018
0x00402f2c
0x00402f35
0x00402f3b
0x00402f37
0x00402f37
0x00402f37
0x00402f47
0x00402f56
0x00402f63
0x00402fd5
0x00402fdc
0x00402fde
0x00402fe0
0x00402fe2
0x00402fe8
0x00402fec
0x00402fec
0x00402fef
0x00402fef
0x00402fff
0x00403006
0x00403006
0x00402f65
0x00402f65
0x00402f71
0x00402f77
0x00000000
0x00402f79
0x00402f8a
0x00402f8e
0x00402f90
0x00402f90
0x00402fa6
0x00000000
0x00402fbe
0x00402fc0
0x00402fc3
0x00402fce
0x00402fd1
0x00402fd1
0x00402fa6
0x00402f77
0x00402f63
0x00403055
0x004038e7
0x004038e7
0x004038e9
0x004038e9
0x00403675
0x00403677
0x0040367a
0x0040367b
0x0040367e
0x00403681
0x00403684
0x00403686
0x00403687
0x0040379c
0x0040379f
0x004037a1
0x00403894
0x0040389f
0x004038a6
0x004038a8
0x004038ab
0x004038b0
0x004038b1
0x004038b3
0x00000000
0x004038b5
0x004038b5
0x004038bb
0x004038bd
0x004038bd
0x004038c0
0x004038c8
0x004038cf
0x004038da
0x004038da
0x004037a7
0x004037a7
0x004037aa
0x004037ad
0x004037af
0x00000000
0x004037b5
0x004037b5
0x004037bc
0x00403819
0x00403819
0x0040381e
0x00403824
0x00403829
0x0040382a
0x0040382a
0x00403836
0x00403847
0x0040384d
0x0040384d
0x0040384f
0x0040385c
0x00403863
0x00403867
0x00403869
0x0040386f
0x00403871
0x00403873
0x00403873
0x00403851
0x00403851
0x00403855
0x00403855
0x00403878
0x00403878
0x0040387a
0x0040387d
0x00403884
0x00403886
0x0040388a
0x004037be
0x004037be
0x004037c3
0x004037cb
0x00000000
0x00000000
0x004037cd
0x004037cf
0x004037d6
0x00000000
0x004037d8
0x004037dc
0x004037e1
0x004037e2
0x004037e8
0x004037f0
0x004037f6
0x004037fb
0x004037fc
0x00000000
0x004037fc
0x004037f0
0x00000000
0x004037d6
0x00403805
0x00403808
0x0040380b
0x0040380d
0x0040388d
0x0040388d
0x00000000
0x0040380f
0x0040380f
0x00403812
0x00403815
0x00403817
0x00000000
0x00000000
0x00000000
0x00000000
0x00403817
0x0040380d
0x004037bc
0x004037af
0x0040368d
0x00403690
0x00403692
0x0040369c
0x004036a2
0x004036b9
0x004036c5
0x004036cb
0x004036cd
0x004036d4
0x004036d6
0x004036db
0x004036e3
0x00000000
0x00000000
0x004036e5
0x004036e7
0x004036ee
0x00000000
0x004036f0
0x004036f3
0x004036f8
0x004036fe
0x00403706
0x0040370b
0x00403710
0x00000000
0x00403710
0x00403706
0x00000000
0x004036ee
0x00403719
0x00403719
0x00403719
0x0040371e
0x00403721
0x00403723
0x00403726
0x00403729
0x00403734
0x00403736
0x00403739
0x0040373b
0x0040373d
0x00403743
0x00403745
0x00403745
0x0040372b
0x0040372e
0x0040372e
0x0040374a
0x00403750
0x00403754
0x0040375a
0x00403761
0x00403761
0x00403766
0x00403773
0x004036a4
0x004036a4
0x004036aa
0x00403774
0x00403778
0x0040377d
0x0040377f
0x00403781
0x00403789
0x00403790
0x00403795
0x00403795
0x0040379b
0x004036b0
0x004036b0
0x004036b5
0x004036b7
0x00000000
0x00000000
0x00000000
0x00000000
0x004036b7
0x004036aa
0x00403694
0x00403694
0x00403698
0x00403698
0x00403692
0x00403687
0x004035e4
0x004035e4
0x004035e6
0x004035ea
0x004035ed
0x004035ef
0x00403628
0x0040362c
0x0040362d
0x0040362f
0x00403631
0x00403633
0x00403636
0x00403638
0x0040363a
0x0040363f
0x00403641
0x00403643
0x00403649
0x0040364b
0x0040364b
0x00403652
0x00403652
0x00403655
0x00403657
0x00403660
0x00403665
0x00403665
0x00403667
0x00403668
0x00403669
0x0040366a
0x004035f1
0x004035f1
0x004035f8
0x004035fa
0x00403600
0x00403602
0x00403604
0x00403609
0x0040360b
0x0040360d
0x0040360f
0x00403611
0x0040361c
0x00403621
0x00403621
0x00403623
0x00403624
0x00403625
0x004035fc
0x004035fc
0x004035fd
0x004035fe
0x004035fe
0x004035fa
0x004035ef

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f64e1bdb7b35fec48c8f819c790700a65832aa6539ed00bc52fdfc18aab675
Instruction ID: e4c14585aa1b4b2d2bba146c775b8547e7d2cba4f623262dc4b88ac30ef64495
Opcode Fuzzy Hash: 71f64e1bdb7b35fec48c8f819c790700a65832aa6539ed00bc52fdfc18aab675
Instruction Fuzzy Hash: B3B129A27002040BE714AE7D9D8976EBB899BC5326F18827FF104EB3D5DA7CDE458358

Uniqueness

Uniqueness Score: -1.00%

Function 00405EF8, Relevance: 10.6, APIs: 7, Instructions: 132
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EF8(signed char* __eax, void* __ecx, void* __edx, void* __eflags) {
				void* _t49;
				long _t52;
				signed char _t53;
				signed char _t54;
				intOrPtr _t55;
				signed char _t56;
				signed char _t57;
				void* _t73;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t76;

				_t73 = __edx;
				_t74 = __eax;
				_t75 =  *((intOrPtr*)(__eax + 0x10));
				while(1) {
					L1:
					 *_t76 = E004061A8(_t74);
					if( *_t76 != 0 || _t73 == 0) {
						break;
					}
					_t76[1] = 0;
					if(_t75 <= 0) {
						while(1) {
							L17:
							_t53 =  *_t74;
							if(_t53 == 0) {
								goto L1;
							}
							if(_t53 != E00402728(_t74, _t53)) {
								continue;
							} else {
								goto L19;
							}
							do {
								L19:
								_t76[4] = GetTickCount();
								E004060F4(_t74);
								_t55 =  *0x45a8f8; // 0x459604
								 *((intOrPtr*)(_t55 + 0x10))();
								 *_t76 = 0 == 0;
								if(_t73 != 0xffffffff) {
									_t76[8] = GetTickCount();
									if(_t73 <= _t76[8] - _t76[4]) {
										_t73 = 0;
									} else {
										_t73 = _t73 - _t76[8] - _t76[4];
									}
								}
								if( *_t76 == 0) {
									do {
										_t56 =  *_t74;
									} while (_t56 != E00402728(_t74, _t56));
									_t76[1] = 1;
								} else {
									while(1) {
										_t57 =  *_t74;
										if((_t57 & 0x00000001) != 0) {
											goto L29;
										}
										if(_t57 != E00402728(_t74, _t57)) {
											continue;
										}
										_t76[1] = 1;
										goto L29;
									}
								}
								L29:
							} while (_t76[1] == 0);
							if( *_t76 != 0) {
								_t74[8] = GetCurrentThreadId();
								_t74[4] = 1;
							}
							goto L32;
						}
						continue;
					}
					_t76[4] = GetTickCount();
					if(_t75 <= 0) {
						L13:
						if(_t73 == 0xffffffff) {
							goto L17;
						}
						_t76[8] = GetTickCount();
						_t49 = _t76[8] - _t76[4];
						if(_t73 > _t49) {
							_t73 = _t73 - _t49;
							goto L17;
						}
						 *_t76 = 0;
						break;
					} else {
						goto L5;
					}
					do {
						L5:
						if(_t73 == 0xffffffff) {
							L8:
							_t54 =  *_t74;
							if(_t54 > 1) {
								goto L13;
							}
							if(_t54 != 0 || E00402728(_t74, 0) != 0) {
								goto L12;
							} else {
								_t74[8] = GetCurrentThreadId();
								_t74[4] = 1;
								 *_t76 = 1;
								goto L32;
							}
						}
						_t52 = GetTickCount();
						_t46 = _t52 - _t76[4];
						if(_t73 > _t52 - _t76[4]) {
							goto L8;
						} else {
							 *_t76 = 0;
							goto L32;
						}
						L12:
						_t46 = E004061EC(_t46);
						_t75 = _t75 - 1;
					} while (_t75 > 0);
					goto L13;
				}
				L32:
				return  *_t76 & 0x000000ff;
			}

0x00405eff
0x00405f01
0x00405f03
0x00405f06
0x00405f06
0x00405f0d
0x00405f14
0x00000000
0x00000000
0x00405f22
0x00405f29
0x00405fbb
0x00405fbb
0x00405fbb
0x00405fbf
0x00000000
0x00000000
0x00405fd3
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fd5
0x00405fd5
0x00405fda
0x00405fe0
0x00405fe7
0x00405ff1
0x00405ff6
0x00405ffd
0x00406004
0x00406012
0x00406020
0x00406014
0x0040601c
0x0040601c
0x00406012
0x00406026
0x0040604b
0x0040604b
0x0040605b
0x0040605f
0x00000000
0x00406028
0x00406028
0x0040602d
0x00000000
0x00000000
0x00406042
0x00000000
0x00000000
0x00406044
0x00000000
0x00406044
0x00406028
0x00406064
0x00406064
0x00406073
0x0040607a
0x0040607d
0x0040607d
0x00000000
0x00406073
0x00000000
0x00405fbb
0x00405f34
0x00405f3a
0x00405f96
0x00405f99
0x00000000
0x00000000
0x00405fa0
0x00405fa8
0x00405fae
0x00405fb9
0x00000000
0x00405fb9
0x00405fb0
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f3c
0x00405f3c
0x00405f3f
0x00405f57
0x00405f57
0x00405f5c
0x00000000
0x00000000
0x00405f60
0x00000000
0x00405f74
0x00405f79
0x00405f7c
0x00405f83
0x00000000
0x00405f83
0x00405f60
0x00405f41
0x00405f46
0x00405f4c
0x00000000
0x00405f4e
0x00405f4e
0x00000000
0x00405f4e
0x00405f8c
0x00405f8c
0x00405f91
0x00405f92
0x00000000
0x00405f3c
0x00406084
0x0040608f

APIs

Part of subcall function 004061A8: GetCurrentThreadId.KERNEL32 ref: 004061AB

GetTickCount.KERNEL32 ref: 00405F2F
GetTickCount.KERNEL32 ref: 00405F41
GetCurrentThreadId.KERNEL32 ref: 00405F74
GetTickCount.KERNEL32 ref: 00405F9B
GetTickCount.KERNEL32 ref: 00405FD5
GetTickCount.KERNEL32 ref: 00405FFF
GetCurrentThreadId.KERNEL32 ref: 00406075

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: a3fd0ef106ea169b9eff3737405d017d7e5f6036ff05cd25cbde7a97f5fef50f
Instruction ID: 320e11e1895484dd97853e33e3acf9542b869253ecd946187445273afc1e67d8
Opcode Fuzzy Hash: a3fd0ef106ea169b9eff3737405d017d7e5f6036ff05cd25cbde7a97f5fef50f
Instruction Fuzzy Hash: CB4181316087429ED720EB79C58432F7AD19B80354F16853FE8D9A73C2DABDC895871A

Uniqueness

Uniqueness Score: -1.00%

Function 00405D34, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00405D34(void* __edx) {
				intOrPtr _v8;
				char _v12;
				char* _t20;
				intOrPtr _t26;
				signed int _t32;
				intOrPtr _t40;
				void* _t42;
				void* _t44;
				intOrPtr _t45;

				_t42 = _t44;
				_t45 = _t44 + 0xfffffff8;
				_v12 = 0;
				if(GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLogicalProcessorInformation") == 0) {
					L10:
					_t32 = 0x40;
					goto L11;
				} else {
					_t20 =  &_v12;
					_push(_t20);
					_push(0);
					L00402934();
					if(_t20 != 0 || GetLastError() != 0x7a) {
						goto L10;
					} else {
						_v8 = E004044CC(_v12);
						_push(_t42);
						_push(E00405DE0);
						_push( *[fs:edx]);
						 *[fs:edx] = _t45;
						_push( &_v12);
						_push(_v8);
						L00402934();
						_t26 = _v8;
						if(_v12 <= 0) {
							L8:
							_pop(_t40);
							 *[fs:eax] = _t40;
							_push(0x405de7);
							return E004044E8(_v8);
						} else {
							while( *((short*)(_t26 + 4)) != 2 ||  *((char*)(_t26 + 8)) != 1) {
								_t26 = _t26 + 0x18;
								_v12 = _v12 - 0x18;
								if(_v12 > 0) {
									continue;
								} else {
									goto L8;
								}
								goto L12;
							}
							_t32 =  *(_t26 + 0xa) & 0x0000ffff;
							E00406840();
							L11:
							return _t32;
						}
					}
				}
				L12:
			}

0x00405d35
0x00405d37
0x00405d3d
0x00405d57
0x00405de7
0x00405de7
0x00000000
0x00405d5d
0x00405d5d
0x00405d60
0x00405d61
0x00405d63
0x00405d6a
0x00000000
0x00405d76
0x00405d7e
0x00405d83
0x00405d84
0x00405d89
0x00405d8c
0x00405d92
0x00405d96
0x00405d97
0x00405d9c
0x00405da3
0x00405dca
0x00405dcc
0x00405dcf
0x00405dd2
0x00405ddf
0x00405da5
0x00405da5
0x00405dbd
0x00405dc0
0x00405dc8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dc8
0x00405db2
0x00405db6
0x00405dec
0x00405df2
0x00405df2
0x00405da3
0x00405d6a
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00405D4A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00405D50
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00405D6C

Strings

GetLogicalProcessorInformation, xrefs: 00405D40
kernel32.dll, xrefs: 00405D45

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-812649623
Opcode ID: 863bfcf51d35678c1c5c5690424457cf11f5a1c675e92d83d0228cc1c1c2ec53
Instruction ID: 98032b134372ad5d4df392febb5cee6dd9eab7165ad31d4e0d4e7c156c70a6a6
Opcode Fuzzy Hash: 863bfcf51d35678c1c5c5690424457cf11f5a1c675e92d83d0228cc1c1c2ec53
Instruction Fuzzy Hash: 08118471904644AEEF50FBA1C94AB9FB7A9EF40314F21807BE404B66C1D67C9A80CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 004094A8, Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004094A8(signed short __eax, void* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				short _v22;
				short _v24;
				char _v26;
				char _v32;
				void* __ebp;
				void* _t39;
				void* _t55;
				void* _t59;
				short* _t62;
				signed short _t66;
				void* _t67;
				void* _t68;
				signed short _t79;
				void* _t81;

				_t81 = __edx;
				_t66 = __eax;
				_v16 = 0;
				if(__eax !=  *0x45cb80()) {
					_v16 = E00409464( &_v8);
					_t79 = _t66;
					_v20 = 3;
					_t62 =  &_v26;
					do {
						 *_t62 =  *(0xf + "0123456789ABCDEF") & 0x000000ff;
						_t79 = (_t79 & 0x0000ffff) >> 4;
						_v20 = _v20 - 1;
						_t62 = _t62 - 2;
					} while (_v20 != 0xffffffff);
					_v24 = 0;
					_v22 = 0;
					 *0x45cb7c(4,  &_v32,  &_v20);
				}
				_t39 = E00409464( &_v12);
				_t67 = _t39;
				if(_t67 != 0) {
					_t55 = _v12 - 2;
					if(_t55 >= 0) {
						_t59 = _t55 + 1;
						_v20 = 0;
						do {
							if( *((short*)(_t67 + _v20 * 2)) == 0) {
								 *((short*)(_t67 + _v20 * 2)) = 0x2c;
							}
							_v20 = _v20 + 1;
							_t59 = _t59 - 1;
						} while (_t59 != 0);
					}
					E00407C00(_t81, _t67);
					_t39 = E004044E8(_t67);
				}
				if(_v16 != 0) {
					 *0x45cb7c(0, 0,  &_v20);
					_t68 = E00409464( &_v12);
					if(_v8 != _v12 || E00409440(_v16, _v12, _t68) != 0) {
						 *0x45cb7c(8, _v16,  &_v20);
					}
					E004044E8(_t68);
					return E004044E8(_v16);
				}
				return _t39;
			}

0x004094b0
0x004094b2
0x004094b6
0x004094c2
0x004094cc
0x004094cf
0x004094d1
0x004094d8
0x004094db
0x004094ec
0x004094f2
0x004094f5
0x004094f8
0x004094fb
0x00409501
0x00409507
0x00409517
0x00409517
0x00409520
0x00409525
0x00409529
0x0040952e
0x00409533
0x00409535
0x00409536
0x0040953d
0x00409545
0x0040954a
0x0040954a
0x00409550
0x00409553
0x00409553
0x0040953d
0x0040955a
0x00409561
0x00409561
0x0040956a
0x00409574
0x00409582
0x0040958a
0x004095a7
0x004095a7
0x004095af
0x00000000
0x004095b7
0x004095c1

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 004094B9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00409517
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00409574
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 004095A7

Part of subcall function 00409464: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00409525), ref: 0040947B
Part of subcall function 00409464: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00409525), ref: 00409498

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 6e253d593cab2408df00f34a80740f2092f01fe665a3f9e6f890c95ae601fce8
Instruction ID: 45a3101d14276a2a49cfc5000a3c3cf8a7f72fed558edd49c2bc7541cdcef5fc
Opcode Fuzzy Hash: 6e253d593cab2408df00f34a80740f2092f01fe665a3f9e6f890c95ae601fce8
Instruction Fuzzy Hash: E2313071A0021AABDF10EFAADC856AEB3B8EF04304F40417AE515E72D2D7789E05CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040641E, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040641E(void* __ebx, void* __edi, void* __esi, void* __ebp, struct _EXCEPTION_POINTERS _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v44;
				struct _EXCEPTION_RECORD* _t31;
				long _t34;
				long _t35;
				struct _EXCEPTION_RECORD* _t36;
				intOrPtr* _t38;
				long _t42;
				long _t44;
				long _t45;
				void* _t46;
				intOrPtr* _t47;
				void* _t51;
				long _t52;
				void* _t55;
				intOrPtr _t57;
				long* _t58;
				long _t64;
				intOrPtr* _t67;
				intOrPtr* _t69;
				void* _t70;
				long _t72;
				long _t73;
				void* _t75;
				long* _t76;
				void* _t78;
				long _t79;
				intOrPtr _t82;

				_t78 = __ebp;
				_t75 = __esi;
				_t70 = __edi;
				_t51 = __ebx;
				_t31 = _a4.ExceptionRecord;
				if((_t31->ExceptionFlags & 0x00000006) == 0) {
					if(_t31->ExceptionCode == 0xeedfade) {
						_t34 =  *(_t31->ExceptionInformation[1]);
						goto L6;
					} else {
						asm("cld");
						E004055E8(_t31);
						_t69 =  *0x45a010; // 0x0
						if(_t69 != 0) {
							_t34 =  *_t69();
							if(_t34 != 0) {
								L6:
								_push(_t51);
								_push(_t75);
								_push(_t70);
								_push(_t78);
								_t57 =  *((intOrPtr*)(_a8 + 4));
								_t52 =  *(_t57 + 5);
								_t9 = _t57 + 9; // 0xf
								_t76 = _t9;
								_t79 = _t34;
								while(1) {
									L7:
									_t35 =  *_t76;
									__eflags = _t35;
									if(_t35 == 0) {
										break;
									}
									_t72 = _t79;
									while(1) {
										_t46 =  *_t35;
										__eflags = _t46 - _t72;
										if(_t46 == _t72) {
											goto L17;
										}
										__eflags =  *((intOrPtr*)(_t46 - 0x34)) -  *((intOrPtr*)(_t72 - 0x34));
										if( *((intOrPtr*)(_t46 - 0x34)) !=  *((intOrPtr*)(_t72 - 0x34))) {
											L14:
											_t73 =  *(_t72 - 0x30);
											_t35 =  *_t76;
											__eflags = _t73;
											if(_t73 != 0) {
												_t72 =  *_t73;
												continue;
											} else {
												_t76 =  &(_t76[2]);
												_t52 = _t52 - 1;
												__eflags = _t52;
												if(_t52 != 0) {
													goto L7;
												} else {
												}
											}
										} else {
											_t47 =  *((intOrPtr*)(_t46 - 0x38));
											_t67 =  *((intOrPtr*)(_t72 - 0x38));
											_t62 =  *_t47;
											__eflags =  *_t47 -  *_t67;
											if( *_t47 !=  *_t67) {
												goto L14;
											} else {
												__eflags = _t67 + 1;
												E0040759C(_t47 + 1, _t62, _t67 + 1);
												if(__eflags == 0) {
													goto L17;
												} else {
													goto L14;
												}
											}
										}
										goto L26;
									}
									break;
								}
								L17:
								_t36 = _a4.ExceptionRecord;
								__eflags = _t36->ExceptionCode - 0xeedfade;
								_t64 = _t36->ExceptionInformation[1];
								_t58 = _t36->ExceptionInformation;
								if(_t36->ExceptionCode == 0xeedfade) {
									__eflags =  *0x45802d - 1;
									if( *0x45802d <= 1) {
										goto L25;
									}
									__eflags =  *0x45802c;
									if( *0x45802c > 0) {
										goto L25;
									}
									_t42 = UnhandledExceptionFilter( &_a4);
									__eflags = _t42;
									_t58 = _t58;
									_t64 = _t64;
									_t36 = _t36;
									if(_t42 != 0) {
										goto L25;
									}
								} else {
									_t44 = E0040620C( *0x45a014(), _a12);
									__eflags =  *0x45802d;
									if( *0x45802d <= 0) {
										L21:
										_t64 = _t44;
										_t36 = _a4.ExceptionRecord;
										_t58 = _t36->ExceptionAddress;
										L25:
										_t36->ExceptionFlags = _t36->ExceptionFlags | 0x00000002;
										 *0x45a01c(_a8, 0x406554, _t36, 0, _t76, _t58, _t64, _t36,  *[fs:ebx]);
										_pop(_t55);
										_t38 = E0040AA20();
										_push( *_t38);
										 *_t38 = _t82;
										 *((intOrPtr*)(_v8 + 4)) = E00406580;
										E00406248(_v44, _t55, _t76);
										goto ( *((intOrPtr*)(_t55 + 4)));
									}
									__eflags =  *0x45802c;
									if( *0x45802c > 0) {
										goto L21;
									}
									_t45 = UnhandledExceptionFilter( &_a4);
									__eflags = _t45;
									_t44 = _t44;
									if(_t45 != 0) {
										goto L21;
									}
								}
							} else {
							}
						}
					}
				}
				L26:
				return 1;
			}

0x0040641e
0x0040641e
0x0040641e
0x0040641e
0x00406420
0x0040642b
0x00406437
0x0040645b
0x00000000
0x00406439
0x00406439
0x0040643a
0x0040643f
0x00406447
0x0040644d
0x00406451
0x0040645d
0x00406461
0x00406462
0x00406463
0x00406464
0x00406465
0x00406468
0x0040646b
0x0040646b
0x0040646e
0x00406470
0x00406470
0x00406470
0x00406472
0x00406474
0x00000000
0x00000000
0x00406476
0x0040647c
0x0040647c
0x0040647e
0x00406480
0x00000000
0x00000000
0x00406485
0x00406488
0x004064a1
0x004064a1
0x004064a4
0x004064a6
0x004064a8
0x0040647a
0x00000000
0x004064aa
0x004064aa
0x004064ad
0x004064ad
0x004064ae
0x00000000
0x004064b0
0x004064b3
0x004064ae
0x0040648a
0x0040648a
0x0040648d
0x00406492
0x00406494
0x00406496
0x00000000
0x00406498
0x00406499
0x0040649a
0x0040649f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040649f
0x00406496
0x00000000
0x00406488
0x00000000
0x0040647c
0x004064b9
0x004064b9
0x004064bd
0x004064c3
0x004064c6
0x004064c9
0x0040650c
0x00406513
0x00000000
0x00000000
0x00406515
0x0040651c
0x00000000
0x00000000
0x00406526
0x0040652b
0x0040652e
0x0040652f
0x00406530
0x00406531
0x00000000
0x00000000
0x004064cb
0x004064d5
0x004064da
0x004064e1
0x00406501
0x00406501
0x00406503
0x00406507
0x00406533
0x00406540
0x0040654e
0x00406554
0x00406559
0x0040655e
0x00406564
0x0040656d
0x00406578
0x0040657d
0x0040657d
0x004064e3
0x004064ea
0x00000000
0x00000000
0x004064f2
0x004064f7
0x004064fa
0x004064fb
0x00000000
0x00000000
0x004064fb
0x00000000
0x00406453
0x00406451
0x00406447
0x00406437
0x004065a0
0x004065a5

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 004064F2

Strings

'@, xrefs: 0040654E

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: '@
API String ID: 3192549508-1210607465
Opcode ID: 14a5f145026a9e8308c0aea04e3a8ceea458f2e6719b8d6534c032ee58cb043c
Instruction ID: d9945ef524c90c6bd9f30337c6b4db501bb7818b994dcb4b19a5ad409a67f04d
Opcode Fuzzy Hash: 14a5f145026a9e8308c0aea04e3a8ceea458f2e6719b8d6534c032ee58cb043c
Instruction Fuzzy Hash: 8E419E70204200AFD720DF14EC84B6BB7A5EB84714F16857AE446A73D2D738EC61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00405CA5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00405CA5(void* __ebx, void* __edi, void* __esi, void* __ebp, struct _EXCEPTION_POINTERS _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				struct _EXCEPTION_RECORD* _t22;
				intOrPtr* _t25;
				long _t28;
				long _t30;
				long _t31;
				long _t32;
				void* _t33;
				void* _t38;
				long _t41;
				intOrPtr* _t43;
				intOrPtr _t44;
				void* _t45;
				void* _t47;
				void* _t48;
				intOrPtr _t50;

				_t48 = __ebp;
				_t47 = __esi;
				_t45 = __edi;
				_t33 = __ebx;
				_t22 = _a4.ExceptionRecord;
				if((_t22->ExceptionFlags & 0x00000006) == 0) {
					_t41 = _t22->ExceptionInformation[1];
					_t38 = _t22->ExceptionInformation;
					if(_t22->ExceptionCode == 0xeedfade) {
						L11:
						if( *0x45802d <= 1 ||  *0x45802c > 0) {
							goto L14;
						}
						_t28 = UnhandledExceptionFilter( &_a4);
						_t38 = _t38;
						_t41 = _t41;
						_t22 = _t22;
						if(_t28 != 0) {
							goto L14;
						}
					} else {
						asm("cld");
						E004055E8(_t22);
						_t43 =  *0x45a014; // 0x0
						if(_t43 != 0) {
							_t30 =  *_t43();
							if(_t30 != 0) {
								_t44 = _a12;
								if(_a4.ExceptionRecord->ExceptionCode == 0xeefface) {
									L10:
									_t41 = _t30;
									_t22 = _a4.ExceptionRecord;
									_t38 = _t22->ExceptionAddress;
									goto L11;
								} else {
									_t30 = E0040620C(_t30, _t44);
									if( *0x45802d <= 0 ||  *0x45802c > 0) {
										goto L10;
									} else {
										_t31 = UnhandledExceptionFilter( &_a4);
										_t32 = _t30;
										if(_t31 != 0) {
											_t41 = _t32;
											_t22 = _a4.ExceptionRecord;
											_t38 = _t22->ExceptionAddress;
											L14:
											_t22->ExceptionFlags = _t22->ExceptionFlags | 0x00000002;
											 *0x45a01c(_a8, 0x4063cc, _t22, 0, _t38, _t41, _t22,  *[fs:ebx], _t48, _t45, _t47, _t33);
											_t46 = _v8;
											_t25 = E0040AA20();
											_push( *_t25);
											 *_t25 = _t50;
											 *((intOrPtr*)(_v8 + 4)) = E004063F8;
											E0040625C(_t25,  *((intOrPtr*)(_t46 + 4)) + 5);
											goto __ebx;
										}
									}
								}
							}
						}
					}
				}
				return 1;
			}

0x00405ca5
0x00405ca5
0x00405ca5
0x00405ca5
0x004062f4
0x004062ff
0x0040630b
0x0040630e
0x00406311
0x00406381
0x00406388
0x00000000
0x00000000
0x0040639b
0x004063a3
0x004063a4
0x004063a5
0x004063a6
0x00000000
0x00000000
0x00406313
0x00406313
0x00406314
0x00406319
0x00406321
0x00406327
0x0040632b
0x00406331
0x0040633f
0x00406378
0x00406378
0x0040637a
0x0040637e
0x00000000
0x00406341
0x00406341
0x0040634d
0x00000000
0x00406358
0x0040635e
0x00406366
0x00406367
0x0040636d
0x0040636f
0x00406373
0x004063a8
0x004063a8
0x004063c6
0x004063cc
0x004063d0
0x004063d5
0x004063db
0x004063e7
0x004063f1
0x004063f6
0x004063f6
0x00406367
0x0040634d
0x0040633f
0x0040632b
0x00406321
0x00406311
0x0040641d

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 0040635E
UnhandledExceptionFilter.KERNEL32(?,?,?,?), ref: 0040639B

Strings

'@, xrefs: 004063C6

Memory Dump Source

Source File: 00000004.00000002.402849297.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.402832526.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.402874922.0000000000412000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402934833.000000000045E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402950145.0000000000461000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.402985294.0000000000463000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403007918.0000000000472000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.403677906.000000000068F000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_detection.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: '@
API String ID: 3192549508-1210607465
Opcode ID: 04b40ad9b2f2c5d806417b637208c4494d4b728bbd3315b03ed6050750cd16cf
Instruction ID: 4f091763deb142c0f653f44d50732f5a11c5928c85bd7cd2ea70200cac19ae9c
Opcode Fuzzy Hash: 04b40ad9b2f2c5d806417b637208c4494d4b728bbd3315b03ed6050750cd16cf
Instruction Fuzzy Hash: A23180B0604300AFD724DB14C884F6B77A5EB84714F16C57EE80AA72D2CB78EC61DB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: curl_x64.exe PID: 5968 Parent PID: 5556 curl_x64.exeCOMMON

Executed Functions

Function 0040D4E9, Relevance: 92.7, APIs: 1, Strings: 60, Instructions: 1152COMMON

Download Yara Rule

Strings

CURLOPT_PROTOCOLS, xrefs: 0040DB22
CURLOPT_SSL_SESSIONID_CACHE, xrefs: 0040D8E2
CURLOPT_GSSAPI_DELEGATION, xrefs: 0040DD66
CURLOPT_REDIR_PROTOCOLS, xrefs: 0040DB65
CURLOPT_EXPECT_100_TIMEOUT_MS, xrefs: 0040DF30
CURLOPT_MAIL_AUTH, xrefs: 0040DDEE
CURLOPT_TLSAUTH_TYPE, xrefs: 0040DD31
Throwing away %I64d bytes, xrefs: 0040E226
http, xrefs: 0040E12F, 0040E2E8
Metalink: fetching (%s) from (%s) FAILED (HTTP status code %d), xrefs: 0040E347
%s%s, xrefs: 0040EAAA
CURLOPT_LOCALPORTRANGE, xrefs: 0040D87D
CURLOPT_FTP_ALTERNATIVE_TO_USER, xrefs: 0040D8AE
CURLOPT_FTP_SKIP_PASV_IP, xrefs: 0040D7E3
^, xrefs: 0040EB5E
Metalink: fetching (%s) from (%s) FAILED (%s), xrefs: 0040E398
CURLOPT_MAIL_FROM, xrefs: 0040DA86
CURLOPT_HTTP_TRANSFER_DECODING, xrefs: 0040D942
CURLOPT_PROXY_SERVICE_NAME, xrefs: 0040D715
CURLOPT_SSL_ENABLE_NPN, xrefs: 0040DE52
CURLOPT_DEFAULT_PROTOCOL, xrefs: 0040DEF7
CURLOPT_SERVICE_NAME, xrefs: 0040D74C
CURLOPT_HEADERDATA, xrefs: 0040DC0F
CURLOPT_SOCKS5_GSSAPI_NEC, xrefs: 0040D6DE
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like, xrefs: 0040EA9C
CURLOPT_TLSAUTH_PASSWORD, xrefs: 0040DCFA
@`L, xrefs: 0040DCA0
CURLOPT_FTP_FILEMETHOD, xrefs: 0040D817
CURLOPT_TLSAUTH_USERNAME, xrefs: 0040DCC3
curl: Saved to filename '%s', xrefs: 0040E051
CURLOPT_LOCALPORT, xrefs: 0040D850
CURLOPT_IGNORE_CONTENT_LENGTH, xrefs: 0040D7AD
CURLOPT_IPRESOLVE, xrefs: 0040D52C, 0040D561, 0040D595
Transient problem: %s Will retry in %ld seconds. %ld retries left., xrefs: 0040E1BD
CURLOPT_RESOLVE, xrefs: 0040DC46
CURLOPT_HTTP_CONTENT_DECODING, xrefs: 0040D917
', xrefs: 0040DDFD
CURLOPT_USE_SSL, xrefs: 0040D5D1, 0040D61B, 0040D65D
CURLOPT_FTP_ACCOUNT, xrefs: 0040D779
CURLOPT_SASL_IR, xrefs: 0040DE1E
curl: (%d) %s, xrefs: 0040EA80
failed to truncate, exiting, xrefs: 0040E28E
CURLOPT_MAIL_RCPT, xrefs: 0040DAB8
Error setting extended attributes: %s, xrefs: 0040EB13
CURLOPT_TCP_KEEPINTVL, xrefs: 0040D9E5
CURLOPT_FTP_SSL_CCC, xrefs: 0040D69D
CURLOPT_HEADERFUNCTION, xrefs: 0040DBBD
CURLOPT_SSL_ENABLE_ALPN, xrefs: 0040DE87
CURLOPT_TFTP_BLKSIZE, xrefs: 0040DA4F
CURLOPT_TCP_KEEPIDLE, xrefs: 0040D9B8
CURLOPT_FTP_USE_PRET, xrefs: 0040DAE6
CURLOPT_UNIX_SOCKET_PATH, xrefs: 0040DEC3
More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate , xrefs: 0040EAA3
CURLOPT_SSL_OPTIONS, xrefs: 0040DDB6
CURLOPT_MAXFILESIZE_LARGE, xrefs: 0040D4FA
(%d) Failed writing body, xrefs: 0040EB54
CURLOPT_CONNECT_TO, xrefs: 0040DC79
CURLOPT_TFTP_NO_OPTIONS, xrefs: 0040DF68
CURLOPT_TCP_KEEPALIVE, xrefs: 0040D97B, 0040DA15
Metalink: fetching (%s) from (%s) OK, xrefs: 0040E426

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: %s%s$(%d) Failed writing body$@`L$CURLOPT_CONNECT_TO$CURLOPT_DEFAULT_PROTOCOL$CURLOPT_EXPECT_100_TIMEOUT_MS$CURLOPT_FTP_ACCOUNT$CURLOPT_FTP_ALTERNATIVE_TO_USER$CURLOPT_FTP_FILEMETHOD$CURLOPT_FTP_SKIP_PASV_IP$CURLOPT_FTP_SSL_CCC$CURLOPT_FTP_USE_PRET$CURLOPT_GSSAPI_DELEGATION$CURLOPT_HEADERDATA$CURLOPT_HEADERFUNCTION$CURLOPT_HTTP_CONTENT_DECODING$CURLOPT_HTTP_TRANSFER_DECODING$CURLOPT_IGNORE_CONTENT_LENGTH$CURLOPT_IPRESOLVE$CURLOPT_LOCALPORT$CURLOPT_LOCALPORTRANGE$CURLOPT_MAIL_AUTH$CURLOPT_MAIL_FROM$CURLOPT_MAIL_RCPT$CURLOPT_MAXFILESIZE_LARGE$CURLOPT_PROTOCOLS$CURLOPT_PROXY_SERVICE_NAME$CURLOPT_REDIR_PROTOCOLS$CURLOPT_RESOLVE$CURLOPT_SASL_IR$CURLOPT_SERVICE_NAME$CURLOPT_SOCKS5_GSSAPI_NEC$CURLOPT_SSL_ENABLE_ALPN$CURLOPT_SSL_ENABLE_NPN$CURLOPT_SSL_OPTIONS$CURLOPT_SSL_SESSIONID_CACHE$CURLOPT_TCP_KEEPALIVE$CURLOPT_TCP_KEEPIDLE$CURLOPT_TCP_KEEPINTVL$CURLOPT_TFTP_BLKSIZE$CURLOPT_TFTP_NO_OPTIONS$CURLOPT_TLSAUTH_PASSWORD$CURLOPT_TLSAUTH_TYPE$CURLOPT_TLSAUTH_USERNAME$CURLOPT_UNIX_SOCKET_PATH$CURLOPT_USE_SSL$Error setting extended attributes: %s$If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like$Metalink: fetching (%s) from (%s) FAILED (%s)$Metalink: fetching (%s) from (%s) FAILED (HTTP status code %d)$Metalink: fetching (%s) from (%s) OK$More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate $Throwing away %I64d bytes$Transient problem: %s Will retry in %ld seconds. %ld retries left.$curl: (%d) %s$curl: Saved to filename '%s'$failed to truncate, exiting$http$^$'
API String ID: 0-2543072273
Opcode ID: 5529bc182b7da6ad1b8dc8b5bea0c283b6cc53f1644420080a1c34297545c681
Instruction ID: 21937a47350052fe6363d520302cc8fa78568f0ffb025e04b0ac014b9d5224f6
Opcode Fuzzy Hash: 5529bc182b7da6ad1b8dc8b5bea0c283b6cc53f1644420080a1c34297545c681
Instruction Fuzzy Hash: A4A28E7170878086DB64CB67E44479B77A4FB88784F04052BEF89A77A9DB3CC946CB09

Uniqueness

Uniqueness Score: -1.00%

Function 0046D1D0, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultLCID.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046396C), ref: 0046D25B
EnumSystemLocalesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046396C), ref: 0046D419
GetUserDefaultLangID.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046396C), ref: 0046D474
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046396C), ref: 0046D4E0
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046396C), ref: 0046D50B
IsValidCodePage.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046396C), ref: 0046D533
IsValidLocale.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046396C), ref: 0046D54C
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046396C), ref: 0046D5C2
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046396C), ref: 0046D5E5

Strings

OCP, xrefs: 0046D4B8
ACP, xrefs: 0046D4A5

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Locale$Info$DefaultUserValid$CodeEnumLangLocalesPageSystem
String ID: ACP$OCP
API String ID: 4167469521-711371036
Opcode ID: 90aca2ada9d41e04dc76a7d4600a8a0d2b031e80dbb9359b5e3a9eba5e97c041
Instruction ID: 89255832a6a225acc97a27ebe2910fe0d72484697f73d6251c56c13e74966a2f
Opcode Fuzzy Hash: 90aca2ada9d41e04dc76a7d4600a8a0d2b031e80dbb9359b5e3a9eba5e97c041
Instruction Fuzzy Hash: 76B189B1F05B4086EB60CF12E944B6A33A4F744B84F58412ADB8987B64FF7CD985C70A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C2E0, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(?,?,?,?,?,?,00418E28,?,?,?,?,0042FAA9), ref: 0042C2FF
GetProcAddress.KERNEL32(?,?,?,?,?,?,00418E28,?,?,?,?,0042FAA9), ref: 0042C330

Strings

AddDllDirectory, xrefs: 0042C37B
kernel32, xrefs: 0042C2F1
LoadLibraryExA, xrefs: 0042C321

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 1646373207-3327535076
Opcode ID: 75d95d9e1ef5d731eed0b49f35cadfd7614023738d8931bdcf1cb98430b2f29a
Instruction ID: 0918accc6cb6d2e12088cb3c840581236fffc5715161b03d456abdf7b6bcb5f3
Opcode Fuzzy Hash: 75d95d9e1ef5d731eed0b49f35cadfd7614023738d8931bdcf1cb98430b2f29a
Instruction Fuzzy Hash: 8341C365705A9085DA14DF26B85032E7360FB89FE4F9C4625EE6E47BA8EF7CC405C708

Uniqueness

Uniqueness Score: -1.00%

Function 00464730, Relevance: 9.1, APIs: 6, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0046473E
HeapAlloc.KERNEL32 ref: 0046474F
GetVersionExA.KERNEL32 ref: 00464770

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Heap$AllocProcessVersion
String ID:
API String ID: 3730437025-0
Opcode ID: d755c3607a27c761b8ec831016487170296bc1da3fa8a8d476f5fa12b9b45c7a
Instruction ID: b4441600fceb0865e0b1e12c86e58dc29905e94a58f157920d75ed8d958f895d
Opcode Fuzzy Hash: d755c3607a27c761b8ec831016487170296bc1da3fa8a8d476f5fa12b9b45c7a
Instruction Fuzzy Hash: 173149BA60574087FB54EF66E84072A73A5BB85B85F44406ADB0987361FBBCC844CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 00463850, Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

English_United States.1252, xrefs: 00463913
English_United States.1252, xrefs: 004638D7

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: English_United States.1252$English_United States.1252
API String ID: 0-3610643126
Opcode ID: 71d3fd5140f11c6d3feabbd69dfa5123e4962ecbde24ddef2f7bafdcfe608574
Instruction ID: 575f30fa8187724f45dea64bbe663b12c31ad213965e905c71c7e0617e01a979
Opcode Fuzzy Hash: 71d3fd5140f11c6d3feabbd69dfa5123e4962ecbde24ddef2f7bafdcfe608574
Instruction Fuzzy Hash: 9551E9A16087C185EB21CF66A4103BB77A0F756789F488017EEDA53715FB3CCA09C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00427A30, Relevance: 1.6, APIs: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00427B2F

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 9acf59ad7c39a43b3af5afe6d0c4ba5654e2f16b7294665b94318116609b09fd
Instruction ID: 436a8884f2c7b4bbc5f9e3cfb9331bfd6939499af379b40f0f21ffba31ba4c44
Opcode Fuzzy Hash: 9acf59ad7c39a43b3af5afe6d0c4ba5654e2f16b7294665b94318116609b09fd
Instruction Fuzzy Hash: C121A036305E9092C7948F55B9A47DA7760F708BA8FA8133ADF59077A8CF38E460C314

Uniqueness

Uniqueness Score: -1.00%

Function 00425170, Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: 1c912f1128a623c9007abc0841340ae11f9c59ea0b79cae281a3fe5e646b25af
Instruction ID: 904c673a2e8d09cb7cfff9bd8ed88d75672d7972fc047c65c6a8b002c88ab47e
Opcode Fuzzy Hash: 1c912f1128a623c9007abc0841340ae11f9c59ea0b79cae281a3fe5e646b25af
Instruction Fuzzy Hash: 4DA1B136305F9082DB248F1AF44436A7365FB85B98FA48217DF6A97795DB3CC845C708

Uniqueness

Uniqueness Score: -1.00%

Function 00425562, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752a5ef40430fc721eb8dd3cc7e6b5c2b1bef61e62a4d4767349bfc46ee64a49
Instruction ID: d39571d9d016bfee2ccdbcc0e4b687b3c0616f6889c26443bea1a9a1bd195a17
Opcode Fuzzy Hash: 752a5ef40430fc721eb8dd3cc7e6b5c2b1bef61e62a4d4767349bfc46ee64a49
Instruction Fuzzy Hash: BF41C266711F9082DB158F2DE41476A7360FB95BA8FD49603CE6E533A5EA3DC846C30C

Uniqueness

Uniqueness Score: -1.00%

Function 004255A7, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dcbf5b0611664db341e6f8fa95ca532a0405b2ec4805990c8d56426f62f6a42
Instruction ID: a6f127e405681484034e4f136de57cc87cd5650d8cc517fc711fafa4023a585e
Opcode Fuzzy Hash: 9dcbf5b0611664db341e6f8fa95ca532a0405b2ec4805990c8d56426f62f6a42
Instruction Fuzzy Hash: 2941D066711F9481DB158F2AE0507AA7360FB45B98FD995038F6E533A5EA3DC806C30C

Uniqueness

Uniqueness Score: -1.00%

Function 0042553C, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15cf6ff6068f1aefd8cde0f4797e900675a2961aea8ffb5410dc77bf10ba7701
Instruction ID: 72d64ef69885ab0381db91847118acb8c57dabcc9e5ec4491b99c3c93682961e
Opcode Fuzzy Hash: 15cf6ff6068f1aefd8cde0f4797e900675a2961aea8ffb5410dc77bf10ba7701
Instruction Fuzzy Hash: 5F41B166711B9481DB168F2DE0543AA7360FB45B9CFD89513CE6E633A5EA3DC446C308

Uniqueness

Uniqueness Score: -1.00%

Function 004254E8, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fb97d080116a169e993e2439b1b7c44de214b4b17218f158e01b01894c0399
Instruction ID: df915c0c4f188fb9fa57c91e7582e3c633ea01054f8a00ed88f8f181cccb51fb
Opcode Fuzzy Hash: 43fb97d080116a169e993e2439b1b7c44de214b4b17218f158e01b01894c0399
Instruction Fuzzy Hash: BD41C066711B9081DB158F2AE05036A7360FB85B9CFD895038E6E633A5EA3DC406C30C

Uniqueness

Uniqueness Score: -1.00%

Function 00425504, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f861acb9317bb493e4f576a32fc0fb29d9c3f51f18b0681e9dca0dbc18f23c85
Instruction ID: d416542698e13315e08cf00a212c864cc0212cfad46da8b7b7e50194133755b5
Opcode Fuzzy Hash: f861acb9317bb493e4f576a32fc0fb29d9c3f51f18b0681e9dca0dbc18f23c85
Instruction Fuzzy Hash: 4B41C066715B9081DB158F2EE0503AAB360FB85B9CFD895038F6E633A5EA3DC406C30C

Uniqueness

Uniqueness Score: -1.00%

Function 00425520, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32df73e087ec483995843cd37685e30cbe115a3ad390cb11fd28c9124aeff41c
Instruction ID: ddc2cbc0ffc55b3fc824dcd6efd17f85c35613fa138c7e01f101e7c66a756410
Opcode Fuzzy Hash: 32df73e087ec483995843cd37685e30cbe115a3ad390cb11fd28c9124aeff41c
Instruction Fuzzy Hash: D641C066715B9481DB158F2AE0503AA7360FB85B9CFD895038E6E633A5EA3DC406C30C

Uniqueness

Uniqueness Score: -1.00%

Function 004255D8, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba636fd91792eeeadfabe62ff65efb0b35325993376ba682f5fce593f00dd83
Instruction ID: ed5af8601cc9e358c3f648788651ab3d2deb787692c6bc9de29acf85a7c101cc
Opcode Fuzzy Hash: aba636fd91792eeeadfabe62ff65efb0b35325993376ba682f5fce593f00dd83
Instruction Fuzzy Hash: F941C066711B9081DB158F2AE05436A7360FB85B9CFD895038E6E633A5EA3DC806C30C

Uniqueness

Uniqueness Score: -1.00%

Function 00468190, Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 79
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE ref: 004681AA
GetProcAddress.KERNEL32 ref: 004681C6
GetProcAddress.KERNEL32 ref: 004681DD
GetProcAddress.KERNEL32 ref: 004681F4
GetProcAddress.KERNEL32 ref: 0046820B
FlsSetValue.KERNEL32 ref: 004682A9
GetCurrentThreadId.KERNEL32 ref: 004682C8
FlsFree.KERNEL32 ref: 004682EE

Strings

FlsGetValue, xrefs: 004681CC
FlsSetValue, xrefs: 004681E3
FlsAlloc, xrefs: 004681BC
kernel32.dll, xrefs: 004681A3
FlsFree, xrefs: 004681FA

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: AddressProc$CurrentFreeHandleModuleThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$kernel32.dll
API String ID: 2257066991-282957996
Opcode ID: 7471f566d92bc4738dd3f3e8d14d76683ef5a6ba43ce22ee506a5f27a6cf9714
Instruction ID: e9f4ce2e775d2ef4d1ced8282ebb08f926a3df6e436be582b34827586b672946
Opcode Fuzzy Hash: 7471f566d92bc4738dd3f3e8d14d76683ef5a6ba43ce22ee506a5f27a6cf9714
Instruction Fuzzy Hash: D341F5F0602F0186FB949B25EC5876533A5F748BA5F88426E8A1D473A0EF7CC486C71D

Uniqueness

Uniqueness Score: -1.00%

Function 0042B4B0, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 262
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 0042B57D

Part of subcall function 00432080: SetLastError.KERNEL32 ref: 004320B7

htons.WS2_32 ref: 0042B5E7
htons.WS2_32 ref: 0042B6AD
GetLastError.KERNEL32 ref: 0042B6BF
closesocket.WS2_32 ref: 0042B712

Strings

Immediate connect fail for %s: %s, xrefs: 0042B855
Trying %s..., xrefs: 0042B5F5
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0042B6D1

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLasthtons$closesocketsocket
String ID: Trying %s...$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 353835356-3338264681
Opcode ID: c9796a9bd06a99a884cfa545187c5e507271d3cfe47e3771c63c6f503abb6cfe
Instruction ID: 38104ddd3c2303f1f259c8e6667e55f2ae5d563dcca4b3e6a367a0c68ed9cf83
Opcode Fuzzy Hash: c9796a9bd06a99a884cfa545187c5e507271d3cfe47e3771c63c6f503abb6cfe
Instruction Fuzzy Hash: 1EA1B1753146A086DB24EB16B58476F73A4F784B88F80442BEF5A87B44DB3CC841CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD50, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 147
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 0042ADBC
WSAGetLastError.WS2_32 ref: 0042ADC6

Part of subcall function 004183D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0041A288), ref: 004183E8
Part of subcall function 004183D0: GetLastError.KERNEL32 ref: 004184C7
Part of subcall function 004183D0: SetLastError.KERNEL32 ref: 004184D3

getsockname.WS2_32 ref: 0042AE19
WSAGetLastError.WS2_32 ref: 0042AE23

Strings

getpeername() failed with errno %d: %s, xrefs: 0042ADD8
getsockname() failed with errno %d: %s, xrefs: 0042AE35
ssloc inet_ntop() failed with errno %d: %s, xrefs: 0042AF22
ssrem inet_ntop() failed with errno %d: %s, xrefs: 0042AE80

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast$getpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 1444953621-670633250
Opcode ID: 923a9864c86e7dadcd77240cf1aa241fdcd004b55161d5e425d97c478e0f648d
Instruction ID: e125c79b2ab55860f3ccaa2e7edf1b33c51e6f9ba2da33637a069ff8191aa17b
Opcode Fuzzy Hash: 923a9864c86e7dadcd77240cf1aa241fdcd004b55161d5e425d97c478e0f648d
Instruction Fuzzy Hash: 22715776302B84D6DB58CB2AE6847D9B3A0F748B84F948026DF9C87720EF38D166C715

Uniqueness

Uniqueness Score: -1.00%

Function 0042BBF0, Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 288
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

connect to %s port %ld failed: %s, xrefs: 0042BED2
Failed to connect to %s port %ld: %s, xrefs: 0042C062
Connection time-out, xrefs: 0042BCDD
After %ldms connect time, move on!, xrefs: 0042BD61
Connection failed, xrefs: 0042BE61

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: After %ldms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-885759404
Opcode ID: d053fc9e986a4460eab182c34ba54bb6b08002e78a4ac5841a5f1997093f64d4
Instruction ID: 8144d2596da5887b218cefce9ac6232cf538a33acc439dad2bbb2c7d1420e55b
Opcode Fuzzy Hash: d053fc9e986a4460eab182c34ba54bb6b08002e78a4ac5841a5f1997093f64d4
Instruction Fuzzy Hash: 25C1A07231469086DB24DB16F4407AFB361F784BA4F91521AEFAA87B94CF7CC845CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00419080, Relevance: 15.3, APIs: 10, Instructions: 257
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 004190EA
Sleep.KERNEL32 ref: 004190FC

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: c53c2f39b3f560c02fa79df169bc42b30076c1fc3295d85c1e396f880ab26127
Instruction ID: c0305223b480fe492b696f3983356cd79f1b9bb5c11194b6047f2f59a1fa21ca
Opcode Fuzzy Hash: c53c2f39b3f560c02fa79df169bc42b30076c1fc3295d85c1e396f880ab26127
Instruction Fuzzy Hash: 4CA1D736704B8196DB248A19A8643DBB7A6F3C57A4F540717EA66837C8DB3DCC91CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00472180, Relevance: 13.8, APIs: 9, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringW.KERNELBASE ref: 0047220A
GetLastError.KERNEL32 ref: 0047222E
GetCPInfo.KERNEL32 ref: 0047234E

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CompareErrorInfoLastString
String ID:
API String ID: 3723911898-0
Opcode ID: ac15f1c761fc46ce15ae46db0531c2a630b2064addb252c328d3406ef138df0c
Instruction ID: e9c30096ef19e7321cf9ec8262ee203e98a383fbab576983fe3b805a5da45205
Opcode Fuzzy Hash: ac15f1c761fc46ce15ae46db0531c2a630b2064addb252c328d3406ef138df0c
Instruction Fuzzy Hash: 08D115717057808AD7348F35AA407DA37A5F744798F54822BEE4E4BB49EBBCCA45C708

Uniqueness

Uniqueness Score: -1.00%

Function 00410240, Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 00410329

Strings

%s%s, xrefs: 00410375
%s:%d: warning: '%s' %s, xrefs: 0041077F
%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!, xrefs: 00410602
%s%s%s, xrefs: 004102D9
_curlrc, xrefs: 00410294
<stdin>, xrefs: 0041073B

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: FileModuleName
String ID: %s%s$%s%s%s$%s:%d: warning: '%s' %s$%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!$<stdin>$_curlrc
API String ID: 514040917-7833359
Opcode ID: ceb33f71867c9ee3af007e0ad91048e079ff00e43134cc9906bca3e23264ba43
Instruction ID: 519962710f67e30d51fbcd066cb8d9d84cd5bf06f7638ecaeb6f1865a4eca919
Opcode Fuzzy Hash: ceb33f71867c9ee3af007e0ad91048e079ff00e43134cc9906bca3e23264ba43
Instruction Fuzzy Hash: 87E1EE712097C485DB208F22A4403EBA765F785B98F484127EFDA57796DEBCC8C2CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00419460, Relevance: 12.3, APIs: 8, Instructions: 266
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 004194C6
Sleep.KERNEL32 ref: 004194DA
WSASetLastError.WS2_32 ref: 00419677
Sleep.KERNEL32 ref: 00419687

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 050ff8e7c7a908849508c7e4af77ee5d89c403769a64d6ddf01c783b4bbbcf35
Instruction ID: 4c5994bae433f5bf0ff5a3b1bd26263af66db5948277fb2896908ebee9381b43
Opcode Fuzzy Hash: 050ff8e7c7a908849508c7e4af77ee5d89c403769a64d6ddf01c783b4bbbcf35
Instruction Fuzzy Hash: 3FA1077262969082CB354F19E5603AFB365FBC1B94F144216DE6653B94DB3DCC81CB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00419A70, Relevance: 9.1, APIs: 6, Instructions: 68
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042D310: getaddrinfo.WS2_32(?,?,?,?,?,?,?,?,?,?,00419ACB), ref: 0042D378
Part of subcall function 0042D310: WSASetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00419ACB), ref: 0042D37F

WSAGetLastError.WS2_32 ref: 00419AD1
WSAGetLastError.WS2_32 ref: 00419ADB
EnterCriticalSection.KERNEL32 ref: 00419AF4
LeaveCriticalSection.KERNEL32 ref: 00419B08
DeleteCriticalSection.KERNEL32 ref: 00419B16
LeaveCriticalSection.KERNEL32 ref: 00419B60

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CriticalSection$ErrorLast$Leave$DeleteEntergetaddrinfo
String ID:
API String ID: 749948856-0
Opcode ID: 992a069709f6c31ec8a0e411eb499f29afff2afa8598a5b1b944226b89a6e6c6
Instruction ID: a357475f4eee50011446f32110fcad60a8495873841227e198ef08d7ffa9090d
Opcode Fuzzy Hash: 992a069709f6c31ec8a0e411eb499f29afff2afa8598a5b1b944226b89a6e6c6
Instruction Fuzzy Hash: 673105B6604A80C6EB54DF22E45039A73B0FB88F88F544016DB4E57B28DF7CD949CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042A400, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0042A442
WSAIoctl.WS2_32 ref: 0042A4CD
WSAGetLastError.WS2_32 ref: 0042A4D7

Strings

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 0042A4DD
Failed to set SO_KEEPALIVE on fd %d, xrefs: 0042A44C

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorIoctlLastsetsockopt
String ID: Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d
API String ID: 1819429192-277924715
Opcode ID: 4f1df9dcdae01853105e7b9da6908811b0975e02ae02e8f8008338c75421903b
Instruction ID: 09d43f99b0a67230b89b78444f32fb36a0ceddd6cd4c1b3a09376715f4eb8848
Opcode Fuzzy Hash: 4f1df9dcdae01853105e7b9da6908811b0975e02ae02e8f8008338c75421903b
Instruction Fuzzy Hash: 46219C7270879186D7109F26E44474EB7A9F788B88F54012AEB8D87F58DBBCC545CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00466140, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0046614F
GetProcAddress.KERNEL32 ref: 00466164
ExitProcess.KERNEL32 ref: 00466175

Strings

mscoree.dll, xrefs: 00466148
CorExitProcess, xrefs: 0046615A

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 4b255960f05c953bc5ed8402e649ad69c3005899242e79782227b0a2de538e9e
Instruction ID: e9c98754f3c0393fddb5f9c48d96d6bb1a56da9b71575faf2500b015c9af0d8a
Opcode Fuzzy Hash: 4b255960f05c953bc5ed8402e649ad69c3005899242e79782227b0a2de538e9e
Instruction Fuzzy Hash: 36E01290306B0041FF089B70AC943642774AB48B40F48142D4A0F06362EFBCC84DC75C

Uniqueness

Uniqueness Score: -1.00%

Function 0046F180, Relevance: 7.7, APIs: 5, Instructions: 246fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 0046F3BF
GetFileType.KERNEL32 ref: 0046F3D1
CloseHandle.KERNEL32 ref: 0046F3DE
GetLastError.KERNEL32 ref: 0046F3E4
CloseHandle.KERNEL32 ref: 0046F421

Part of subcall function 00468BE0: CloseHandle.KERNEL32(?,?,?,?,00468D04,?,?,?,?,00461D7E,?,?,?,?,00461E28), ref: 00468C2E
Part of subcall function 00468BE0: GetLastError.KERNEL32(?,?,?,?,00468D04,?,?,?,?,00461D7E,?,?,?,?,00461E28), ref: 00468C38

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CloseHandle$ErrorFileLast$CreateType
String ID:
API String ID: 3635033729-0
Opcode ID: aaf2278ca104e1ac4fb8a423a6eb76d9386b9bf81e191c365724515a7ac89e6a
Instruction ID: 2f87662bfc400a7dd3b73fa9f8dc6b2ea99abd0df92103080d31aa1bf0864739
Opcode Fuzzy Hash: aaf2278ca104e1ac4fb8a423a6eb76d9386b9bf81e191c365724515a7ac89e6a
Instruction Fuzzy Hash: 4591C53620468085EB345F2AF45436F6650B7417A8F64463BDEE687BE1EB3DC849CB0B

Uniqueness

Uniqueness Score: -1.00%

Function 00465BB0, Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 00465BDB

Part of subcall function 00465EC0: Sleep.KERNEL32(?,?,?,?,00465BEC), ref: 00465EF4

GetFileType.KERNEL32 ref: 00465D36

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID:
API String ID: 1527402494-0
Opcode ID: 825c9859a287091dd884a7d3286909610f1059c93f2f14074ef71e498e2c61c8
Instruction ID: d9be916e1f8515ee866afd462a9b5c2e97c61de36225c92ec7e0d48f1140b477
Opcode Fuzzy Hash: 825c9859a287091dd884a7d3286909610f1059c93f2f14074ef71e498e2c61c8
Instruction Fuzzy Hash: 0C719FB1205F8085DB108B25E94872A3764F705BA8F65831BDABE873D0EB3DC856C75B

Uniqueness

Uniqueness Score: -1.00%

Function 00419C70, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00419D52
LeaveCriticalSection.KERNEL32 ref: 00419D66
CloseHandle.KERNEL32 ref: 00419D73
SetLastError.KERNEL32 ref: 00419DF2

Part of subcall function 00419950: InitializeCriticalSection.KERNEL32 ref: 004199E7
Part of subcall function 00419950: DeleteCriticalSection.KERNEL32 ref: 00419A0F

DeleteCriticalSection.KERNEL32 ref: 00419D90

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CriticalSection$Delete$CloseEnterErrorHandleInitializeLastLeave
String ID:
API String ID: 1319367174-0
Opcode ID: 249db6e6b3e62efad946ccf3e2b40ab1ba51783647f9eaf550f759ae9fc7f8b2
Instruction ID: ed4c8023912201dae85d68fa271e89d9a749ee0a8b8da2aac8a6717419fb2ba0
Opcode Fuzzy Hash: 249db6e6b3e62efad946ccf3e2b40ab1ba51783647f9eaf550f759ae9fc7f8b2
Instruction Fuzzy Hash: 8C412876705B4082DB58DF22E66439A7360FB88B84F44401ACF5E57B20DF3CE9A4CB44

Uniqueness

Uniqueness Score: -1.00%

Function 004656D0, Relevance: 7.5, APIs: 5, Instructions: 44threadCOMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 004656E7
FlsSetValue.KERNEL32 ref: 004656FE
GetLastError.KERNEL32 ref: 00465708
ExitThread.KERNEL32 ref: 00465710
GetCurrentThreadId.KERNEL32 ref: 00465717

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ThreadValue$CurrentErrorExitLast
String ID:
API String ID: 1808566232-0
Opcode ID: af84f515f6e8438571f0ca1cf23243d6b477a38ee484d45bbc546e1765657892
Instruction ID: b7424f848bf09846d41a2f02d09c6c76d9a6bae5430aa72015ac15550f1ecdff
Opcode Fuzzy Hash: af84f515f6e8438571f0ca1cf23243d6b477a38ee484d45bbc546e1765657892
Instruction Fuzzy Hash: BC110565306B4086EB44AF32E84475973A1FB49B85F98843ADF4E87365EF3CC8148709

Uniqueness

Uniqueness Score: -1.00%

Function 0041A150, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

init_resolve_thread() failed for %s; %s, xrefs: 0041A28B
getaddrinfo() failed for %s:%d; %s, xrefs: 0041A2CE

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast
String ID: getaddrinfo() failed for %s:%d; %s$init_resolve_thread() failed for %s; %s
API String ID: 1452528299-1389973398
Opcode ID: 0f662b7cb390a78905ed7db988bdb9d742d7dfd17c2f69ec7314286f4c3829a6
Instruction ID: bcd696c0a31c23370d5ae4158fce6d0e85a716414749417bc960df6e1d3951e5
Opcode Fuzzy Hash: 0f662b7cb390a78905ed7db988bdb9d742d7dfd17c2f69ec7314286f4c3829a6
Instruction Fuzzy Hash: 8E416A72719B8481CB609F62B94079AB3A5F788BC4F90002AEF8D97B59EF3CC455C709

Uniqueness

Uniqueness Score: -1.00%

Function 00468AB0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(?,?,?,?,?,?,00466414,?,?,?,?,?,?,0046819B), ref: 00468AEF
GetProcAddress.KERNEL32(?,?,?,?,?,?,00466414,?,?,?,?,?,?,0046819B), ref: 00468B04

Strings

InitializeCriticalSectionAndSpinCount, xrefs: 00468AFA
kernel32.dll, xrefs: 00468AE8

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 1646373207-3733552308
Opcode ID: 84b390c8ea35c3c1c0e56ecead250bdc29c3368b00754c50737d1c01184c8b1c
Instruction ID: acc36c6f73149781dbcb8dfa4e27ade675e762bef4c962ab1ca23e57e7197d18
Opcode Fuzzy Hash: 84b390c8ea35c3c1c0e56ecead250bdc29c3368b00754c50737d1c01184c8b1c
Instruction Fuzzy Hash: EF11D7B020AB4096EA50CB45A84031573A4F758B84F88066EDB4D43724FF7DD416C70A

Uniqueness

Uniqueness Score: -1.00%

Function 0042B050, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0042B088
WSAGetLastError.WS2_32 ref: 0042B092

Part of subcall function 004183D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0041A288), ref: 004183E8
Part of subcall function 004183D0: GetLastError.KERNEL32 ref: 004184C7
Part of subcall function 004183D0: SetLastError.KERNEL32 ref: 004184D3

Strings

Could not set TCP_NODELAY: %s, xrefs: 0042B0A2
TCP_NODELAY set, xrefs: 0042B0C3

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast$setsockopt
String ID: Could not set TCP_NODELAY: %s$TCP_NODELAY set
API String ID: 3136324617-1562148346
Opcode ID: 95b059cf6715011c8bea582579cc7e102a3d8dd7c78aa21e41dd6193cc9105c5
Instruction ID: 817723ab3a29a3cfcaef88a505eac62bffbe1c234af957b23b3846edf6aac980
Opcode Fuzzy Hash: 95b059cf6715011c8bea582579cc7e102a3d8dd7c78aa21e41dd6193cc9105c5
Instruction Fuzzy Hash: 0E011DB5704B8182DA009F52E90439AB761FB89BD8F984116DF4D47B29DFBDC159CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00418DF0, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0042C180: GetVersionExA.KERNEL32 ref: 0042C1E0

GetProcAddressForCaller.KERNELBASE(?,?,?,?,0042FAA9,?,?,?,?,00414C98), ref: 00418E3E

Strings

secur32.dll, xrefs: 00418E1C
InitSecurityInterfaceA, xrefs: 00418E34
security.dll, xrefs: 00418E11

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: AddressCallerProcVersion
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 1946158156-3788156360
Opcode ID: 0ee484147ce1e7b22d3153a8d575cc2d2f17a267a4e9b7d5f8bbc34b48fedc17
Instruction ID: a05debb423e43c7f7ec9efe0b6975cc1d8b894699688950707e31c1d43952b61
Opcode Fuzzy Hash: 0ee484147ce1e7b22d3153a8d575cc2d2f17a267a4e9b7d5f8bbc34b48fedc17
Instruction Fuzzy Hash: B3F030B0B42F0085FE54DB62AC8176523D0AF55B44F84456E8A0DC2360FF3CC596CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0042EDD0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

select/poll on SSL socket, errno: %d, xrefs: 0042F055
schannel: timed out sending data (bytes sent: %zd), xrefs: 0042F023, 0042F07C

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 0-3891197721
Opcode ID: 65ef274df420369aa348346ef2dbc14f6bc544e4b14d6592181711537be1cd08
Instruction ID: c15ac3e807ff7ba3fe78952a950a09a5ec31d5738e1313ec80d259279e0f3951
Opcode Fuzzy Hash: 65ef274df420369aa348346ef2dbc14f6bc544e4b14d6592181711537be1cd08
Instruction Fuzzy Hash: 6E818B76309B81C6DB208F26F44479AB3A5F784BA4F944226EFAD47B99DB3CC405CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB90, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 0042FD84
select/poll on SSL/TLS socket, errno: %d, xrefs: 0042FD5F

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 03b946d3877a0e5fffc815ac0613dfe5e9e33cf296285e224a2ac0d1bc8e59f6
Instruction ID: 3cd4677bf7acc09ad05a532b3914bfd65381056c599635b7733016e7befd2712
Opcode Fuzzy Hash: 03b946d3877a0e5fffc815ac0613dfe5e9e33cf296285e224a2ac0d1bc8e59f6
Instruction Fuzzy Hash: AF51E0313147A582CB209B22B94876F73B1FB85BA4FD4463BDE2687794DB38D815C708

Uniqueness

Uniqueness Score: -1.00%

Function 00427C30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00427A30: recv.WS2_32 ref: 00427B2F

send.WS2_32 ref: 00427C7E
WSAGetLastError.WS2_32 ref: 00427C92

Strings

Send failure: %s, xrefs: 00427CD2

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastrecvsend
String ID: Send failure: %s
API String ID: 3418755260-857917747
Opcode ID: ec9cd42d27ad389e44ba5a15310e33f6444d7b1dc448c6bd25da865635be88b1
Instruction ID: f21f2413fa0fa4b1d8adaac81a6fbc90565feb8db304573241e49312aa65055d
Opcode Fuzzy Hash: ec9cd42d27ad389e44ba5a15310e33f6444d7b1dc448c6bd25da865635be88b1
Instruction Fuzzy Hash: 3E216D32719B90C6C7509F26F54035AA7A1F388BE8F681122EF5A47BA8CE7CC1028704

Uniqueness

Uniqueness Score: -1.00%

Function 0042D310, Relevance: 4.7, APIs: 3, Instructions: 154networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,?,?,?,?,?,?,?,?,?,00419ACB), ref: 0042D378
WSASetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00419ACB), ref: 0042D37F

Part of subcall function 0042D0A0: GetSystemDirectoryA.KERNEL32 ref: 0042D125
Part of subcall function 0042D0A0: LoadLibraryA.KERNEL32 ref: 0042D183
Part of subcall function 0042D0A0: GetProcAddress.KERNEL32 ref: 0042D197
Part of subcall function 0042D0A0: FreeLibrary.KERNEL32 ref: 0042D1A5
Part of subcall function 0042D0A0: LoadLibraryA.KERNEL32 ref: 0042D1E3
Part of subcall function 0042D0A0: GetProcAddress.KERNEL32 ref: 0042D1F7
Part of subcall function 0042D0A0: FreeLibrary.KERNEL32 ref: 0042D205

WSASetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00419ACB), ref: 0042D51C

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc$DirectorySystemgetaddrinfo
String ID:
API String ID: 3402602543-0
Opcode ID: 853c2a3efc17940b0bfeebe172d7a3d8e9f53925350bd3d396881b6c49dd3272
Instruction ID: 8a3008c65d6e079b7d32a1385d76a0522032599d72a6252252f268f4712e8074
Opcode Fuzzy Hash: 853c2a3efc17940b0bfeebe172d7a3d8e9f53925350bd3d396881b6c49dd3272
Instruction Fuzzy Hash: 3B512776706B5082EA24EF12E95072A77A4FB88F94F99852ACF8E43B14DF3CD544C748

Uniqueness

Uniqueness Score: -1.00%

Function 00404B40, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0045FE10: RtlAllocateHeap.NTDLL(?,?,?,?,00465EEA,?,?,?,?,00465BEC), ref: 0045FE44
Part of subcall function 0045FE10: HeapAlloc.KERNEL32(?,?,?,?,00465EEA,?,?,?,?,00465BEC), ref: 0045FE73

SearchPathA.KERNELBASE ref: 00404BA8

Strings

@`L, xrefs: 00404B44

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Heap$AllocAllocatePathSearch
String ID: @`L
API String ID: 287850878-2504798926
Opcode ID: d42543db88a6d4b28c402d638ec13edd1b57f0b6ee6083c792c3c2b23b37416e
Instruction ID: 694e90c71cf50fbf82d98ab8f71a4e73520131db1e24bd016d701de0e4e8148e
Opcode Fuzzy Hash: d42543db88a6d4b28c402d638ec13edd1b57f0b6ee6083c792c3c2b23b37416e
Instruction Fuzzy Hash: A0118872208B8086DB159F52B84176AB7A5F788BD4F48003AEF8A47B5ADF7CD414CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00414A80, Relevance: 3.1, APIs: 2, Instructions: 68networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00414B1E
WSACleanup.WS2_32 ref: 00414B8A

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CleanupStartup
String ID:
API String ID: 915672949-0
Opcode ID: 569fb22dbc3efc613bba492129f39427a23791ed09fc875d2a20a0eb82be00ce
Instruction ID: 243b37dbb45c279dd0a109e6d742a8e8bc43899166ac20e7b1a94d8319a50ca9
Opcode Fuzzy Hash: 569fb22dbc3efc613bba492129f39427a23791ed09fc875d2a20a0eb82be00ce
Instruction Fuzzy Hash: F0214AF460AB0186FB619B16F8517E633A4BB98355F40002ADA8D86362FF6CC5859B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004657B0, Relevance: 3.1, APIs: 2, Instructions: 60threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00465863
GetLastError.KERNEL32(?,?,?,?,?,0042DB1E), ref: 0046586E

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CreateErrorLastThread
String ID:
API String ID: 1689873465-0
Opcode ID: 76a6197b7e5d07f61c422ac589519fc0d4e790b0f2a4b1467616ce4f2d79e0d1
Instruction ID: 815ce4eb3b7fa8e29ec4c9710690b4c884bfdebc453d43e596e4d0e4fc954588
Opcode Fuzzy Hash: 76a6197b7e5d07f61c422ac589519fc0d4e790b0f2a4b1467616ce4f2d79e0d1
Instruction Fuzzy Hash: 13213E31608B8086DB14AFA2B94035AB3A4F789BE4F94012AEF9947B59EF7CD4648705

Uniqueness

Uniqueness Score: -1.00%

Function 00414C20, Relevance: 3.1, APIs: 2, Instructions: 56networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00414CA5
WSACleanup.WS2_32 ref: 00414D15

Part of subcall function 00418DF0: GetProcAddressForCaller.KERNELBASE(?,?,?,?,0042FAA9,?,?,?,?,00414C98), ref: 00418E3E

Part of subcall function 00419860: socket.WS2_32 ref: 0041987C

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: AddressCallerCleanupProcStartupsocket
String ID:
API String ID: 2320918483-0
Opcode ID: 56d43d9eabee90baa1072eb0b6891ec7ba3411d6fcbe62c43cfb53cec955c4bd
Instruction ID: 1c562367de90b30d7d8760fd4e28c3d394458ebc2a1aca3e390f035754b9b3a3
Opcode Fuzzy Hash: 56d43d9eabee90baa1072eb0b6891ec7ba3411d6fcbe62c43cfb53cec955c4bd
Instruction Fuzzy Hash: A72149B4615F4181FB60EB12F8413EA33A5BB99748F800026DE4D82365EF3CC589C758

Uniqueness

Uniqueness Score: -1.00%

Function 0045FE10, Relevance: 3.0, APIs: 2, Instructions: 45memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,?,00465EEA,?,?,?,?,00465BEC), ref: 0045FE44
HeapAlloc.KERNEL32(?,?,?,?,00465EEA,?,?,?,?,00465BEC), ref: 0045FE73

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Heap$AllocAllocate
String ID:
API String ID: 2177240990-0
Opcode ID: 815e9e86c80adf38db329bf639e17cace45d26f255a0c268ea31fe11f97082e6
Instruction ID: 897e450367451e13d035f563384c7ce554c27077621b2022d37ef2aa71074230
Opcode Fuzzy Hash: 815e9e86c80adf38db329bf639e17cace45d26f255a0c268ea31fe11f97082e6
Instruction Fuzzy Hash: 0C018461706B4081EB048B17A84031AA3A1F7CDBE5F5C0136EF5D53BAADF3CC4898B09

Uniqueness

Uniqueness Score: -1.00%

Function 00426DC0, Relevance: 3.0, APIs: 2, Instructions: 22networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00426DCC
WSAGetLastError.WS2_32 ref: 00426DDB

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 5844b63ef9383d101242dc78e94b1967ac89de1bbbf496a1948a0ec8864e250f
Instruction ID: d0d5cb576897fd53cfd92b3f9b12423d5ea56a2d85551a04aa309eee15ae3280
Opcode Fuzzy Hash: 5844b63ef9383d101242dc78e94b1967ac89de1bbbf496a1948a0ec8864e250f
Instruction Fuzzy Hash: 0EE0C2B1B1090843FF2853B5B8A57791145CB98732F985734DA3A8A7D0DA5C49D64714

Uniqueness

Uniqueness Score: -1.00%

Function 00466690, Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 004666A2
HeapSetInformation.KERNEL32 ref: 004666D1

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Heap$CreateInformation
String ID:
API String ID: 1774340351-0
Opcode ID: b25388e1f4a998067b74f2ef56253761c708096d6735c2516d3a7e06a5bc683d
Instruction ID: 28939662bcff9b5fb9c4de93bc1ff0593e5f1839ccf810af5d9fe283cd4cfc6b
Opcode Fuzzy Hash: b25388e1f4a998067b74f2ef56253761c708096d6735c2516d3a7e06a5bc683d
Instruction Fuzzy Hash: 50E086F6B26B9083FB985B21E849B566260F7D8784FD0502DEF4D42B64EFBCC1958B04

Uniqueness

Uniqueness Score: -1.00%

Function 00419050, Relevance: 3.0, APIs: 2, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(?,?,?,?,00414E1F), ref: 0041905F
SleepEx.KERNEL32(?,?,?,?,00414E1F), ref: 0041906F

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: ee635acd2ee8772ae622c96682e4ef0fdb01aa38d11b80b47d0bdab7989139f2
Instruction ID: 8d886e78c474cbaa4ed1ccd3f6ee4ace85b0f7aedea2cf8ab73121b6454e2785
Opcode Fuzzy Hash: ee635acd2ee8772ae622c96682e4ef0fdb01aa38d11b80b47d0bdab7989139f2
Instruction Fuzzy Hash: DFD012B4F0780292EA0C23219C6536510516B5C732FC00219C62A887D4DB5C49DA4704

Uniqueness

Uniqueness Score: -1.00%

Function 0046E300, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 0046E30D

Part of subcall function 0045FEC0: RtlReleasePrivilege.NTDLL(?,?,?,?,004664B0,?,?,?,?,00468303), ref: 0045FED5

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: PrivilegeRelease__initmbctable
String ID:
API String ID: 1797876752-0
Opcode ID: 7b04478e7e5ed8e61a786337712f43b90e95c479310eadbf75b0747534f56ae6
Instruction ID: 981ffad1635e5b8d4d04442d5b42b81358fc561622f1a909735068632a79e7e9
Opcode Fuzzy Hash: 7b04478e7e5ed8e61a786337712f43b90e95c479310eadbf75b0747534f56ae6
Instruction Fuzzy Hash: BA310ABA60678081EB50CB23A48035A77E1E745BE4F5C0217EFA8437D5EB3EC8858B05

Uniqueness

Uniqueness Score: -1.00%

Function 0046483B, Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 004648F9

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: a3e3c5691cb120215f20256173ec19fd40b32ff30f47c040bd5b0bc0083c8e96
Instruction ID: da645937a6986334da5563c23c4f61f7fe97a620def60bf914e7ad941156942a
Opcode Fuzzy Hash: a3e3c5691cb120215f20256173ec19fd40b32ff30f47c040bd5b0bc0083c8e96
Instruction Fuzzy Hash: BC213EB960538186EB547FB3A45132A2291ABC1759F04043FEB4587792FFAC88449A5F

Uniqueness

Uniqueness Score: -1.00%

Function 004647DE, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00466690: HeapCreate.KERNELBASE ref: 004666A2

GetCommandLineA.KERNEL32 ref: 004648F9

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CommandCreateHeapLine
String ID:
API String ID: 2517019150-0
Opcode ID: 19c3762b1f42ced47d8e1e960929f4efff554d326429ca6f248f5dd631559a41
Instruction ID: b40551d47dcd8cf346da9cd72c975aaddc8a388044c81303a7e223d8c4b01080
Opcode Fuzzy Hash: 19c3762b1f42ced47d8e1e960929f4efff554d326429ca6f248f5dd631559a41
Instruction Fuzzy Hash: 4D2162B560564187FB547BB7E81272A2292AB82349F04146FDB4587352FFACC8448B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00464873, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00466690: HeapCreate.KERNELBASE ref: 004666A2

GetCommandLineA.KERNEL32 ref: 004648F9

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CommandCreateHeapLine
String ID:
API String ID: 2517019150-0
Opcode ID: dc751f9baddfa96ee2f320d1a5969c8ae3fa1a853b487dd19d449d11d0f6485e
Instruction ID: 1091e851c4943c156bca14033899ee374352654a1def464c9d530f4e33b018e8
Opcode Fuzzy Hash: dc751f9baddfa96ee2f320d1a5969c8ae3fa1a853b487dd19d449d11d0f6485e
Instruction Fuzzy Hash: 0D214CA970578182EB547BB3A41272A2292AB82349F04143FEB4587392FFACC804875F

Uniqueness

Uniqueness Score: -1.00%

Function 00464827, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00466690: HeapCreate.KERNELBASE ref: 004666A2

GetCommandLineA.KERNEL32 ref: 004648F9

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CommandCreateHeapLine
String ID:
API String ID: 2517019150-0
Opcode ID: dc751f9baddfa96ee2f320d1a5969c8ae3fa1a853b487dd19d449d11d0f6485e
Instruction ID: 1091e851c4943c156bca14033899ee374352654a1def464c9d530f4e33b018e8
Opcode Fuzzy Hash: dc751f9baddfa96ee2f320d1a5969c8ae3fa1a853b487dd19d449d11d0f6485e
Instruction Fuzzy Hash: 0D214CA970578182EB547BB3A41272A2292AB82349F04143FEB4587392FFACC804875F

Uniqueness

Uniqueness Score: -1.00%

Function 00464260, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c250c48d94c51c5c1f64b5a3bf410bf999203af4124fbea61a81a039675f78
Instruction ID: dd7fd103089b98870ca5472483ff0e7121b756b7d89318256fbb9d368e556a44
Opcode Fuzzy Hash: e0c250c48d94c51c5c1f64b5a3bf410bf999203af4124fbea61a81a039675f78
Instruction Fuzzy Hash: F701D221705B8080EE488B17A940356A361E7CDBE8F6C0127FF4E437A9EE3CC0958B05

Uniqueness

Uniqueness Score: -1.00%

Function 00462D10, Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00462D55

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dd4ea415179fe7c0bfd5de5b11430550d7e9171a825dc883fb2edc75cfdd247c
Instruction ID: dbd3fcfd12b30177bf2c99b6cde85d8023873d72a380c71a96141f2d91591bee
Opcode Fuzzy Hash: dd4ea415179fe7c0bfd5de5b11430550d7e9171a825dc883fb2edc75cfdd247c
Instruction Fuzzy Hash: 30F0A760302F0555FE195B76BB507A292449B99BB5F0C5B368E3A8A3E4FBFCC4C5810E

Uniqueness

Uniqueness Score: -1.00%

Function 00419860, Relevance: 1.5, APIs: 1, Instructions: 31networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 0041987C

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 4189c32fd309d28d757fa6d01cfb753f28d4c1c4f5eea285b44bbd786961fe41
Instruction ID: b07700f128c14906a00c1203ddd504ffe1bcf4b57bcc66bc6e292bebafcae85b
Opcode Fuzzy Hash: 4189c32fd309d28d757fa6d01cfb753f28d4c1c4f5eea285b44bbd786961fe41
Instruction Fuzzy Hash: 8EF082B170220187F704DFBAA8D4B963255E754334F85872DEA3A9B2E0C76898988B1C

Uniqueness

Uniqueness Score: -1.00%

Function 0042B2D0, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 0042B314

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: e0b6c51315c5bf3edf7cc572f045187a8044557b6936f2999e1c9c271e330ee7
Instruction ID: 134469779855fb340b590921a78d51fbe18d85ba284d67f0d394b1ac53b40b14
Opcode Fuzzy Hash: e0b6c51315c5bf3edf7cc572f045187a8044557b6936f2999e1c9c271e330ee7
Instruction Fuzzy Hash: D8F03C7130AA40C5CB14DB1AE5843AAA374EB49BD8FA80026DF4947728CF3DC4828B44

Uniqueness

Uniqueness Score: -1.00%

Function 004153E0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32 ref: 00415413

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: ee1bb8074a8fb1c987e3c698e220a338710cf4d26901fe07cd6eb29be314ad87
Instruction ID: e1547e541216e5d4a55e5c8e06f5f40ab761fcb27bcb6e4567a07287ebc2a1d9
Opcode Fuzzy Hash: ee1bb8074a8fb1c987e3c698e220a338710cf4d26901fe07cd6eb29be314ad87
Instruction Fuzzy Hash: A6F05E75A24AC082EF31E715F4543EA63A0F7C9748F8401159A8D0A765DF3CC648CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00414BC0, Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

WSACleanup.WS2_32 ref: 00414BFA

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Cleanup
String ID:
API String ID: 99945797-0
Opcode ID: ed39c373ef81d787906e31c3fc3a40bdcb5237fc0ba92cf4ea7c6724e1660ee3
Instruction ID: 52f31e6ac1fa21e808d37e042b8a6ad6db3426ceb5732992a75d77d1e6e3b4a7
Opcode Fuzzy Hash: ed39c373ef81d787906e31c3fc3a40bdcb5237fc0ba92cf4ea7c6724e1660ee3
Instruction Fuzzy Hash: 87E092B460FA4143F395672AA84674539505B5232CF45014A9620463A2E7AC44C08BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00465690, Relevance: 1.5, APIs: 1, Instructions: 14threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 004656BA

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 81bea15a211f38faa605d11893773da6726a5329c1f63d64fbb58ac133b034ba
Instruction ID: 80c5b8fcf727d17b3797aa42a5029488723d9a8706539bf719626ea94030297f
Opcode Fuzzy Hash: 81bea15a211f38faa605d11893773da6726a5329c1f63d64fbb58ac133b034ba
Instruction Fuzzy Hash: 7AD0C960B13B0641EE5977A6E85572912505F4A754F8C182E5D1D0B361FE6CC814C35E

Uniqueness

Uniqueness Score: -1.00%

Function 00402BD0, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00402BE9

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 902a142a989ff78e805f5340326c1da37fd9befc17faa3ee98e137cd65b9a284
Instruction ID: 6e08ba395850d31a2431f36cd6730955a384405a36eda1e24ea76f27d59f38bb
Opcode Fuzzy Hash: 902a142a989ff78e805f5340326c1da37fd9befc17faa3ee98e137cd65b9a284
Instruction Fuzzy Hash: 60C08055F15981C2D3445B6954413866772A7C4248FD55415D3074112CDE3CC1E58B04

Uniqueness

Uniqueness Score: -1.00%

Function 00418E70, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,?,?,00414C05), ref: 00418E80

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 849a5501fbb722a31a8aca101d7d4da3856a910ae8b2118e519396c4413102d0
Instruction ID: 448c111db683846bb961890b9ffef50bffb2016e909220afbc298a7e47d7f8e3
Opcode Fuzzy Hash: 849a5501fbb722a31a8aca101d7d4da3856a910ae8b2118e519396c4413102d0
Instruction Fuzzy Hash: 37D012B4A1BE0082FA48DF32BC907242264BF88701F809908CB4B26224CF7C48A68B18

Uniqueness

Uniqueness Score: -1.00%

Function 0045FEC0, Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlReleasePrivilege.NTDLL(?,?,?,?,004664B0,?,?,?,?,00468303), ref: 0045FED5

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: PrivilegeRelease
String ID:
API String ID: 113639715-0
Opcode ID: 9f86fe518bcd17c32de11dc155d5f10da49df3681f584fb98da9d991cb4b3dc1
Instruction ID: 4a972bfd50eec19036504e8ed9b7a32a5358c75ff9531621f4aaa6a6e1a0666a
Opcode Fuzzy Hash: 9f86fe518bcd17c32de11dc155d5f10da49df3681f584fb98da9d991cb4b3dc1
Instruction Fuzzy Hash: 22C04CD4A07A4481EA1897525C9133111116FC8792EC44429DE0E596229E7C415B4609

Uniqueness

Uniqueness Score: -1.00%

Function 00465F30, Relevance: 1.3, APIs: 1, Instructions: 34sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00462D10: RtlAllocateHeap.NTDLL ref: 00462D55

Sleep.KERNEL32(?,?,?,?,00468298), ref: 00465F75

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: AllocateHeapSleep
String ID:
API String ID: 4201116106-0
Opcode ID: 7035d22741a127dd6393845fb0bacdad96759f3797e431a64faa03e51ef576f8
Instruction ID: 0843f57396854dbd392e000836ffbcdd70d407d2ee7d632008aeaf2622358f79
Opcode Fuzzy Hash: 7035d22741a127dd6393845fb0bacdad96759f3797e431a64faa03e51ef576f8
Instruction Fuzzy Hash: EAF03C32728E8486DA189F02E84011EA365F389BD5F681125FF9E17F98DB3CD9618B05

Uniqueness

Uniqueness Score: -1.00%

Function 00465EC0, Relevance: 1.3, APIs: 1, Instructions: 28sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045FE10: RtlAllocateHeap.NTDLL(?,?,?,?,00465EEA,?,?,?,?,00465BEC), ref: 0045FE44
Part of subcall function 0045FE10: HeapAlloc.KERNEL32(?,?,?,?,00465EEA,?,?,?,?,00465BEC), ref: 0045FE73

Sleep.KERNEL32(?,?,?,?,00465BEC), ref: 00465EF4

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Heap$AllocAllocateSleep
String ID:
API String ID: 1327310711-0
Opcode ID: 5cdb79de003987c623acd571239f66fbb1358bf1a8f011fe77376b379592ae3d
Instruction ID: 2d7a4cb00f078253fda9c3aa2bd89e8d4476f05ea97f1460575547909565564e
Opcode Fuzzy Hash: 5cdb79de003987c623acd571239f66fbb1358bf1a8f011fe77376b379592ae3d
Instruction Fuzzy Hash: 65F0B432325B8482CA049F06E84021EB361F3C9B90F580115FF8E17B55CF3DD8618B05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0043CF40, Relevance: 107.4, APIs: 48, Strings: 13, Instructions: 684COMMON

Download Yara Rule

APIs

#22.WLDAP32 ref: 0043D074
#41.WLDAP32 ref: 0043D98D
#46.WLDAP32 ref: 0043DA32

Strings

LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 0043CF80
LDAP local: %s, xrefs: 0043D07A
There are more than %d entries, xrefs: 0043D9A1
Microsoft Corporation., xrefs: 0043CF79
;binary, xrefs: 0043D46B
LDAP local: ldap_simple_bind_s %s, xrefs: 0043D21A
LDAP local: trying to establish %s connection, xrefs: 0043D0B8
cleartext, xrefs: 0043D0A8
encrypted, xrefs: 0043D0C2
LDAP local: %s, xrefs: 0043CFC4
LDAP remote: %s, xrefs: 0043D28F
LDAP local: Cannot connect to %s:%ld, xrefs: 0043D183
DN: , xrefs: 0043D315

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: ldap_simple_bind_s %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 0-1575950145
Opcode ID: f1a3631a2ea8f96406b642f001cf5310ae48468acd7f7b95f428cb995f9e7051
Instruction ID: 928790bbfb58ce29b5fbff1c0657f6aba65d207a259d370337f5d7b59838ed19
Opcode Fuzzy Hash: f1a3631a2ea8f96406b642f001cf5310ae48468acd7f7b95f428cb995f9e7051
Instruction Fuzzy Hash: DC52787AA08A408ADB149F12B40039AB3B0F789FD8F544416DF8E57B58DFBDD946CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0044CE20, Relevance: 44.4, Strings: 35, Instructions: 659COMMON

Download Yara Rule

Strings

HTTP/1.%d %d, xrefs: 0044D559
Received HTTP code %d from proxy after CONNECT, xrefs: 0044D9B9
Read %zd bytes of chunk, continue, xrefs: 0044D34F, 0044D6D8
TUNNEL_STATE switched to: %d, xrefs: 0044D846
chunked, xrefs: 0044D4EB
Proxy-authenticate:, xrefs: 0044D422
WWW-Authenticate:, xrefs: 0044D3F7
Ignore %I64d bytes of response-body, xrefs: 0044D5EF
Content-Length:, xrefs: 0044D492
Proxy-Connection:, xrefs: 0044D01D, 0044D52D
CONNECT, xrefs: 0044CF29
Failed sending CONNECT to proxy, xrefs: 0044D116
close, xrefs: 0044D4C4, 0044D526
Host:, xrefs: 0044CFEE
Proxy CONNECT followed by %zd bytes of opaque data. Data ignored (known bug #39), xrefs: 0044D744
1.0, xrefs: 0044CF79
Transfer-Encoding:, xrefs: 0044D4F2
Proxy-Connection: Keep-Alive, xrefs: 0044D02C
chunk reading DONE, xrefs: 0044D31C, 0044D699
1.1, xrefs: 0044CF72
Proxy CONNECT aborted due to select/poll error, xrefs: 0044D79F
Proxy CONNECT connection closed, xrefs: 0044D280
%s%s%s:%hu, xrefs: 0044CFC4
Connection:, xrefs: 0044D4CB
Establish HTTP proxy tunnel to %s:%hu, xrefs: 0044CECF
CONNECT %s HTTP/%s%s%s%s%s, xrefs: 0044D080
%s:%hu, xrefs: 0044CF0E
User-Agent:, xrefs: 0044D033
Proxy replied OK to CONNECT request, xrefs: 0044D9EA
Host: %s, xrefs: 0044D002
Proxy CONNECT aborted, xrefs: 0044D29F
Proxy CONNECT aborted due to timeout, xrefs: 0044D89A, 0044D8D5
%zd bytes of chunk left, xrefs: 0044D64F
Connect me again please, xrefs: 0044D93F
CONNECT responded chunked, xrefs: 0044D505

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: %s%s%s:%hu$%s:%hu$%zd bytes of chunk left$1.0$1.1$CONNECT$CONNECT %s HTTP/%s%s%s%s%s$CONNECT responded chunked$Connect me again please$Connection:$Content-Length:$Establish HTTP proxy tunnel to %s:%hu$Failed sending CONNECT to proxy$HTTP/1.%d %d$Host:$Host: %s$Ignore %I64d bytes of response-body$Proxy CONNECT aborted$Proxy CONNECT aborted due to select/poll error$Proxy CONNECT aborted due to timeout$Proxy CONNECT connection closed$Proxy CONNECT followed by %zd bytes of opaque data. Data ignored (known bug #39)$Proxy replied OK to CONNECT request$Proxy-Connection:$Proxy-Connection: Keep-Alive$Proxy-authenticate:$Read %zd bytes of chunk, continue$Received HTTP code %d from proxy after CONNECT$TUNNEL_STATE switched to: %d$Transfer-Encoding:$User-Agent:$WWW-Authenticate:$chunk reading DONE$chunked$close
API String ID: 0-416532
Opcode ID: f3bb864199d9f95e702441e84d4cdc8564a584d275db642c3bc83ee9bf1cd575
Instruction ID: 18e9ac2d7a06f88d0e780f6017105091c19cb4a3185fd07021b1e8d3a76774cc
Opcode Fuzzy Hash: f3bb864199d9f95e702441e84d4cdc8564a584d275db642c3bc83ee9bf1cd575
Instruction Fuzzy Hash: 7B52CBB2708B8186EB20DF16E4883AA73A0F749B98F50411BDF9947B55EF7CC545CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0042A600, Relevance: 33.6, APIs: 11, Strings: 8, Instructions: 302networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 0042A8F8
htons.WS2_32 ref: 0042A94B
bind.WS2_32 ref: 0042A9C3
htons.WS2_32 ref: 0042A9FD
bind.WS2_32 ref: 0042AA23
getsockname.WS2_32 ref: 0042AA5A
WSAGetLastError.WS2_32 ref: 0042AA64

Strings

getsockname() failed with errno %d: %s, xrefs: 0042AA7C
Bind to local port %hu failed, trying next, xrefs: 0042A9DC
Couldn't bind to '%s', xrefs: 0042A95C
bind failed with errno %d: %s, xrefs: 0042AABF
Name '%s' family %i resolved to '%s' family %i, xrefs: 0042A87B
Local port: %hu, xrefs: 0042AA85
Local Interface %s is ip %s using address family %i, xrefs: 0042A7AC
Couldn't bind to interface '%s', xrefs: 0042A7D6

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: htons$bind$ErrorLastgetsockname
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3628919538-2769131373
Opcode ID: 0ae58da1949f9afff8250e7c1c126c6e940ae12f66851557f66fbbdcff625933
Instruction ID: 0aa6aefb8b16d188f774b708b68f11bcb6600b85300c6c7f7914af3d40a604be
Opcode Fuzzy Hash: 0ae58da1949f9afff8250e7c1c126c6e940ae12f66851557f66fbbdcff625933
Instruction Fuzzy Hash: 9BC1D475308A9086DB20DB52B4043AF6361FB84BE4F844617EE9A47B94EF7CC555C70A

Uniqueness

Uniqueness Score: -1.00%

Function 004624F0, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

./\, xrefs: 004625C4

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: ./\
API String ID: 0-3176372042
Opcode ID: 6ded1542b74f58fad2292516f739665d6a7adb6dba47926216edbe942f67422e
Instruction ID: ffbf36ad20c5724544878d8546d55197797f0d74499a272a9b7740e146dd4035
Opcode Fuzzy Hash: 6ded1542b74f58fad2292516f739665d6a7adb6dba47926216edbe942f67422e
Instruction Fuzzy Hash: 4F91A472208B91D6D7609F21E54432EB3B0F785B94F54421AEB9947B98FBBCC844CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 00416370, Relevance: 18.4, Strings: 14, Instructions: 855COMMON

Download Yara Rule

Strings

%s; boundary=%s, xrefs: 00416429
couldn't open file "%s", xrefs: 00416E9A
Content-Type: %s, xrefs: 004168FA
Content-Disposition: form-data; name=", xrefs: 004164B8
, xrefs: 00416964
------------------------%08x%08x, xrefs: 004163F7, 004165CD
--%s--, xrefs: 00416FCD
Content-Type: multipart/mixed; boundary=%s, xrefs: 004165EF
; filename="%s", xrefs: 0041675A, 004168BC
Content-Type: multipart/form-data, xrefs: 0041641F
--%sContent-Disposition: attachment, xrefs: 0041662B
--%s, xrefs: 00416495
%s, xrefs: 00416933
--%s--, xrefs: 00416EE8

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: $%s$--%sContent-Disposition: attachment$--%s--$--%s--$Content-Type: %s$Content-Type: multipart/mixed; boundary=%s$%s; boundary=%s$--%s$------------------------%08x%08x$; filename="%s"$Content-Disposition: form-data; name="$Content-Type: multipart/form-data$couldn't open file "%s"
API String ID: 0-3553099412
Opcode ID: 9fbd35aa7f209db35fd8cd1792564467beb35553afa949fcca7b28004eaecf65
Instruction ID: a43b2830a17fdfb69f37ed158d5997a1d1c879b3af57b2b7d142738d78600e3b
Opcode Fuzzy Hash: 9fbd35aa7f209db35fd8cd1792564467beb35553afa949fcca7b28004eaecf65
Instruction Fuzzy Hash: DA729C76319B8086DB50DF12E4407AAA7A1F789BC4F564026EF8E47B59EF3CC485C709

Uniqueness

Uniqueness Score: -1.00%

Function 00467160, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 234timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,00467D55,?,?,?,?,00460588), ref: 004673B5
WideCharToMultiByte.KERNEL32 ref: 00467463
WideCharToMultiByte.KERNEL32 ref: 004674BE

Strings

mL, xrefs: 0046733A, 0046734F, 0046736E, 004674A1, 004674CE, 004674ED
lL, xrefs: 00467258, 0046726D, 00467446, 00467473, 00467480
?, xrefs: 004674B1

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ByteCharMultiWide$InformationTimeZone
String ID: mL$?$lL
API String ID: 1904278450-3670013262
Opcode ID: 4bf8f2c36c359aab32ae9b5f5db9113060855a76139db94217cc97d872789949
Instruction ID: b000f7364369d5854add489a533b58d76bfbdcd449a64e019a3f8866c32feac0
Opcode Fuzzy Hash: 4bf8f2c36c359aab32ae9b5f5db9113060855a76139db94217cc97d872789949
Instruction Fuzzy Hash: 83A1F7B1709B8085FB50CF26E81071A7BA1F786B98F48911BDB99437A9EF3CC441C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00413E00, Relevance: 10.7, Strings: 8, Instructions: 709COMMON

Download Yara Rule

Strings

.%ld, xrefs: 00414124
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00413E3F, 004142D7, 00414343
%, xrefs: 00414034
%ld, xrefs: 00414105
(nil), xrefs: 00414664
-, xrefs: 004140C9
(nil), xrefs: 004145EE
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 004142DE, 0041434A

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: %$%ld$(nil)$(nil)$-$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-2861588038
Opcode ID: 0e725291da20821ff9c479591339fbdd6b3797a57a8c4d74fea0f69677d1abf1
Instruction ID: 7ce463dbc130664866a8cbbdf2eac3d1a3cd040fa54457bf3ffbad350346442c
Opcode Fuzzy Hash: 0e725291da20821ff9c479591339fbdd6b3797a57a8c4d74fea0f69677d1abf1
Instruction Fuzzy Hash: 7A322876208B8541D7349E25A5803EBA751F7C27A8F640317EFAA437D8EB7CC9C68709

Uniqueness

Uniqueness Score: -1.00%

Function 004735B0, Relevance: 10.6, APIs: 7, Instructions: 135COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0047361A
GetLastError.KERNEL32 ref: 00473633
GetLocaleInfoW.KERNEL32 ref: 0047369B
GetLocaleInfoW.KERNEL32 ref: 0047372E
WideCharToMultiByte.KERNEL32 ref: 0047375E

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: InfoLocale$ByteCharErrorLastMultiWide
String ID:
API String ID: 97497842-0
Opcode ID: 162fa76e655f62e48f342dd57192cfa5d92f928d7b87557aa9ac4cb32d5226bb
Instruction ID: 97db6eab7c6de0abeae1f84fa1e48cba5ea8ceeeb898c76f1c084fc89f160466
Opcode Fuzzy Hash: 162fa76e655f62e48f342dd57192cfa5d92f928d7b87557aa9ac4cb32d5226bb
Instruction Fuzzy Hash: 6351B0B6204B808AD728CF36E84079A77A5FB54B99F14811AEF4E87F58DB7CC640D744

Uniqueness

Uniqueness Score: -1.00%

Function 004733A0, Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0047340A
GetLastError.KERNEL32 ref: 00473423
GetLocaleInfoW.KERNEL32 ref: 00473455
GetLocaleInfoA.KERNEL32 ref: 00473498
GetLocaleInfoA.KERNEL32 ref: 00473517
MultiByteToWideChar.KERNEL32 ref: 00473542

Part of subcall function 00465EC0: Sleep.KERNEL32(?,?,?,?,00465BEC), ref: 00465EF4

MultiByteToWideChar.KERNEL32 ref: 00473568

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWide$ErrorLastSleep
String ID:
API String ID: 406007779-0
Opcode ID: e904266738e2eb366e8725b2934370903dd98325af83b4e107b4e95778f61bdd
Instruction ID: ed8063448968d7dbe5bf11de3bbc316f3cfb5c369c31eafcfaa60234928f2c19
Opcode Fuzzy Hash: e904266738e2eb366e8725b2934370903dd98325af83b4e107b4e95778f61bdd
Instruction Fuzzy Hash: 6251BD72204B808AD729CF31E84079A37A5FB48BD9F54461AEF4E47B68DF38C650D788

Uniqueness

Uniqueness Score: -1.00%

Function 0046C860, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 100COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 0046C8C7

Strings

ESP, xrefs: 0046C903
850, xrefs: 0046C93C
1252, xrefs: 0046C966
ESP, xrefs: 0046C916
040a, xrefs: 0046C929

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: InfoLocale
String ID: 040a$1252$850$ESP$ESP
API String ID: 2299586839-1770330732
Opcode ID: f5de885a840cf94c5a246cb766c777c0208ad5d1d3c9385b5fb7f50ebe37a379
Instruction ID: 4e6e06e1fbf34f8d12c7f5523447f929b74cae9f06ce62115c9941a61f5ca9cb
Opcode Fuzzy Hash: f5de885a840cf94c5a246cb766c777c0208ad5d1d3c9385b5fb7f50ebe37a379
Instruction Fuzzy Hash: 2C3106F270664096DF388B14A4C53B9B352E7407C2F55852BD78B0B718FB2DC908C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00418CD0, Relevance: 10.6, APIs: 7, Instructions: 55COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00418CF0
RtlLookupFunctionEntry.KERNEL32 ref: 00418D08
RtlVirtualUnwind.KERNEL32 ref: 00418D42
SetUnhandledExceptionFilter.KERNEL32 ref: 00418DA9
UnhandledExceptionFilter.KERNEL32 ref: 00418DB6
GetCurrentProcess.KERNEL32 ref: 00418DBC
TerminateProcess.KERNEL32 ref: 00418DCA

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
String ID:
API String ID: 3266983031-0
Opcode ID: acde2d345e0f718c11ac7e12cabaf5b18d9b00d9140d02817220e4e837b09da6
Instruction ID: d7cc3f0c487cd12426d2c31f8cfab6936e8e1243b5020f23a1c755ede6b40393
Opcode Fuzzy Hash: acde2d345e0f718c11ac7e12cabaf5b18d9b00d9140d02817220e4e837b09da6
Instruction Fuzzy Hash: 933122B520AF40C2FA409B16F84474973A4F789B84F94411ADB8E57B25DF7CC55ACB08

Uniqueness

Uniqueness Score: -1.00%

Function 00456370, Relevance: 9.1, APIs: 6, Instructions: 110encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 004563BA
CryptImportKey.ADVAPI32 ref: 004564A6
CryptReleaseContext.ADVAPI32 ref: 004564B7
CryptEncrypt.ADVAPI32 ref: 004564EB
CryptDestroyKey.ADVAPI32 ref: 004564F6
CryptReleaseContext.ADVAPI32 ref: 00456503

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID:
API String ID: 3016261861-0
Opcode ID: 3ba492c37778ac28713ff9c57f4d0219f9bee1cb93fa59a423da9b7815465661
Instruction ID: 16c9f988158b86884b01019c7bd57e5720104d88e2570e8a2b6cbe15457a7bab
Opcode Fuzzy Hash: 3ba492c37778ac28713ff9c57f4d0219f9bee1cb93fa59a423da9b7815465661
Instruction Fuzzy Hash: 59418C72208AD08AE7108B66F45039EBBA1F79A784F444016EBDD47B5ACB7DD109DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00456660, Relevance: 9.1, APIs: 6, Instructions: 80encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 004566ED
CryptCreateHash.ADVAPI32 ref: 00456711
CryptHashData.ADVAPI32 ref: 00456732
CryptGetHashParam.ADVAPI32 ref: 00456752
CryptDestroyHash.ADVAPI32 ref: 0045675D
CryptReleaseContext.ADVAPI32 ref: 0045676A

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamRelease
String ID:
API String ID: 3186506766-0
Opcode ID: a41be1ab9e583a3211cbe86c037b72e8f50702a371174f568234a51b9bef8954
Instruction ID: 61b645c84aad8114bff7e27323231f715ba79615f11f6b04ac539b6d5c2a56f7
Opcode Fuzzy Hash: a41be1ab9e583a3211cbe86c037b72e8f50702a371174f568234a51b9bef8954
Instruction Fuzzy Hash: CA319076319A8086EB50CF21E90475AB7B0FB89B94F844215EB8E87B59CF7CC4098B04

Uniqueness

Uniqueness Score: -1.00%

Function 0046DE60, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 125fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,?,?,?,?,?,?,0046E0B6), ref: 0046DF23
GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,0046E0B6), ref: 0046E033
WriteFile.KERNEL32(?,?,?,?,?,?,?,?,0046E0B6), ref: 0046E06E

Strings

..., xrefs: 0046DF99
Microsoft Visual C++ Runtime Library, xrefs: 0046E000

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$Microsoft Visual C++ Runtime Library
API String ID: 3784150691-1400160072
Opcode ID: 226ef7b518c2117cbe9dc6a769243f1fe6b36ee4981da16d3e794de98cf74bca
Instruction ID: 06c1d40aa478eecae307031368e9fdbcecd44f8f1d9a219dc1497ef89d426aa1
Opcode Fuzzy Hash: 226ef7b518c2117cbe9dc6a769243f1fe6b36ee4981da16d3e794de98cf74bca
Instruction Fuzzy Hash: AA518276704B808ADB54CF26E8403AAB3A1F74A7A0F484316EBBA43B95DF7CD515C709

Uniqueness

Uniqueness Score: -1.00%

Function 004183B4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0041A288), ref: 004183E8
FormatMessageA.KERNEL32 ref: 00418454
GetLastError.KERNEL32 ref: 004184C7
SetLastError.KERNEL32 ref: 004184D3

Strings

Unknown error %d (%#x), xrefs: 0041845E

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast$FormatMessage
String ID: Unknown error %d (%#x)
API String ID: 71157656-2414550090
Opcode ID: 3a5d755d4fab77669bc3ac3b8a879641e3c11082faf149fd313662fd0d5134a5
Instruction ID: 96f339f9139ca9121b223d169d0f06e7f8c7f82a30a9e1875808c06aad9fd0f2
Opcode Fuzzy Hash: 3a5d755d4fab77669bc3ac3b8a879641e3c11082faf149fd313662fd0d5134a5
Instruction Fuzzy Hash: DF21A33130878282EB159F27B41076A6B92EBC5BC8F48413EDA4E4BB55EF7DC4818709

Uniqueness

Uniqueness Score: -1.00%

Function 0042FAF0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 0042FB25
CryptGenRandom.ADVAPI32 ref: 0042FB39
CryptReleaseContext.ADVAPI32 ref: 0042FB4A
CryptReleaseContext.ADVAPI32 ref: 0042FB6B

Strings

@, xrefs: 0042FB1D

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: 477fb04b8c0f41af54bbd451bf6e143659ea3268cd8cef9d97d5c4263828ef31
Instruction ID: dc5aec170ef780f159e38d2dbf2e8eefd2ca63437efb5fbd2bb979295c983fdd
Opcode Fuzzy Hash: 477fb04b8c0f41af54bbd451bf6e143659ea3268cd8cef9d97d5c4263828ef31
Instruction Fuzzy Hash: E601FF75718B8082EB00CB22E85475BA761FBC9BD4F845025EB8D5BB59CF7CD045CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00446E10, Relevance: 7.7, Strings: 6, Instructions: 182COMMON

Download Yara Rule

Strings

Ignoring duplicate digest auth header., xrefs: 00446FDA
Authentication problem. Ignoring this., xrefs: 00446F9D, 00447011, 00447053
NTLM, xrefs: 00446F35
Negotiate, xrefs: 00446E90
Digest, xrefs: 00446FBB
Basic, xrefs: 0044702C

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: Authentication problem. Ignoring this.$Basic$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 0-3881471014
Opcode ID: e5d392c302c8843e98bc1a5401d0db5c722175d30d4e1d670bdbc3d1ce031887
Instruction ID: da2da668f4d46c538039c4994f12e57c6e861c90881df88e9631f5e3f7463178
Opcode Fuzzy Hash: e5d392c302c8843e98bc1a5401d0db5c722175d30d4e1d670bdbc3d1ce031887
Instruction Fuzzy Hash: 6361F37130878196FB289F22D60436B7BA0F742788F58801BDF9683755DB3DD51AC70A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A100, Relevance: 6.3, Strings: 5, Instructions: 55COMMON

Download Yara Rule

Strings

Features: , xrefs: 0040A185
%s , xrefs: 0040A150, 0040A1C2
Protocols: , xrefs: 0040A12B
curl 7.51.0 (x86_64-pc-win32) %s, xrefs: 0040A10E
@`L, xrefs: 0040A11D, 0040A137, 0040A178, 0040A1B0

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: %s $@`L$Features: $Protocols: $curl 7.51.0 (x86_64-pc-win32) %s
API String ID: 0-344921250
Opcode ID: f7bdc60936643f48f5f27e9a861f2e698d564a64e30cdaaa39c36d04edd7d0d7
Instruction ID: 4691e6ec1c41284f0e3cd592bd4d0b66ae1c4685b52f943f829142e3c177b4dd
Opcode Fuzzy Hash: f7bdc60936643f48f5f27e9a861f2e698d564a64e30cdaaa39c36d04edd7d0d7
Instruction Fuzzy Hash: 44217CB1742B0492EB10DF16E88435A7330F74AB88F88442BDA0D673A5EB7CC954C70E

Uniqueness

Uniqueness Score: -1.00%

Function 00466720, Relevance: 6.2, APIs: 4, Instructions: 151fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00466848

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 874a21f8e545dd59b22886acc15dbb77d98025f3c8fe32885be09b4a800b727c
Instruction ID: cf590f86eeed8f841a9020015e0a13dccd99df4d9b439ec764c29d264b4d87b3
Opcode Fuzzy Hash: 874a21f8e545dd59b22886acc15dbb77d98025f3c8fe32885be09b4a800b727c
Instruction Fuzzy Hash: 6E51CEB6229BC581DB209F25E40476EB764F385B88F4A511AEF8E87754EF3CC405CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00431460, Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00431494
CryptGetHashParam.ADVAPI32 ref: 004314BA
CryptDestroyHash.ADVAPI32 ref: 004314CE
CryptReleaseContext.ADVAPI32 ref: 004314E3

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 0528aa71ace4f5e0c23ad0d26e666df61b23e247e06e6c3e976f8ea24affebc6
Instruction ID: 8b0dafff62f1cf8d34d4ea0b8d4e2fa1ed688c7b10a01a24d6ba78ea46a6ef51
Opcode Fuzzy Hash: 0528aa71ace4f5e0c23ad0d26e666df61b23e247e06e6c3e976f8ea24affebc6
Instruction Fuzzy Hash: 1F012876208A80C6EB10CF91E55475AB771FB89BD8F584106EB8D0BB69CFBCC049CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0043AFF0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 0043B116
WSAGetLastError.WS2_32 ref: 0043B120

Strings

bind() failed; %s, xrefs: 0043B133

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastbind
String ID: bind() failed; %s
API String ID: 2328862993-1141498939
Opcode ID: caf49a837ff5325693c0d8de6b9bcc25077c9bb950a95aaff9aff5692cc112eb
Instruction ID: 8d516841e23eef6881152935270ab2a2387371371402efd165103739b0c24e2c
Opcode Fuzzy Hash: caf49a837ff5325693c0d8de6b9bcc25077c9bb950a95aaff9aff5692cc112eb
Instruction Fuzzy Hash: 3C417B32205B8486EB188F22E98039E73B0F789B84F44902ADB1D47754DF7DD8A4C744

Uniqueness

Uniqueness Score: -1.00%

Function 00432080, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 004320B7

Strings

%d.%d.%d.%d, xrefs: 004320F8

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast
String ID: %d.%d.%d.%d
API String ID: 1452528299-3491811756
Opcode ID: a5beef631b661cdff40499abf21f90fe32ae3897ef96faca202ceeefa0b5d013
Instruction ID: 3dc2f335d2f42323b505c4b206b036a467994b078233cb4c9affd6a6065dc89f
Opcode Fuzzy Hash: a5beef631b661cdff40499abf21f90fe32ae3897ef96faca202ceeefa0b5d013
Instruction Fuzzy Hash: 4221C4766087C482DB008B26A61036EB760F79ABE0F685217EBDE47B99CB6CC555CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00411CC0, Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

unmatched close brace/bracket, xrefs: 00411FDF
out of memory, xrefs: 00411E3E, 00411E7B
too many globs, xrefs: 00411FE8

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: out of memory$too many globs$unmatched close brace/bracket
API String ID: 0-3324938048
Opcode ID: 1d1eec26c07d1e56efa74989fb39a5c4c4c55d79d1a0b24dae3af4517363e370
Instruction ID: 31e2f638712d1ca5f2aa0a588ce399103a8f9013aa3a00f2726582be2a36b2da
Opcode Fuzzy Hash: 1d1eec26c07d1e56efa74989fb39a5c4c4c55d79d1a0b24dae3af4517363e370
Instruction Fuzzy Hash: FC818A32609B848ADB648F15B4443EB77A5F386B84F84411BDBCA83769DF3CC486C70A

Uniqueness

Uniqueness Score: -1.00%

Function 004055F0, Relevance: 3.9, Strings: 3, Instructions: 154COMMON

Download Yara Rule

Strings

Failed to open %s to write libcurl code!, xrefs: 0040564D
%s, xrefs: 00405680, 004057C0
%s, xrefs: 004056B6, 00405703, 00405748, 00405793

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: %s$%s$Failed to open %s to write libcurl code!
API String ID: 0-3591596397
Opcode ID: 234543eb8e581e89b3c8e70aef27f184315125f3d9a08c514c5b9cdcb1cbe56e
Instruction ID: 948022fbf5a70f1c49e0ddc9a3c717c8e797cf8a104be62c2830c7c9c72ee618
Opcode Fuzzy Hash: 234543eb8e581e89b3c8e70aef27f184315125f3d9a08c514c5b9cdcb1cbe56e
Instruction Fuzzy Hash: C1518EA4746F5081EA249F16A54076B6320F749BD4F88402BEF8D37B69DF7CD842CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0041364E, Relevance: 3.8, Strings: 3, Instructions: 53COMMON

Download Yara Rule

Strings

$, xrefs: 0041368D
I32, xrefs: 00413430
I64, xrefs: 00413449

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: $$I32$I64
API String ID: 0-872934916
Opcode ID: fa6a9ad1b144017a48c2d022ade2040b2c3703da87461119f83892f0bb56d5ea
Instruction ID: d549dabf135f47df9d46b99816f4aaeb870fb8bb484b1d556d883552033ab722
Opcode Fuzzy Hash: fa6a9ad1b144017a48c2d022ade2040b2c3703da87461119f83892f0bb56d5ea
Instruction Fuzzy Hash: C1110872A085A051DB229F36D4103FFBA94AB06B4DF085157CF5653349DA6DC7418B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00435730, Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 0043582A
GetCurrentProcessId.KERNEL32 ref: 00435871

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CurrentProcesshtons
String ID:
API String ID: 2530476045-0
Opcode ID: e14ca365bc88286f43aa9bd30f1dccaae0688a34d72819a3e0eb7d24535b6004
Instruction ID: 3e051d8766c7cfef52c34fd275743753d5d53748ec65c4bcf8767c4529a6c662
Opcode Fuzzy Hash: e14ca365bc88286f43aa9bd30f1dccaae0688a34d72819a3e0eb7d24535b6004
Instruction Fuzzy Hash: F441D4B670ABC0AAC71CDF65EA0029AB7A5F748744F04503AE7A883754DB78E170C70C

Uniqueness

Uniqueness Score: -1.00%

Function 00431400, Relevance: 3.0, APIs: 2, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 0043141C
CryptCreateHash.ADVAPI32 ref: 0043143D

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID:
API String ID: 1914063823-0
Opcode ID: f2ab21801e73175b70f96c10313c4eb8e9699c534165814134d2448c1adc313e
Instruction ID: 390955b18d5544c01d6a96d6482ea59ecdae7ebb2e6fcce6b4033f284e8e73e8
Opcode Fuzzy Hash: f2ab21801e73175b70f96c10313c4eb8e9699c534165814134d2448c1adc313e
Instruction Fuzzy Hash: AAE08671B2899182FB208B75F815F166360FB98B4CF8490109F8C4BB14DF7CC1558F48

Uniqueness

Uniqueness Score: -1.00%

Function 0046C5F0, Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0046C6BA

Part of subcall function 00471130: GetLastError.KERNEL32 ref: 0047119C

Part of subcall function 0045FEC0: RtlReleasePrivilege.NTDLL(?,?,?,?,004664B0,?,?,?,?,00468303), ref: 0045FED5

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorInfoLastPrivilegeRelease
String ID:
API String ID: 2532465754-0
Opcode ID: 34d21a849edad8b7fb186a4dad68939409665808c18afe91c3e6753899810f99
Instruction ID: a07f85f4817691f811a4a060bf36055767f4083cf6657aa3b392d81c0e77eb8f
Opcode Fuzzy Hash: 34d21a849edad8b7fb186a4dad68939409665808c18afe91c3e6753899810f99
Instruction Fuzzy Hash: D451E0B260579181EB209F22A48477A77A5F745B86F48402BEBC987B51EB3DC480CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00435030, Relevance: 1.6, APIs: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00435090

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: htons
String ID:
API String ID: 4207154920-0
Opcode ID: d430aeb7864c15df4bc2b53146709f47f1fac3f5e5c9018bb3972570f3af40b4
Instruction ID: c132369b3e82b6864aec94be42d1ca0b517860416fa6123aad4cc155548078ce
Opcode Fuzzy Hash: d430aeb7864c15df4bc2b53146709f47f1fac3f5e5c9018bb3972570f3af40b4
Instruction Fuzzy Hash: B9313AB2609BC486D754DB66B50078BB3A9FB48784F44002AEBDE43714DB7CE520CB4C

Uniqueness

Uniqueness Score: -1.00%

Function 0045F820, Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

, xrefs: 0045F867

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: cc52103b46af980987f08aa5711dcdc314fecb14fd51eaa88c03e973e1cb2db8
Instruction ID: 82c76eaabdd1dfbba94a6cd6f6009a82845611a02df4484e4cc6e708f2e38e37
Opcode Fuzzy Hash: cc52103b46af980987f08aa5711dcdc314fecb14fd51eaa88c03e973e1cb2db8
Instruction Fuzzy Hash: E1711C727341B48BEB754B1EA410AAA7390F36678DFD52215EBC617B41CA3DF904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0045285E, Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

%02x:, xrefs: 004528A4

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: %02x:
API String ID: 0-959296634
Opcode ID: fb84d0de505600e7aa09680c2608bbbe7f162b13b69497e00579f0a68adfa83a
Instruction ID: 0e1a7a0a40d455068efe880efb0c0d397416aa6ea4750396e2c4914608905c3a
Opcode Fuzzy Hash: fb84d0de505600e7aa09680c2608bbbe7f162b13b69497e00579f0a68adfa83a
Instruction Fuzzy Hash: 3C216036709AC485DB219F12D2403EAA761F38AFD5F084013CF8D27B59CABCD449CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00461CA0, Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 00461CD7

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastValue$CurrentSleepThread
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 1883287227-798102604
Opcode ID: 1aaf12626c02d9b9f7f4a4d6fc085ef3e8b31405635bbfce13b59a2ae4b5ef42
Instruction ID: 08171a8485a98405dd9fc9a220ece30fdae58cd960a88be13d36d27179d69788
Opcode Fuzzy Hash: 1aaf12626c02d9b9f7f4a4d6fc085ef3e8b31405635bbfce13b59a2ae4b5ef42
Instruction Fuzzy Hash: D8019E72A01B8485DB508F16A48035A67B5F79ABC4F59501BDB4953325EF3DC490C709

Uniqueness

Uniqueness Score: -1.00%

Function 004479A0, Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

HTTP/, xrefs: 00447A00

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: HTTP/
API String ID: 0-2417072641
Opcode ID: b41deab5757cec866d812800bc592310d5363b561b9e02edcbc8fbcaa74b00d7
Instruction ID: 7618e738eda69b4f20c98f9241cd7aee4a0fb116f6de772486b7152c5759cb8c
Opcode Fuzzy Hash: b41deab5757cec866d812800bc592310d5363b561b9e02edcbc8fbcaa74b00d7
Instruction Fuzzy Hash: 9801B131318B8081EB109F16E44079EB364E799FE4F581226FF5967BC8DF2DC8428708

Uniqueness

Uniqueness Score: -1.00%

Function 00436DC0, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

QUIT, xrefs: 00436DE9

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: QUIT
API String ID: 0-1967077921
Opcode ID: 11e5d73abc2b3112a123a8597cf3f5363e5eadc69c9113ea760dd1c487001404
Instruction ID: 6e82a45dc22cdae925a79dfc219ce5118ff7b3b3ed75c413001cc678aceec669
Opcode Fuzzy Hash: 11e5d73abc2b3112a123a8597cf3f5363e5eadc69c9113ea760dd1c487001404
Instruction Fuzzy Hash: C511C635701682A2DB58DB25D5413AEB3E1F78A744F54D026CB4C43314DF3DE4A9CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0045F000, Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac22de058223ad6e4619c6c4dcc531e65a390263fc4512585d1f331ab3e86ed
Instruction ID: 7334431312613af909c8623eb9408b9f051d261dc1b32322a94eb8767837a9ea
Opcode Fuzzy Hash: 6ac22de058223ad6e4619c6c4dcc531e65a390263fc4512585d1f331ab3e86ed
Instruction Fuzzy Hash: CCD1FF76618B9086D7208F29E04076FB7A1F395B85F108126EEC913F59DB3EC88DCB06

Uniqueness

Uniqueness Score: -1.00%

Function 00423DD0, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978f63ccd4896818d2c9ce7d0e914eb6a93fc125870159c04eea53fa6b93cc94
Instruction ID: 9f2132b43609cf68f8f8a243fb1e0cfb1be0233a721adb88ce024c269b0ae92c
Opcode Fuzzy Hash: 978f63ccd4896818d2c9ce7d0e914eb6a93fc125870159c04eea53fa6b93cc94
Instruction Fuzzy Hash: FEB16736305B9482CA60DF06F44436A7364F784BA4F95421AEBAE477D4DF3CC495CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0045F510, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b35e35ed89e1c3a802fee8f4f37d9e275ea125df2f40ec9685654bc12a9269
Instruction ID: e22bb89da69bf39da223201dca3505feb89a08bc3bbfdc02da5dd3c624681a93
Opcode Fuzzy Hash: a5b35e35ed89e1c3a802fee8f4f37d9e275ea125df2f40ec9685654bc12a9269
Instruction Fuzzy Hash: B9616D23F8D0A01BC77E4B3DB054F386DD10A6A30B30561B6E6AAD5E97E04ECB157B18

Uniqueness

Uniqueness Score: -1.00%

Function 004628B0, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastValue$CurrentThread
String ID:
API String ID: 526964173-0
Opcode ID: dd789965735a8681535f8a5403b97f32ae52b200e969e4c804df06422ef34872
Instruction ID: b2e3e988202e5dbf875a444be87385b5d7d31191f26ebc5d98ede3cf0a856cd5
Opcode Fuzzy Hash: dd789965735a8681535f8a5403b97f32ae52b200e969e4c804df06422ef34872
Instruction Fuzzy Hash: B7512662708E9491DB348E15D65137B6790F781BA8F190203DAEA03BA8FAFCC845D70B

Uniqueness

Uniqueness Score: -1.00%

Function 004705B0, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e6e19027a0bbade38f3ef157ce979be168f2a9f9de3ef991022c5993d3ac9a
Instruction ID: 89ab6f2182ea864261caca180b8598a3ab845d31494b27015be71c29f3ceac8a
Opcode Fuzzy Hash: d9e6e19027a0bbade38f3ef157ce979be168f2a9f9de3ef991022c5993d3ac9a
Instruction Fuzzy Hash: 3F3105B2A29680C6D7548F25E5506AEB7A1F3D5780F54A02BFB8D87B08DA3CC121CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00423EF8, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840f5aac0a104cffea4c21cc0ce0ef5d80934e250fb474986a5400d9606ac052
Instruction ID: 636a1a0f99c37a9866a8760742108c30b9db1540560f2b4cd29703183bf6e241
Opcode Fuzzy Hash: 840f5aac0a104cffea4c21cc0ce0ef5d80934e250fb474986a5400d9606ac052
Instruction Fuzzy Hash: FC31BF72704B9482CB208F15F0407AAB3A5F3D1BA4F915216EEA957BC8DF7CC996CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00423F3C, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017b26a30f03679a48c56d0273665bb8e4bc616325ae34192c2bce5cded9d56a
Instruction ID: 5ca53b1fb814586d6a1e3c132256e82cf1af280ec18f55a1f004f51464ce841e
Opcode Fuzzy Hash: 017b26a30f03679a48c56d0273665bb8e4bc616325ae34192c2bce5cded9d56a
Instruction Fuzzy Hash: 4331C022718B9482C620CF45F0407AAB3A5F7C5B94F921107EF9907B48DF7DC851CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00423E6C, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0baaae08cf56c424ad6df8cf01e2146f1b05de2c5faddd7f62dd11ce6d8653
Instruction ID: 89eb48d9b4aef11d855ba3f61356fb79bc9de67e9efd7773a412ac7a4b4a419f
Opcode Fuzzy Hash: 4c0baaae08cf56c424ad6df8cf01e2146f1b05de2c5faddd7f62dd11ce6d8653
Instruction Fuzzy Hash: 9521AC72718B9482D7208F06F0407AAB3A5F3D1B94F51120AEF9A57B88DF7DC896CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00423ED5, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151d49b6bba9c223c28d3de9845385128453e5457f77c65d7ed00dc0203a27f2
Instruction ID: 9a7c6acb1117081864a79bc1fe5ab5cddeaef1228138b9f16d105e14f0c193f7
Opcode Fuzzy Hash: 151d49b6bba9c223c28d3de9845385128453e5457f77c65d7ed00dc0203a27f2
Instruction Fuzzy Hash: 2A218B72708B9482D720CF05F0403AAB3A4F3D5B94F55121AEF9A57B98DF79C896CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00423EB2, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abb80280d0855fa785c4108b5eb940fd444223b0144e88608f1b3fb770340ad
Instruction ID: 4fec1fdd7ea38ec0382c71255942e526ff3b1d25f6d8df0dd5e00ff25669976d
Opcode Fuzzy Hash: 7abb80280d0855fa785c4108b5eb940fd444223b0144e88608f1b3fb770340ad
Instruction Fuzzy Hash: BA21AC72718B9482D7208F06F0407AAB3A5F3D1B94F51120AEF9A57B88DF7DC896CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00423F7B, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f001f312ffea12cfd28f62854255cf2eea203b1a61c258d3ed6beef8f6cafb65
Instruction ID: 6b3507ad2baaf4a98da144e96bc987ead9d2d71c4c3c8e209c989177586a8239
Opcode Fuzzy Hash: f001f312ffea12cfd28f62854255cf2eea203b1a61c258d3ed6beef8f6cafb65
Instruction Fuzzy Hash: 8D21AC72718B9482D7208F06F0407AAB3A5F3D1B94F51120AEF9A57B88DF7DC896CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00461FA0, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166851d1d29ce2275dca8cf41f5a5ea37a8e895a69a7f9249a33ce57d041ff1c
Instruction ID: 7df3c6c5a90e0d857a7dbbdf815d23d97f91ee732d79f89497e3be4f41b3a71f
Opcode Fuzzy Hash: 166851d1d29ce2275dca8cf41f5a5ea37a8e895a69a7f9249a33ce57d041ff1c
Instruction Fuzzy Hash: 1D01046361ABD056DA118F21B85077EBBA0E386388F148025EECCA7B16DA6EC405CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00453630, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654146474c745548caac8689ee5cc0a787eb41f402168a614920b0d61bbac1ee
Instruction ID: 7d5842f973b972705347f715c2557c0ef1e493d277a172763225fb91d72d72b0
Opcode Fuzzy Hash: 654146474c745548caac8689ee5cc0a787eb41f402168a614920b0d61bbac1ee
Instruction Fuzzy Hash: B2D0A79291A2E04DDF128E1040183787F604313B82BC4608786C563243C24DC34DC75B

Uniqueness

Uniqueness Score: -1.00%

Function 00431450, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705c5d19e00c7098aea93799445186d59a55bfb6358ebab464b31130d65a1047
Instruction ID: 85bde8039188989a7a1e8878a9f9a5706e51287afe792e72b070de9269db6b1b
Opcode Fuzzy Hash: 705c5d19e00c7098aea93799445186d59a55bfb6358ebab464b31130d65a1047
Instruction Fuzzy Hash: 1CA002B271BD89C0E7108B15F6B0F156770F7D8B99F9590158A0D4A820CF75C542C344

Uniqueness

Uniqueness Score: -1.00%

Function 0043FE58, Relevance: 75.7, APIs: 25, Strings: 18, Instructions: 418networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0043FF7D

Strings

FreeLibrary(wsock2) failed (%d), xrefs: 0044049B
WSAEnumNetworkEvents, xrefs: 004400D7
failed to find WSAEventSelect function (%d), xrefs: 004400B2
insufficient winsock version to support telnet, xrefs: 0043FFC7
WSACreateEvent, xrefs: 0044001D
WSACloseEvent, xrefs: 00440060
WS2_32.DLL, xrefs: 0043FFE0
WSACloseEvent failed (%d), xrefs: 00440476
failed to find WSAEnumNetworkEvents function (%d), xrefs: 004400F7
Time-out, xrefs: 0044044E
WSAStartup failed (%d), xrefs: 0043FF87
failed to find WSACloseEvent function (%d), xrefs: 00440080
, xrefs: 0044040A
WSAEventSelect, xrefs: 0044008C
failed to find WSACreateEvent function (%d), xrefs: 0044003B
WSACreateEvent failed (%d), xrefs: 00440118
WSAEnumNetworkEvents failed (%d), xrefs: 00440356
failed to load WS2_32.DLL (%d), xrefs: 00440002

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Startup
String ID: $FreeLibrary(wsock2) failed (%d)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$WSAStartup failed (%d)$failed to find WSACloseEvent function (%d)$failed to find WSACreateEvent function (%d)$failed to find WSAEnumNetworkEvents function (%d)$failed to find WSAEventSelect function (%d)$failed to load WS2_32.DLL (%d)$insufficient winsock version to support telnet
API String ID: 724789610-3877627569
Opcode ID: ebbb70bd064bc774e1459744d6a69340ce36674c3769f7f9522a00035c7d70dc
Instruction ID: 0cbf78b841dfcafcd1211000251c0899bd2e9a5e69aee4fe15afbaf9ae750785
Opcode Fuzzy Hash: ebbb70bd064bc774e1459744d6a69340ce36674c3769f7f9522a00035c7d70dc
Instruction Fuzzy Hash: 9F02A172308B85C6EB20DF26E88439A73A0F749B84F944526DF8A87765EF7CC555CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0042D0A0, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 0042D125
LoadLibraryA.KERNEL32 ref: 0042D183
GetProcAddress.KERNEL32 ref: 0042D197
FreeLibrary.KERNEL32 ref: 0042D1A5
LoadLibraryA.KERNEL32 ref: 0042D1E3
GetProcAddress.KERNEL32 ref: 0042D1F7
FreeLibrary.KERNEL32 ref: 0042D205
GetProcAddress.KERNEL32 ref: 0042D219

Strings

getnameinfo, xrefs: 0042D0D0
\wship6, xrefs: 0042D1D3
freeaddrinfo, xrefs: 0042D0F3
\ws2_32, xrefs: 0042D173
getaddrinfo, xrefs: 0042D0E7

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Library$AddressProc$FreeLoad$DirectorySystem
String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
API String ID: 1621665182-744132762
Opcode ID: 5ecf28480564f9acf14ca8f76f896e004fb6657e615e2682a5804dd0cd82db9c
Instruction ID: 6d4af1a8ace13b45f1f5077064615dc2eaf294a3fb5c0f556d863b18176092b4
Opcode Fuzzy Hash: 5ecf28480564f9acf14ca8f76f896e004fb6657e615e2682a5804dd0cd82db9c
Instruction Fuzzy Hash: 4B514E7570AF8485EB60CB11F88439A73A4F789BA4F944266DEAD43B64EF7CC015CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0043ECC0, Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 181networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0043EEAB
WSAGetLastError.WS2_32 ref: 0043EEBD
send.WS2_32 ref: 0043EF75
send.WS2_32 ref: 0043EFFD
WSAGetLastError.WS2_32 ref: 0043F007

Strings

%c%c, xrefs: 0043EE78
%c%c%c%c%s%c%c, xrefs: 0043EF27, 0043EFAF
#, xrefs: 0043EF3E
%c%s%c%s, xrefs: 0043EE3E
Sending data failed (%d), xrefs: 0043EEC3, 0043F00D
%c%c%c%c, xrefs: 0043ED97
%127[^,],%127s, xrefs: 0043EE0E

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: send$ErrorLast
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 2200680727-931584821
Opcode ID: f316a9dc4915804870693697d1606c7c33d6bc8e86e1df005a4107c5a3f57527
Instruction ID: f6b341dd1e2fee9ee73d5f1e3fe4c4d51cbe2a24cf6bec064a6668aa873eded0
Opcode Fuzzy Hash: f316a9dc4915804870693697d1606c7c33d6bc8e86e1df005a4107c5a3f57527
Instruction Fuzzy Hash: 38819C72308AC291EB24DF66E4447DAB360F788798F840226EB9D57B99DF7CC149CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00471FE0, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 96libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,0046E015), ref: 0047201C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,0046E015), ref: 00472038
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,0046E015), ref: 00472054
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,0046E015), ref: 0047206B
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,0046E015), ref: 0047208B
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,0046E015), ref: 004720A7

Strings

MessageBoxA, xrefs: 0047202E
GetActiveWindow, xrefs: 0047204A
GetProcessWindowStation, xrefs: 0047209D
GetLastActivePopup, xrefs: 0047205A
user32.dll, xrefs: 00472015
GetUserObjectInformationA, xrefs: 00472081

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-1612076079
Opcode ID: 07378d0cc2c725cd0b3b1ce214d7988079e3a9779f11c526b340e12858bba01c
Instruction ID: 3f5aadab560cb96dea760ab04b3b9d9f7ab813d39c4fb1ead1654ba0431912ae
Opcode Fuzzy Hash: 07378d0cc2c725cd0b3b1ce214d7988079e3a9779f11c526b340e12858bba01c
Instruction Fuzzy Hash: E7412AB4306B9081FE64CF11B9407AA73A5FB48B80F84842ADB4D07724DFBCC415CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB60, Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 141encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32 ref: 0042ED7F

Strings

schannel: failed to retrieve remote cert context, xrefs: 0042ED8D
schannel: failed to setup confidentiality, xrefs: 0042EC01
schannel: failed to setup sequence detection, xrefs: 0042EBCF
schannel: SSL/TLS connection with %s port %hu (step 3/3), xrefs: 0042EB8F
schannel: failed to setup stream orientation, xrefs: 0042EC35
schannel: failed to setup memory allocation, xrefs: 0042EC1B
schannel: failed to store credential handle, xrefs: 0042ECD0
schannel: old credential handle is stale, removing, xrefs: 0042EC90
schannel: failed to setup replay detection, xrefs: 0042EBE8
schannel: stored credential handle in session cache, xrefs: 0042ECEE

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CertCertificateContextFree
String ID: schannel: SSL/TLS connection with %s port %hu (step 3/3)$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle$schannel: old credential handle is stale, removing$schannel: stored credential handle in session cache
API String ID: 3080675121-474070536
Opcode ID: f01bd9b555f01f3abcb8a7eac71ebd2285fd38ae522862356f97c223942d7a58
Instruction ID: 2e1d00e084558f7aed693c31dfb80c8bbff79f7d49be8bf954bf9d79165f371b
Opcode Fuzzy Hash: f01bd9b555f01f3abcb8a7eac71ebd2285fd38ae522862356f97c223942d7a58
Instruction Fuzzy Hash: 42519C72308A9182EA20DF17F5543AE6361E785BD8FC8012AEE894B769EF7CC441C719

Uniqueness

Uniqueness Score: -1.00%

Function 004184F0, Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 126windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00418521
FormatMessageA.KERNEL32 ref: 00418901
GetLastError.KERNEL32 ref: 00418A96
SetLastError.KERNEL32 ref: 00418AAA

Strings

Unknown error, xrefs: 00418A40
%s - %s, xrefs: 00418982
CRYPT_E_REVOKED, xrefs: 004188AD
%s (0x%08X), xrefs: 004188B4
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00418A6A
No error, xrefs: 004189B8
SEC_I_CONTINUE_NEEDED, xrefs: 004189C4

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast$FormatMessage
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 71157656-1752685260
Opcode ID: 9ea28fa248d940cd1311dc329394381287a49431079c0f0e9bd67641e083d3b1
Instruction ID: a536e61bb4163d8a999f940337025174faba8250d78c7b72859ec47068e1a3fd
Opcode Fuzzy Hash: 9ea28fa248d940cd1311dc329394381287a49431079c0f0e9bd67641e083d3b1
Instruction Fuzzy Hash: 7A519E71308B8586EB20DF65E4803EA6361FB85788F84402BDB8D47B96EF3DC545C75A

Uniqueness

Uniqueness Score: -1.00%

Function 0046EAD0, Relevance: 18.3, APIs: 12, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(?,?,0046FEF7,?,?,?,?,0046E672), ref: 0046EB48
GetLastError.KERNEL32(?,?,0046FEF7,?,?,?,?,0046E672), ref: 0046EB68
MultiByteToWideChar.KERNEL32 ref: 0046EC29
MultiByteToWideChar.KERNEL32 ref: 0046ECD6
LCMapStringW.KERNEL32 ref: 0046ECF9
LCMapStringW.KERNEL32 ref: 0046ED48

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: e37419dfec489d44b8fcf179d30d1444cf6bb73c437dc83e2a043aeef44d213a
Instruction ID: 0902b204f8af4bd5253da4b7311b838ec43131065b3b9961d135934957eb00a3
Opcode Fuzzy Hash: e37419dfec489d44b8fcf179d30d1444cf6bb73c437dc83e2a043aeef44d213a
Instruction Fuzzy Hash: 42D19275205BC08AD7248F26E84039A77E5F748BDCF14422AEA5D47B98EB3CC945C709

Uniqueness

Uniqueness Score: -1.00%

Function 0043AAC0, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 216networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 0043AC2C
sendto.WS2_32 ref: 0043ACF9
WSAGetLastError.WS2_32 ref: 0043AD03

Strings

tftp_tx: internal error, event: %i, xrefs: 0043AB01
tftp_tx: giving up waiting for block %d ack, xrefs: 0043ACA0
Timeout waiting for block %d ACK. Retries = %d, xrefs: 0043AB22
Received ACK for block %d, expecting %d, xrefs: 0043AC81

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: b313ae4348bc4a1f0f3864f69c259907dd7a2cb83a1666ffaa0a9a49df7f8e81
Instruction ID: edfed7ecc9eacdfe337e5ce42ba5106080e1bd590c5f00a233ffd05d92c9f491
Opcode Fuzzy Hash: b313ae4348bc4a1f0f3864f69c259907dd7a2cb83a1666ffaa0a9a49df7f8e81
Instruction Fuzzy Hash: A0A168B6208B91C6CB11CF2AE4807AA77B1F788F89F485126DF8D4B718DB38D451CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040A490, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32 ref: 0040A4B8
GetEnvironmentVariableA.KERNEL32 ref: 0040A4F3
GetEnvironmentVariableA.KERNEL32 ref: 0040A543
ExpandEnvironmentStringsA.KERNEL32 ref: 0040A57F
GetEnvironmentVariableA.KERNEL32 ref: 0040A5E4
ExpandEnvironmentStringsA.KERNEL32 ref: 0040A623

Strings

HOME, xrefs: 0040A4E6
%USERPROFILE%\Application Data, xrefs: 0040A5CA
APPDATA, xrefs: 0040A52C
CURL_HOME, xrefs: 0040A4AB

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Environment$Variable$ExpandStrings
String ID: %USERPROFILE%\Application Data$APPDATA$CURL_HOME$HOME
API String ID: 1313645947-734137483
Opcode ID: f712f36dfa8886fbad7de0c1bb30c7a45b40a1fe8136f8e5089dab360721b1fd
Instruction ID: bf99471f9b74a13d48b658424f25f2b202692eee50eed9da52bd9fe9c9593e9f
Opcode Fuzzy Hash: f712f36dfa8886fbad7de0c1bb30c7a45b40a1fe8136f8e5089dab360721b1fd
Instruction Fuzzy Hash: A3417551308BC095EF31AB11E9403AA63A0F798789F884426DB8D67798EF7CC655CB0E

Uniqueness

Uniqueness Score: -1.00%

Function 00462EE0, Relevance: 16.7, APIs: 11, Instructions: 220COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00462F70

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ff7e8945b65b6a2c19464fc4b075dc14773c4bfb9f11cc2bb49543cdd22083ac
Instruction ID: d2b88212cf43ba72ec5977c8133fc14e637c4e50686cf92f7939102246d3a58d
Opcode Fuzzy Hash: ff7e8945b65b6a2c19464fc4b075dc14773c4bfb9f11cc2bb49543cdd22083ac
Instruction Fuzzy Hash: A9A1A432218B80C2D7208F65E45432FB3B1F785B69F14421AEF99477A8EBBCC545CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A790, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 180COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 0043A914
sendto.WS2_32 ref: 0043A993
sendto.WS2_32 ref: 0043AA52

Strings

Received unexpected DATA packet block %d, expecting block %d, xrefs: 0043AA91
Received last DATA packet block %d again., xrefs: 0043A9E0
Timeout waiting for block %d ACK. Retries = %d, xrefs: 0043A807
tftp_rx: internal error, xrefs: 0043A7CB

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: sendto
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 1876886790-1785996722
Opcode ID: 85fe105b184869f8b557cd1eec8746ca81c08122ba90a1b63803609470b5fbc3
Instruction ID: e8899ef2a0bba414fae5339c6e12b68af5d1328276dcffabc8dd2c0528e82e30
Opcode Fuzzy Hash: 85fe105b184869f8b557cd1eec8746ca81c08122ba90a1b63803609470b5fbc3
Instruction Fuzzy Hash: 9B817D76208B90C2CB11DF29D44039A7BB0F798F88F988126DF8C4B768DB39C456C755

Uniqueness

Uniqueness Score: -1.00%

Function 0042CDD0, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 177networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 0042CEEA
getservbyport.WS2_32 ref: 0042CF1E
inet_ntoa.WS2_32 ref: 0042CFB2
gethostbyaddr.WS2_32 ref: 0042CFD8
WSAGetLastError.WS2_32 ref: 0042D00E
inet_ntoa.WS2_32 ref: 0042D03B

Strings

udp, xrefs: 0042CF07
65535, xrefs: 0042CDE3

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: inet_ntoa$ErrorLastgethostbyaddrgetservbyporthtons
String ID: 65535$udp
API String ID: 1483625650-1267037602
Opcode ID: 7ba5bde4fa44a5387480ed6a44c303012c7955da357db5a1108f9fa9fe509970
Instruction ID: 0c1efdb919823f422cba87356026b46107738434854428374aec279b2463541e
Opcode Fuzzy Hash: 7ba5bde4fa44a5387480ed6a44c303012c7955da357db5a1108f9fa9fe509970
Instruction Fuzzy Hash: 7661A222709BA086EB208F11F18436F6361FB45B94F994127EE9947BA4DF7CC846C71E

Uniqueness

Uniqueness Score: -1.00%

Function 0046E760, Relevance: 15.1, APIs: 10, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0046E77D
GetLastError.KERNEL32 ref: 0046E797
GetEnvironmentStringsW.KERNEL32 ref: 0046E7C0
WideCharToMultiByte.KERNEL32 ref: 0046E826
WideCharToMultiByte.KERNEL32 ref: 0046E861
FreeEnvironmentStringsW.KERNEL32 ref: 0046E879
FreeEnvironmentStringsW.KERNEL32 ref: 0046E8A3
GetEnvironmentStrings.KERNEL32 ref: 0046E8B6
FreeEnvironmentStringsA.KERNEL32 ref: 0046E8FA
FreeEnvironmentStringsA.KERNEL32 ref: 0046E927

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 4109468225-0
Opcode ID: 60360142248fab3bef551299ae01ce7770b38d3279c7d27d2b2366f31c37e9d7
Instruction ID: 384a8359828526eb0ee973967ab25e051131325adfd0816966f82574c6c5a798
Opcode Fuzzy Hash: 60360142248fab3bef551299ae01ce7770b38d3279c7d27d2b2366f31c37e9d7
Instruction Fuzzy Hash: 7E418375A09B8086EB209F23A94431AA7E1FB49BD1F98041ADF4D47B58FF7CD445C70A

Uniqueness

Uniqueness Score: -1.00%

Function 0043B3D9, Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 262COMMON

Download Yara Rule

Strings

%I64d, xrefs: 0043B51A
blksize, xrefs: 0043B61D
0, xrefs: 0043B530
%s%c%s%c, xrefs: 0043B4A7
tsize, xrefs: 0043B553
timeout, xrefs: 0043B6DC

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: %I64d$%s%c%s%c$0$blksize$timeout$tsize
API String ID: 0-2745715247
Opcode ID: c914789099056b407111b2ba0470c6f775f4f139335736a3b5ef7fba9e539587
Instruction ID: 6974e2becbd5f5f926db0792cc86c76d71e60a3f1e88245d6a46037db30a59ec
Opcode Fuzzy Hash: c914789099056b407111b2ba0470c6f775f4f139335736a3b5ef7fba9e539587
Instruction Fuzzy Hash: 4BB17A76208B85C1CB20CF25E04039A7760F789BA9F849312DFAD4B7D9DB78C50AC794

Uniqueness

Uniqueness Score: -1.00%

Function 0042CA10, Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 0042CD15
inet_ntoa.WS2_32 ref: 0042CDA2

Strings

udp, xrefs: 0042CB6C
tcp, xrefs: 0042CB97

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: htonlinet_ntoa
String ID: tcp$udp
API String ID: 298042256-3725065008
Opcode ID: 9776c463be81c6903042e4eed922ee139dd2138a4e4c8722efeb919f402d543d
Instruction ID: e2ec445f5325e6851737b85392dbe3ad1d55d375539184ef57c72e5b3001db89
Opcode Fuzzy Hash: 9776c463be81c6903042e4eed922ee139dd2138a4e4c8722efeb919f402d543d
Instruction Fuzzy Hash: 94A1CE32705B6082DB29CF16B58032F76A1FB94B84F99812BEE4E87714EB7CC844D749

Uniqueness

Uniqueness Score: -1.00%

Function 0043B980, Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 197COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 0043B9E7
sendto.WS2_32 ref: 0043BC79
sendto.WS2_32 ref: 0043BCEB

Strings

Received too short packet, xrefs: 0043BA33
TFTP finished, xrefs: 0043BBFA
Internal error: Unexpected packet, xrefs: 0043BAB3
Internal state machine error, xrefs: 0043BBDD
%s, xrefs: 0043BB13, 0043BC01

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: sendto$recvfrom
String ID: %s$Internal error: Unexpected packet$Internal state machine error$Received too short packet$TFTP finished
API String ID: 4052786580-602509964
Opcode ID: 67350796953d54f2e47a32d503ad389c2caf852c9ea6b65b358461a3ce221544
Instruction ID: 84fd2684b9fd2eca4dbe0a001ca48a921e18df9e2ec43c6f3d6f3ee69e1904c5
Opcode Fuzzy Hash: 67350796953d54f2e47a32d503ad389c2caf852c9ea6b65b358461a3ce221544
Instruction Fuzzy Hash: 15916C76218AD1C6DB60DF26D4403AA77A0F389B88F489136DF894BB48DF3DC406CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00470DD0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 103memorylibraryloaderCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00470E34
GetSystemInfo.KERNEL32 ref: 00470E4B
GetModuleHandleA.KERNEL32 ref: 00470E68
GetProcAddress.KERNEL32 ref: 00470E7D
VirtualAlloc.KERNEL32 ref: 00470F07
VirtualProtect.KERNEL32 ref: 00470F1F

Strings

SetThreadStackGuarantee, xrefs: 00470E73
kernel32.dll, xrefs: 00470E61

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Virtual$AddressAllocHandleInfoModuleProcProtectQuerySystem
String ID: SetThreadStackGuarantee$kernel32.dll
API String ID: 3290314748-423161677
Opcode ID: 9d35b5c34de3a4d54cc351f01a3accc24e4ef63b413c0e8155ab77e470bb5e4c
Instruction ID: abc13426b3abdb6acb7173489a91e326a5f4521e4dab3032d68310694f11afd2
Opcode Fuzzy Hash: 9d35b5c34de3a4d54cc351f01a3accc24e4ef63b413c0e8155ab77e470bb5e4c
Instruction Fuzzy Hash: BA411876311B809AEB30CF25E9507D933A5F748B88F948416DE4D8BB18DF78D689C744

Uniqueness

Uniqueness Score: -1.00%

Function 00417240, Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 420COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00417570
SetLastError.KERNEL32 ref: 0041757A
GetLastError.KERNEL32 ref: 00417595
SetLastError.KERNEL32 ref: 004175A3

Strings

%02d:%02d%n, xrefs: 00417540
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 0041730D
%02d:%02d:%02d%n, xrefs: 004174FF
GMT, xrefs: 0041740F

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 1452528299-988243589
Opcode ID: 3df68456024fffa083826009d4bf99d78d63ff7e6c02c801be9c05fd8a460603
Instruction ID: 73a80a64feb8783d563d2fa4524399d3ed4915471da1f621160ae32c0cc43962
Opcode Fuzzy Hash: 3df68456024fffa083826009d4bf99d78d63ff7e6c02c801be9c05fd8a460603
Instruction Fuzzy Hash: 10F1D97261CA4086CB208F19E44039AB7B1F7857A4F645217EFAA57BE4DB7CD881CF09

Uniqueness

Uniqueness Score: -1.00%

Function 0043F410, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 0043F489
htons.WS2_32 ref: 0043F49F
send.WS2_32 ref: 0043F546
WSAGetLastError.WS2_32 ref: 0043F550
send.WS2_32 ref: 0043F635
WSAGetLastError.WS2_32 ref: 0043F661

Strings

Sending data failed (%d), xrefs: 0043F556, 0043F667

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: 697e69644b1815f3942b3fb9bf09f415a890aee37284e2fdcba42f4eac988570
Instruction ID: f03a59a509bd6a757eb6c796a5136a2a504a4017695da9ce4e0e828821ec52ef
Opcode Fuzzy Hash: 697e69644b1815f3942b3fb9bf09f415a890aee37284e2fdcba42f4eac988570
Instruction Fuzzy Hash: C961A932608B8481CB109F26E45479E7761F3A9F89F949622DF8A43B29DF3CC04AC709

Uniqueness

Uniqueness Score: -1.00%

Function 00419E30, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0042DB40: WaitForSingleObject.KERNEL32(?,?,?,?,0041A3A5,?,?,?,?,0041C3BA), ref: 0042DB59
Part of subcall function 0042DB40: CloseHandle.KERNEL32(?,?,?,?,0041A3A5,?,?,?,?,0041C3BA), ref: 0042DB69

EnterCriticalSection.KERNEL32 ref: 00419EF5
LeaveCriticalSection.KERNEL32 ref: 00419F09
CloseHandle.KERNEL32 ref: 00419F16
DeleteCriticalSection.KERNEL32 ref: 00419F34

Strings

Could not resolve %s: %s, xrefs: 00419ED0
proxy, xrefs: 00419EAC
host, xrefs: 00419EBA

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterLeaveObjectSingleWait
String ID: Could not resolve %s: %s$host$proxy
API String ID: 2761528079-2205167006
Opcode ID: cd81cb6db3a1275bd8b0a062c488c28e44644523446ad768243b89dce23adca6
Instruction ID: d8bcae779fee246e68ebcfc6a0887e7478f3dbe53218615b9a8ef4afdb1198e1
Opcode Fuzzy Hash: cd81cb6db3a1275bd8b0a062c488c28e44644523446ad768243b89dce23adca6
Instruction Fuzzy Hash: 0D412876709B4092EB68DF22E56439AB370F784B84F444016DB5E47B55CF3CE8958B44

Uniqueness

Uniqueness Score: -1.00%

Function 00470C00, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32 ref: 00470C52
GetFullPathNameA.KERNEL32 ref: 00470CCE
GetCurrentDirectoryA.KERNEL32 ref: 00470CE0

Strings

., xrefs: 00470CC4
:, xrefs: 00470CBF
\, xrefs: 00470C43
:, xrefs: 00470C3E

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CurrentDirectoryDriveFullNamePathType
String ID: .$:$:$\
API String ID: 3995704478-3772505838
Opcode ID: 05197da65e64482b56cc07329e1a3e1807b7a207be2cc11fcfa8e8afc6a8162a
Instruction ID: 9ff529ff8f45e12cd500f1d91e15d72e36cabf1e03da74b53d60244852035b15
Opcode Fuzzy Hash: 05197da65e64482b56cc07329e1a3e1807b7a207be2cc11fcfa8e8afc6a8162a
Instruction Fuzzy Hash: DE319062209780C9EB369B25A40439F7790F799788F488216DB8E87B45DB7DC505C719

Uniqueness

Uniqueness Score: -1.00%

Function 00404500, Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 132COMMON

Download Yara Rule

Strings

Error creating directory %s., xrefs: 00404679
%s%s, xrefs: 004045DC, 00404617
No space left on the file system that will contain the directory %s., xrefs: 0040469D
%s resides on a read-only file system., xrefs: 00404694
Cannot create directory %s because you exceeded your quota., xrefs: 00404682
The directory name %s is too long., xrefs: 0040468B
You don't have permission to create %s., xrefs: 004046A6

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID: %s resides on a read-only file system.$%s%s$Cannot create directory %s because you exceeded your quota.$Error creating directory %s.$No space left on the file system that will contain the directory %s.$The directory name %s is too long.$You don't have permission to create %s.
API String ID: 0-1086585624
Opcode ID: f4e44c2c6a36985c11bd4a6f273c972eee063454c447ac5ff2c5261a60dc277e
Instruction ID: 68d4d3a2fc89c293ea99f565a2dc190fd0b17aebc42d168ffb6fae6df6188e22
Opcode Fuzzy Hash: f4e44c2c6a36985c11bd4a6f273c972eee063454c447ac5ff2c5261a60dc277e
Instruction Fuzzy Hash: C841E3B1304B4081DA14DF26A8003AA6361F787BD8F944A27EF5A57BE5EF3DC546C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00472FB0, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

__shl_12.LIBCMT ref: 00473245
__shr_12.LIBCMT ref: 00473265
__shl_12.LIBCMT ref: 0047329B
__shl_12.LIBCMT ref: 004732A5
__shl_12.LIBCMT ref: 004732BE

Strings

?, xrefs: 00473036

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: __shl_12$__shr_12
String ID: ?
API String ID: 4261834660-1684325040
Opcode ID: 3c504777e8cb1e4de4f2ce0b06a871166aaea242c25905cd9b7a67eed60350ab
Instruction ID: 8cce6b5220a39b4082be0018fdc87cccbb00e4a59383101acd819b94e24a9200
Opcode Fuzzy Hash: 3c504777e8cb1e4de4f2ce0b06a871166aaea242c25905cd9b7a67eed60350ab
Instruction Fuzzy Hash: 44A123222187C086D722CF29E2443AEBBA0F352709F44D11AEBDD47B95DB7CCA15D71A

Uniqueness

Uniqueness Score: -1.00%

Function 00471500, Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001C,0046D85D,?,0046E672), ref: 00471591
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001C,0046D85D), ref: 004715A7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001C,0046D85D,?,0046E672), ref: 0047161F
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001C,0046D85D,?,0046E672), ref: 004716CB
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001C,0046D85D,?,0046E672), ref: 00471709

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 09360d08271dff065c2f5943c73fc518a284fa12060ce497d80e602dfc084a12
Instruction ID: 86a2bd8747426a93564261b7f749e599d7728c1c16276693e00f32644a7f1253
Opcode Fuzzy Hash: 09360d08271dff065c2f5943c73fc518a284fa12060ce497d80e602dfc084a12
Instruction Fuzzy Hash: DA816F72200BC08AD724CF2AE8407DA77A9F784BD8F14861AEA5E4BF68DF38C555C744

Uniqueness

Uniqueness Score: -1.00%

Function 0043F200, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 113networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0043F2CC
WSAGetLastError.WS2_32 ref: 0043F2D6
send.WS2_32 ref: 0043F399
WSAGetLastError.WS2_32 ref: 0043F3A3

Strings

SENT, xrefs: 0043F2F2, 0043F3BF
Sending data failed (%d), xrefs: 0043F2DC, 0043F3A9

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 859feea9dea4765fd798de4610a0b27da7faa6bfa08ac63a33134810979a2e0b
Instruction ID: fe25705ac8abae98a1d5a9225ea9a5e05b68a2ba29e29d5073189ed7895aedbb
Opcode Fuzzy Hash: 859feea9dea4765fd798de4610a0b27da7faa6bfa08ac63a33134810979a2e0b
Instruction Fuzzy Hash: 4A51A076604B91C6DB24DF26E04475EB760F389B9CF45522AEE8A47B58DB7CC409CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0043E170, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0043E2B6
WSAGetLastError.WS2_32 ref: 0043E2C0

Strings

SENT, xrefs: 0043E32D
Sending data failed (%d), xrefs: 0043E2C6, 0043E312

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: b43e6837468b5a26aa943aa02dc6ce80ec8c2266cb8383af3961105ece6a759d
Instruction ID: 616bacd154e1fe8757c987cbcbedc1aaf687be650056c326c65a8e6ac70820da
Opcode Fuzzy Hash: b43e6837468b5a26aa943aa02dc6ce80ec8c2266cb8383af3961105ece6a759d
Instruction Fuzzy Hash: B6417F36608AC1C2D7218B5AE04575ABB20F389BDCF985117DF8817BA9CBBDC149CB09

Uniqueness

Uniqueness Score: -1.00%

Function 0046D620, Relevance: 9.2, APIs: 6, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,0046E672), ref: 0046D690
GetLastError.KERNEL32(?,0046E672), ref: 0046D6AD
MultiByteToWideChar.KERNEL32(?,0046E672), ref: 0046D731
MultiByteToWideChar.KERNEL32(?,0046E672), ref: 0046D7D4
GetStringTypeW.KERNEL32(?,0046E672), ref: 0046D7EA

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: f8d7513c89f4954f792a876bcc7487f1ce2a3571adf797a6a36efe2f75971aa2
Instruction ID: a779e4277c930c2703044a6ddf85da92475c73a9b1ce307bca9083b41b3eedf6
Opcode Fuzzy Hash: f8d7513c89f4954f792a876bcc7487f1ce2a3571adf797a6a36efe2f75971aa2
Instruction Fuzzy Hash: 9E61C272B10B908AD7209F25E84079A33A5F7487D8F54412AEE4D8BB58EF38C940C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00472AD0, Relevance: 9.1, APIs: 6, Instructions: 111memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0046B600: SetFilePointer.KERNEL32(?,?,?,?,0046B74A,?,?,?,?,?,?,?,?,00466CD7), ref: 0046B657
Part of subcall function 0046B600: GetLastError.KERNEL32(?,?,?,?,0046B74A,?,?,?,?,?,?,?,?,00466CD7), ref: 0046B664

GetProcessHeap.KERNEL32 ref: 00472B31
HeapAlloc.KERNEL32 ref: 00472B46
GetProcessHeap.KERNEL32 ref: 00472BC5
HeapFree.KERNEL32 ref: 00472BD3
SetEndOfFile.KERNEL32 ref: 00472BFA
GetLastError.KERNEL32 ref: 00472C20

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Heap$ErrorFileLastProcess$AllocFreePointer
String ID:
API String ID: 1354853467-0
Opcode ID: a4d0be4e4ab2e0bfed47f5757a89a31a4c621e5c5749b558f91e5d487a1f9d8b
Instruction ID: 7974eeed95208896192156a5350c54b5eee653724f7ef6a1202c9e7e58e577f6
Opcode Fuzzy Hash: a4d0be4e4ab2e0bfed47f5757a89a31a4c621e5c5749b558f91e5d487a1f9d8b
Instruction Fuzzy Hash: 6441F431304F8086D7156F36A90035E73A1F784BE4F54831AEE1A8B7A4DFBCC9458B4A

Uniqueness

Uniqueness Score: -1.00%

Function 0045B3B0, Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 246COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 0045B5C7

Strings

GSSAPI handshake failure (empty security message), xrefs: 0045B424, 0045B528
GSSAPI handshake failure (invalid security data), xrefs: 0045B53B
GSSAPI handshake failure (invalid security layer), xrefs: 0045B596

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 2009864989-242323837
Opcode ID: 3d48c29c34324fef7321ec0b9562e92cc07974c16820ebed6d7410347468524d
Instruction ID: 90a03074b0a19fa710a09addec620546fe22cbfd913bb01613f97fce98b201dd
Opcode Fuzzy Hash: 3d48c29c34324fef7321ec0b9562e92cc07974c16820ebed6d7410347468524d
Instruction Fuzzy Hash: 95B13D76609B80C6EB60DF26E44479AB3A0F788B95F548126EF8E43B59DF3CC449CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0043BD20, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00460840: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00474182,?,?,?,?,?,?,?,?,?,?,0047433F), ref: 0046084E

WSAGetLastError.WS2_32 ref: 0043BE7F

Strings

TFTP finished, xrefs: 0043BE02
Internal state machine error, xrefs: 0043BDE5
%s, xrefs: 0043BE09
TFTP response timeout, xrefs: 0043BDAA

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: %s$Internal state machine error$TFTP finished$TFTP response timeout
API String ID: 2781989572-1506147383
Opcode ID: 24dc23132c6d2af774ace7b0ce51a1afc85b97d22226539bfa1da08fc974088f
Instruction ID: cdc5666a050d5ef8acc6ffea8a57c74da37316331191ee29bef748a280d09391
Opcode Fuzzy Hash: 24dc23132c6d2af774ace7b0ce51a1afc85b97d22226539bfa1da08fc974088f
Instruction Fuzzy Hash: 54518176304B4586DB20DF3AE84139A77A0F788B98F645117DF5987759EB3CC801C789

Uniqueness

Uniqueness Score: -1.00%

Function 00431CA0, Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00431F15
SetLastError.KERNEL32 ref: 00431FD8
SetLastError.KERNEL32 ref: 00431FE3

Strings

%d.%d.%d.%d, xrefs: 00431F47
%lx, xrefs: 00431EBB

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast
String ID: %d.%d.%d.%d$%lx
API String ID: 1452528299-1067823383
Opcode ID: 8776bab029c8185ed7934378a58108ef1119390bf53a4e39980b003ebaf7ea57
Instruction ID: 5f78226ba4ceef8b054e815fdd4b4ae07a00fcba224aa5ca3d0ce078282118fe
Opcode Fuzzy Hash: 8776bab029c8185ed7934378a58108ef1119390bf53a4e39980b003ebaf7ea57
Instruction Fuzzy Hash: 5BA1D537608AC486D720CB69E4407AEB7A1F389794F245217DFA983FA8DB3DC445CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00474160, Relevance: 7.6, APIs: 5, Instructions: 93timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 004741F8
LocalFileTimeToFileTime.KERNEL32 ref: 00474210
SystemTimeToFileTime.KERNEL32 ref: 00474284
LocalFileTimeToFileTime.KERNEL32 ref: 00474298
SetFileTime.KERNEL32 ref: 004742B8

Part of subcall function 00460840: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00474182,?,?,?,?,?,?,?,?,?,?,0047433F), ref: 0046084E

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Time$File$System$Local
String ID:
API String ID: 2859370177-0
Opcode ID: a59d0c09171c45b1f9cd0a72ea3d29b75efa3aa651d7f981239e9adfb65a9a65
Instruction ID: 5eeade30b6888b6effb62f3f38a2e08e6c2ad8dbd250e471f2c2672e109b68fb
Opcode Fuzzy Hash: a59d0c09171c45b1f9cd0a72ea3d29b75efa3aa651d7f981239e9adfb65a9a65
Instruction Fuzzy Hash: 8541502661868186DB109F61E48037F73B0FB88B85F545016FB8D877A8FB7CC855CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00419FE0, Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0041A029
LeaveCriticalSection.KERNEL32 ref: 0041A036

Strings

Could not resolve %s: %s, xrefs: 0041A094
proxy, xrefs: 0041A070
host, xrefs: 0041A07E

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Could not resolve %s: %s$host$proxy
API String ID: 3168844106-2205167006
Opcode ID: e3544a08843e38cb87c47b9615515de5a751f6c9a910248825d1854edbeee384
Instruction ID: c032e7585d99521cdaf7c81febae2df9f7eae9c98a757e724767c5996a6abf38
Opcode Fuzzy Hash: e3544a08843e38cb87c47b9615515de5a751f6c9a910248825d1854edbeee384
Instruction Fuzzy Hash: 9C414B76609A80D7C714DF26E54079AB3B4F348B88F548027EB9E83B14DB3CE8A5CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00474000, Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9024fe93c81c83f7142b83ed0be11f5713054db8f77f5f8989237988172bdb4f
Instruction ID: a40e1e8f0835562326f9f5eb7bfb04983b0ae703f92cda706f97408f472a6256
Opcode Fuzzy Hash: 9024fe93c81c83f7142b83ed0be11f5713054db8f77f5f8989237988172bdb4f
Instruction Fuzzy Hash: D0214DA1708A9182EB20CF25E8407B66360E7C4779F448356EBBD467E4DB6CC989CF49

Uniqueness

Uniqueness Score: -1.00%

Function 004149C0, Relevance: 7.5, APIs: 5, Instructions: 40timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00414A02
GetCurrentProcessId.KERNEL32 ref: 00414A0D
GetCurrentThreadId.KERNEL32 ref: 00414A19
GetTickCount.KERNEL32 ref: 00414A25
QueryPerformanceCounter.KERNEL32 ref: 00414A36

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: aa0d563a173986655b064f9f203aee48e98d2f42f87126848ff1f0f9f1087077
Instruction ID: 64b63b0cd7bda0d8bc39ef1bc922ad2d6f90863ea8d934560a677f495f72155a
Opcode Fuzzy Hash: aa0d563a173986655b064f9f203aee48e98d2f42f87126848ff1f0f9f1087077
Instruction Fuzzy Hash: C7012DB5216F4082EA40DF26F940346B3A5FB89BD5F996611DF9E177A4CF3CC8948B04

Uniqueness

Uniqueness Score: -1.00%

Function 00467F20, Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00467F2E
FlsGetValue.KERNEL32 ref: 00467F3C
SetLastError.KERNEL32 ref: 00467F99

Part of subcall function 00465F30: Sleep.KERNEL32(?,?,?,?,00468298), ref: 00465F75

FlsSetValue.KERNEL32 ref: 00467F68
GetCurrentThreadId.KERNEL32 ref: 00467F87

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastValue$CurrentSleepThread
String ID:
API String ID: 1883287227-0
Opcode ID: 9b3f4db3ee8057387a06aa22c1e11c535bb0ae4bb75d3a64d4bb9bfd34866640
Instruction ID: aa616edc40467d0078227de07b96f69ffe311a83c68da479046e6665ed51b80d
Opcode Fuzzy Hash: 9b3f4db3ee8057387a06aa22c1e11c535bb0ae4bb75d3a64d4bb9bfd34866640
Instruction Fuzzy Hash: 3A015AB1206B408AEB489F21F884B59B3B1F749B68F98422DCB5D4B395EF3CC405CB19

Uniqueness

Uniqueness Score: -1.00%

Function 00467E80, Relevance: 7.5, APIs: 5, Instructions: 34threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,00461329), ref: 00467E8E
FlsGetValue.KERNEL32(?,?,?,?,00461329), ref: 00467E9C
SetLastError.KERNEL32(?,?,?,?,00461329), ref: 00467EF9

Part of subcall function 00465F30: Sleep.KERNEL32(?,?,?,?,00468298), ref: 00465F75

FlsSetValue.KERNEL32(?,?,?,?,00461329), ref: 00467EC8
GetCurrentThreadId.KERNEL32 ref: 00467EE7

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastValue$CurrentSleepThread
String ID:
API String ID: 1883287227-0
Opcode ID: 61e4f1dfc9f98fb06d09cfc52d082657e2c0e0d3040cd91f869d2f77336a5192
Instruction ID: 35d5cda5953268759b41fd9dffb6c4a2bcf6a44d8f1366d04e021acd318405a3
Opcode Fuzzy Hash: 61e4f1dfc9f98fb06d09cfc52d082657e2c0e0d3040cd91f869d2f77336a5192
Instruction Fuzzy Hash: 7F0178B5206B8086EB449F21F84871973B1F74DB68F988229CB5D47794EF3DC809CB08

Uniqueness

Uniqueness Score: -1.00%

Function 004427B0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 118networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00442987

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00442992
We got a 421 - timeout!, xrefs: 00442948
FTP response timeout, xrefs: 0044296D

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1452528299-2064316097
Opcode ID: 84efcd3648ba2f38d3fee84cd4bac6d18fcef91d6e18cba5fa564c50173e2748
Instruction ID: 5997d719b56003f1c1952bcc5c5f5a5579c38d3fbdda177bad9a4a6fb19b56e2
Opcode Fuzzy Hash: 84efcd3648ba2f38d3fee84cd4bac6d18fcef91d6e18cba5fa564c50173e2748
Instruction Fuzzy Hash: 1E41CCB2304B84C2EB60AF16E54475E77A4F388B88F95421AEBAC87754EF7CC545CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0043F690, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0043F798
WSAGetLastError.WS2_32 ref: 0043F7A2

Strings

SENT, xrefs: 0043F7BD
Sending data failed (%d), xrefs: 0043F7A8

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 350b657650f9c6072c077b41af443fc5920654c5e25e2c485b43b4dfcb2bbf40
Instruction ID: 469b24c5e25208bb679edb05f899ec565374f72b99e66999244a3b5c18fe576c
Opcode Fuzzy Hash: 350b657650f9c6072c077b41af443fc5920654c5e25e2c485b43b4dfcb2bbf40
Instruction Fuzzy Hash: B1418832604B558AD7289F1AE04076A7760F349BCCF64612EDB8607B58CF7DC449C70C

Uniqueness

Uniqueness Score: -1.00%

Function 0043E350, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0043E457
WSAGetLastError.WS2_32 ref: 0043E461

Strings

SENT, xrefs: 0043E47C
Sending data failed (%d), xrefs: 0043E467

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: f6d46c0daf6dfedebf3b8389d98ef29530903bdaec32fc7e705c429fd2ffb1cc
Instruction ID: 0e6c0e25550d42c95f1992b0b8b97c782008a73c6add35993c68b5ff470d1feb
Opcode Fuzzy Hash: f6d46c0daf6dfedebf3b8389d98ef29530903bdaec32fc7e705c429fd2ffb1cc
Instruction Fuzzy Hash: 3E318231708A8186C760CB5AE44575ABBA0F39CB9CF9C5117DB8C83BA9DB78C059CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0043E4B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0043E5A8
WSAGetLastError.WS2_32 ref: 0043E5B2

Strings

SENT, xrefs: 0043E5CD
Sending data failed (%d), xrefs: 0043E5B8

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 32ada3caa304901e56586e658b5d22e2ec7bbdf1375ea9733ba550688b140f5c
Instruction ID: e834e04a65bf6d5002dc9e1c61c1c810a1d8c8d4c935f1abca4dd83e5a802d25
Opcode Fuzzy Hash: 32ada3caa304901e56586e658b5d22e2ec7bbdf1375ea9733ba550688b140f5c
Instruction Fuzzy Hash: EA318171704A8196C760CB5AE54535ABBA0F388BDCF9C501BDB8C83BA5DB7CC055CB05

Uniqueness

Uniqueness Score: -1.00%

Function 004405E0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00440632
accept.WS2_32 ref: 00440651

Part of subcall function 00402BD0: ioctlsocket.WS2_32 ref: 00402BE9

Part of subcall function 0042B2D0: closesocket.WS2_32 ref: 0042B314

Strings

Error accept()ing server connect, xrefs: 0044066B
Connection accepted from server, xrefs: 00440682

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: acceptclosesocketgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 3983744323-2331703088
Opcode ID: 9708775ad45a4ba31113d1dbe741a9ad9185ac66eb5e70fec7d205372692ea85
Instruction ID: c44b8ef11c9982b1734d766bc296280bc5c3872798ecf21dec56fd83cb52e015
Opcode Fuzzy Hash: 9708775ad45a4ba31113d1dbe741a9ad9185ac66eb5e70fec7d205372692ea85
Instruction Fuzzy Hash: 17314672204B8185EB609F26E44439A73A1F384BA8F884326DFB91B7C8DF7CD1558B08

Uniqueness

Uniqueness Score: -1.00%

Function 0046E660, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 0046E66D
GetModuleFileNameA.KERNEL32 ref: 0046E695

Strings

P4`, xrefs: 0046E69B
C:\Users\user\AppData\Local\Temp\curl_x64.exe, xrefs: 0046E67C

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: FileModuleName__initmbctable
String ID: C:\Users\user\AppData\Local\Temp\curl_x64.exe$P4`
API String ID: 3548084100-732295884
Opcode ID: 344f83f92b1edafc3bee0bd9ec4f241a9b558417162138d8acdee91d38440db8
Instruction ID: 242759173f846251f0dd7c19637c8d771a4983b6d141dc13a029053b2071b264
Opcode Fuzzy Hash: 344f83f92b1edafc3bee0bd9ec4f241a9b558417162138d8acdee91d38440db8
Instruction Fuzzy Hash: 20217CB6619B8486EB50CB52F90074AB3A5F798BD4F88101AEB8C43B28EF7CD515CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0043E0E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0043E11F
WSAGetLastError.WS2_32 ref: 0043E129

Strings

SENT, xrefs: 0043E144
Sending data failed (%d), xrefs: 0043E12F

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 4250c9cc6a7183655597588751e4ad932abe494ce0bd8d118d6d95a47f0c168e
Instruction ID: 028de8509ba021263694fbf266b78a9c5014062781626720249d1174a3d2c501
Opcode Fuzzy Hash: 4250c9cc6a7183655597588751e4ad932abe494ce0bd8d118d6d95a47f0c168e
Instruction Fuzzy Hash: 4301883A304B91C2DB109B2AE84434C7B60F798FD8F985016DF4847B29CF78C515C784

Uniqueness

Uniqueness Score: -1.00%

Function 0046D9D0, Relevance: 6.2, APIs: 4, Instructions: 173fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 0046DA67
GetLastError.KERNEL32 ref: 0046DA71

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: cb97ab194d5ca4244d8fde3ac1e531da64cb22c24211d5144fadab3c7de44cd0
Instruction ID: c12f5912bf0d06dcbedda41168adca35e45cc359a9082cbbc0b37847a672f495
Opcode Fuzzy Hash: cb97ab194d5ca4244d8fde3ac1e531da64cb22c24211d5144fadab3c7de44cd0
Instruction Fuzzy Hash: 2E61B262F197C485DB218F29D40432A7B90F341F94F5A420BDBAA4B798EB7CC442C71B

Uniqueness

Uniqueness Score: -1.00%

Function 00472449, Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00470DD0: VirtualQuery.KERNEL32 ref: 00470E34
Part of subcall function 00470DD0: GetSystemInfo.KERNEL32 ref: 00470E4B
Part of subcall function 00470DD0: GetModuleHandleA.KERNEL32 ref: 00470E68
Part of subcall function 00470DD0: GetProcAddress.KERNEL32 ref: 00470E7D
Part of subcall function 00470DD0: VirtualAlloc.KERNEL32 ref: 00470F07
Part of subcall function 00470DD0: VirtualProtect.KERNEL32 ref: 00470F1F

MultiByteToWideChar.KERNEL32 ref: 004724B5
MultiByteToWideChar.KERNEL32 ref: 004724DE
MultiByteToWideChar.KERNEL32 ref: 00472575
CompareStringW.KERNEL32 ref: 0047259A

Part of subcall function 00465EC0: Sleep.KERNEL32(?,?,?,?,00465BEC), ref: 00465EF4

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ByteCharMultiVirtualWide$AddressAllocCompareHandleInfoModuleProcProtectQuerySleepStringSystem
String ID:
API String ID: 3514146622-0
Opcode ID: 42ef7eca819690bb9cad437eafaba516bb5f9e2a490da9b76ddda3fe7ef63a5b
Instruction ID: 23ef9a0ba48b03e242b1f48699d8b37f379612d08e53dbb40751991f2476e770
Opcode Fuzzy Hash: 42ef7eca819690bb9cad437eafaba516bb5f9e2a490da9b76ddda3fe7ef63a5b
Instruction Fuzzy Hash: 4D416D72700B80DAC7349F22A9507DA37A4F748BDCF48822AEE4D5BB59DF78C6458744

Uniqueness

Uniqueness Score: -1.00%

Function 00419B90, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00419BBC
LeaveCriticalSection.KERNEL32 ref: 00419BD0
CloseHandle.KERNEL32 ref: 00419BDD
DeleteCriticalSection.KERNEL32 ref: 00419BFB

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: 36998f053fef2878b95a4db046f7a5c2e6c626137e64ad0f6ba65211079cde75
Instruction ID: ca1494d3950c2d487435cc66b6d07acd15eba4f4472cfa60c1aed08168f5ecf0
Opcode Fuzzy Hash: 36998f053fef2878b95a4db046f7a5c2e6c626137e64ad0f6ba65211079cde75
Instruction Fuzzy Hash: 5221C77A715B4097DB64DF22E6A035D7370FB98B80F544016DB8E43B14DF38D8A58754

Uniqueness

Uniqueness Score: -1.00%

Function 00427660, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 0042774B
WSAGetLastError.WS2_32 ref: 00427765

Part of subcall function 004183D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0041A288), ref: 004183E8
Part of subcall function 004183D0: GetLastError.KERNEL32 ref: 004184C7
Part of subcall function 004183D0: SetLastError.KERNEL32 ref: 004184D3

Strings

Recv failure: %s, xrefs: 00427789

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLast$recv
String ID: Recv failure: %s
API String ID: 316788870-4276829032
Opcode ID: c198d3435b99d2017725be1e7bd95a8e2d0832eb892d6528f643d0f4b7e6f9f0
Instruction ID: 7be0a7be7bd051beeba9f08869fb1d4762976bce563d485e117a6509ba114256
Opcode Fuzzy Hash: c198d3435b99d2017725be1e7bd95a8e2d0832eb892d6528f643d0f4b7e6f9f0
Instruction Fuzzy Hash: 2431AC3A705B9482D6109F16F58439D73A4F388FE0F98422ADF596BB68CF38D462C708

Uniqueness

Uniqueness Score: -1.00%

Function 0042B0F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 0042B16F
setsockopt.WS2_32 ref: 0042B19E

Part of subcall function 0042C180: GetVersionExA.KERNEL32 ref: 0042C1E0

Strings

@, xrefs: 0042B0FF

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: Versiongetsockoptsetsockopt
String ID: @
API String ID: 1450965354-2726393805
Opcode ID: f5a7ed7607c8132870a4aa83c5d5a709af634b698b2b3268c1fa27755d0fbc47
Instruction ID: cedb9d865edae910f4b1c61e30d0dfdb827b7bfa930a48459eab0ce9b7174c53
Opcode Fuzzy Hash: f5a7ed7607c8132870a4aa83c5d5a709af634b698b2b3268c1fa27755d0fbc47
Instruction Fuzzy Hash: 8011CEB230828187F720CF14F80476ABBA0FB84388F984125EB8847B94D7BDC599CF08

Uniqueness

Uniqueness Score: -1.00%

Function 00427B70, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00427A30: recv.WS2_32 ref: 00427B2F

send.WS2_32 ref: 00427BAD
WSAGetLastError.WS2_32 ref: 00427BC7

Strings

Send failure: %s, xrefs: 00427BEE

Memory Dump Source

Source File: 0000000B.00000002.231918231.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.231910763.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232023273.0000000000475000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.232084420.00000000004C6000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.232106855.00000000004CA000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_curl_x64.jbxd

Similarity

API ID: ErrorLastrecvsend
String ID: Send failure: %s
API String ID: 3418755260-857917747
Opcode ID: 8a9673482afe3db93b43ea18fe8588586988656795e946eb73f70219d8e13c41
Instruction ID: c898370c723723f30508dd55fb73234d497370ff65789fcf95facadd84de6326
Opcode Fuzzy Hash: 8a9673482afe3db93b43ea18fe8588586988656795e946eb73f70219d8e13c41
Instruction Fuzzy Hash: 12115171718B91C6C7509F26B94034AA761F759BE4FA80226EF9E47B98DB7CC4418704

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: detect_x64.exe PID: 360 Parent PID: 5556 detect_x64.exeCOMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF7A745286C, Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 252
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A74528D0
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A74528F1
SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF7A7452907
SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF7A7452926
SetupDiOpenDevRegKey.SETUPAPI ref: 00007FF7A7452954
RegQueryValueExW.ADVAPI32 ref: 00007FF7A7452997
RegQueryValueExW.ADVAPI32 ref: 00007FF7A74529E0
RegQueryValueExW.ADVAPI32 ref: 00007FF7A7452A24
RegQueryValueExW.ADVAPI32 ref: 00007FF7A7452A68
RegCloseKey.ADVAPI32 ref: 00007FF7A7452A73
SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF7A7452AB1
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A7452AD6
SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF7A7452AED

Strings

InfSection, xrefs: 00007FF7A7452A15
ProviderName, xrefs: 00007FF7A74529D6
InfPath, xrefs: 00007FF7A7452988
DriverDesc, xrefs: 00007FF7A7452A59

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setup$DeviceQueryValue$DriverInfoInstallParams$BuildList$CloseEnumOpenPropertyRegistry
String ID: DriverDesc$InfPath$InfSection$ProviderName
API String ID: 1187922586-109328823
Opcode ID: 2807d56651047efa3482015aea118a6355b1fd54d7907657358463e624218efe
Instruction ID: 276fa0418bacce983faaffe922fb80dac99079f6ae0b761d638b969d58d033b2
Opcode Fuzzy Hash: 2807d56651047efa3482015aea118a6355b1fd54d7907657358463e624218efe
Instruction Fuzzy Hash: CBB18772B09B4286EB749F11A8446BAB3A4FB84B85FC14136DE4D43A78DF3CDA05C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7451970, Relevance: 19.9, APIs: 13, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A74566F4: malloc.MSVCRT(?,?,?,00007FF7A745129B), ref: 00007FF7A7456712

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF7A7451A4C
GetLastError.KERNEL32 ref: 00007FF7A7451A59
CharNextW.USER32 ref: 00007FF7A7451AF6
CharNextW.USER32 ref: 00007FF7A7451B0A
wcschr.MSVCRT ref: 00007FF7A7451B1C
SetupDiCreateDeviceInfoListExW.SETUPAPI ref: 00007FF7A7451B83
SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF7A7451BCA
SetupDiOpenDeviceInfoW.SETUPAPI ref: 00007FF7A7451C14
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF7A7451C37
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF7A7451C6A
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF7A7451CE2
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF7A7451E6E
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF7A7451EA5

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setup$DeviceInfo$List$CharClassEnumNext$CreateDestroyDetailDevice_DevsErrorFromGet_GuidsLastNameOpenmallocwcschr
String ID:
API String ID: 43639810-0
Opcode ID: 89f27aaf0f823c13d3424bd83824de243595a0339a55a0fa3d661b8a36788e4b
Instruction ID: 18f231df29b6853d103d7d57cb6a07a2f99a69b3afe61d98db441c401b55b992
Opcode Fuzzy Hash: 89f27aaf0f823c13d3424bd83824de243595a0339a55a0fa3d661b8a36788e4b
Instruction Fuzzy Hash: 7CE19332B0AA4286EB209F15E4406BEB7A4FB45B98FD24135DE4E47BA4DF3CD946C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7456CB0, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF7A7456CBB

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5ebaec917797f88d02dffa84fcdc6cd0efd3092181cc90a82e3a7c50803cd070
Instruction ID: 18f9b97fbc62e4c8d3092e10f074083a08788db83ef2544d4d3aaa291a7c06e8
Opcode Fuzzy Hash: 5ebaec917797f88d02dffa84fcdc6cd0efd3092181cc90a82e3a7c50803cd070
Instruction Fuzzy Hash: F0B09210F26802C1E604BF219C9506452A0BB58700FC20431C40D80130EE2C999B8711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7452C80, Relevance: 19.7, APIs: 13, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7A7452CD3

Part of subcall function 00007FF7A745286C: SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A74528D0
Part of subcall function 00007FF7A745286C: SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A74528F1
Part of subcall function 00007FF7A745286C: SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF7A7452907
Part of subcall function 00007FF7A745286C: SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF7A7452926

SetupDiGetDriverInfoDetailW.SETUPAPI ref: 00007FF7A7452D41
GetLastError.KERNEL32 ref: 00007FF7A7452D50
SetupDiSetSelectedDriverW.SETUPAPI ref: 00007FF7A7452D88
SetupOpenFileQueue.SETUPAPI ref: 00007FF7A7452D96
memset.MSVCRT ref: 00007FF7A7452DB6
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A7452DCE
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A7452DF1
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF7A7452E0A
SetupScanFileQueueW.SETUPAPI ref: 00007FF7A7452E47
SetupScanFileQueueW.SETUPAPI ref: 00007FF7A7452EA9
SetupDiDestroyDriverInfoList.SETUPAPI ref: 00007FF7A7452EBA
SetupCloseFileQueue.SETUPAPI ref: 00007FF7A7452EC9

Part of subcall function 00007FF7A745115C: fputs.MSVCRT ref: 00007FF7A745117B

Part of subcall function 00007FF7A7451084: FormatMessageW.KERNEL32 ref: 00007FF7A74510D5
Part of subcall function 00007FF7A7451084: CharPrevW.USER32 ref: 00007FF7A74510F7
Part of subcall function 00007FF7A7451084: fputws.MSVCRT ref: 00007FF7A7451136
Part of subcall function 00007FF7A7451084: LocalFree.KERNEL32 ref: 00007FF7A7451140

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setup$Driver$DeviceFileInfoInstallParamsQueue$ListScanmemset$BuildCallCharClassCloseDestroyDetailEnumErrorFormatFreeInstallerLastLocalMessageOpenPrevSelectedfputsfputws
String ID:
API String ID: 2781244042-0
Opcode ID: 253b2cddc8f9d1938ef382ad6dc5530c7879cc85a48f7d341777d53daa8e34c3
Instruction ID: 6108e0f0955d4af2aec134407dae522935e32d556e9cf56530ab05675473429a
Opcode Fuzzy Hash: 253b2cddc8f9d1938ef382ad6dc5530c7879cc85a48f7d341777d53daa8e34c3
Instruction Fuzzy Hash: 0761942270A68286E760EF21D8502AEB3A5FB84B94FC50636DD1E47BA5CF3CD906C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7456870, Relevance: 9.1, APIs: 6, Instructions: 95
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7A74568B4
_amsg_exit.MSVCRT ref: 00007FF7A74568D0
_initterm.MSVCRT ref: 00007FF7A7456954
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7A7456981
exit.KERNELBASE ref: 00007FF7A74569CE
_cexit.MSVCRT ref: 00007FF7A74569DD

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
String ID:
API String ID: 4291973834-0
Opcode ID: b4ab8591321b2fc8539f0d3258a043a7e7af45e6699f1fcfe4db934f454d5aa1
Instruction ID: e0249e7718700a1de40e9acaa41015a9b2fcbfd115bdf8381ced2067753cbe4d
Opcode Fuzzy Hash: b4ab8591321b2fc8539f0d3258a043a7e7af45e6699f1fcfe4db934f454d5aa1
Instruction Fuzzy Hash: 8641F331A0A64686F750BF15E864239A2A4BF45B84FC60539ED4D876B0EF3CEC43C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7451ED8, Relevance: 6.2, APIs: 4, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsrchr.MSVCRT ref: 00007FF7A7451F11
CharNextW.USER32 ref: 00007FF7A7451F24
CharNextW.USER32 ref: 00007FF7A7451FCC
_wcsicmp.MSVCRT ref: 00007FF7A7451FF0

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: CharNext$_wcsicmpwcsrchr
String ID:
API String ID: 349611830-0
Opcode ID: 5707b521c4e7c77c14a78bd7294958d538c62ad06d35ede6c3700352360a144e
Instruction ID: f6e0a46195d2cb7242209f591908c215051e50e5a7468681e2862b709103807b
Opcode Fuzzy Hash: 5707b521c4e7c77c14a78bd7294958d538c62ad06d35ede6c3700352360a144e
Instruction Fuzzy Hash: B951AC62A0A64686EA54AF55E440679B3A4FB04B88FC64036DF0E537B4EF3CED57C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7451590, Relevance: 3.1, APIs: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A74566F4: malloc.MSVCRT(?,?,?,00007FF7A745129B), ref: 00007FF7A7456712

GetLastError.KERNEL32 ref: 00007FF7A74515F5
SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF7A7451667

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: DeviceErrorLastPropertyRegistrySetupmalloc
String ID:
API String ID: 3222414921-0
Opcode ID: 66b54f04880a69e2df15ef1fac651865b731044f75462621537e4e7538dac4ed
Instruction ID: bc0fe1db68f040fac8915213af02ac77b8d86377e888a32fa5b17ac6a21dc56f
Opcode Fuzzy Hash: 66b54f04880a69e2df15ef1fac651865b731044f75462621537e4e7538dac4ed
Instruction Fuzzy Hash: 9421A72170A74143EA54EF15B4102BAA394FB89B94FC90734EE5E437A5DF3CD846C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A745125C, Relevance: 3.1, APIs: 2, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A74566F4: malloc.MSVCRT(?,?,?,00007FF7A745129B), ref: 00007FF7A7456712

GetLastError.KERNEL32 ref: 00007FF7A74512C4
SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF7A7451338

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: DeviceErrorLastPropertyRegistrySetupmalloc
String ID:
API String ID: 3222414921-0
Opcode ID: 712fab2b1444c65af948b10dd7050d47f82d5600e510e89c8421b08d2ec1e92c
Instruction ID: bea541c51ab146ed74b85ba459b9a3ed5a84456bd790739875313889805c51d0
Opcode Fuzzy Hash: 712fab2b1444c65af948b10dd7050d47f82d5600e510e89c8421b08d2ec1e92c
Instruction Fuzzy Hash: 4F21B72170A78186EA64EF15B81426EE394FB89BA4FC50235EE5E43BE5DF3CD846C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7451380, Relevance: 2.6, APIs: 2, Instructions: 59
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 00007FF7A74513AB
lstrlenW.KERNEL32 ref: 00007FF7A7451401

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 25d8622939fd3d378dfb894d5c14bcf06b3d632f45eafb97b642428814df23e3
Instruction ID: 918e11ebb2a78463c20e3dc6688cfa3cae608242bf3a510fbaabbd4501a45e00
Opcode Fuzzy Hash: 25d8622939fd3d378dfb894d5c14bcf06b3d632f45eafb97b642428814df23e3
Instruction Fuzzy Hash: 82114F22A05B8181D615EF15E450139B3B4FB85B90B9A8235DF9E437A4DE3CE893C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7456820, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 00007FF7A7456858

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: 5940b59835abce81edaa81f592c787fbeee1ceda1b8c82252df102a8fff8c996
Instruction ID: 8c43b95dd0f0f448f4c43a0927040c378d1c29dde06c48179b4c3be5706baa21
Opcode Fuzzy Hash: 5940b59835abce81edaa81f592c787fbeee1ceda1b8c82252df102a8fff8c996
Instruction Fuzzy Hash: 55E07D74E0A687A5E700AF10E844478B7A0BB04304FC24136DC0D56774DE3CA94BCB30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74566F4, Relevance: 1.3, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT(?,?,?,00007FF7A745129B), ref: 00007FF7A7456712

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 65627b1ac0e2acfb5e7cd4696612a14c86a6680fd011bfbf976ab167a43bf727
Instruction ID: bf6efe144c9385edfa03e2708da5d64f1e03f5f0ce7c874d74cc7e16e18f2db5
Opcode Fuzzy Hash: 65627b1ac0e2acfb5e7cd4696612a14c86a6680fd011bfbf976ab167a43bf727
Instruction Fuzzy Hash: 80D01201B1F24640FD55BB56666117982919F48FD0FD95030DE5D0B796DE2CEC924B22

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7A7455890, Relevance: 42.4, APIs: 14, Strings: 10, Instructions: 355
registryservicestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF7A7455912
GetLastError.KERNEL32 ref: 00007FF7A745591C
_wcsicmp.MSVCRT ref: 00007FF7A7455941
_wcsicmp.MSVCRT ref: 00007FF7A7455962
SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00007FF7A74559A5
OpenSCManagerW.ADVAPI32 ref: 00007FF7A7455AA9
OpenServiceW.ADVAPI32 ref: 00007FF7A7455AC7
CloseServiceHandle.ADVAPI32 ref: 00007FF7A7455AD8
CloseServiceHandle.ADVAPI32 ref: 00007FF7A7455AE1
_wcsicmp.MSVCRT ref: 00007FF7A7455BD1
lstrlenW.KERNEL32 ref: 00007FF7A7455C92
RegSetValueExW.ADVAPI32 ref: 00007FF7A7455CDE
RegDeleteValueW.ADVAPI32 ref: 00007FF7A7455D18

Part of subcall function 00007FF7A7451084: FormatMessageW.KERNEL32 ref: 00007FF7A74510D5
Part of subcall function 00007FF7A7451084: CharPrevW.USER32 ref: 00007FF7A74510F7
Part of subcall function 00007FF7A7451084: fputws.MSVCRT ref: 00007FF7A7451136
Part of subcall function 00007FF7A7451084: LocalFree.KERNEL32 ref: 00007FF7A7451140

Part of subcall function 00007FF7A7452F24: wprintf.MSVCRT ref: 00007FF7A7452F4F

RegCloseKey.ADVAPI32 ref: 00007FF7A7455D8D

Strings

lower, xrefs: 00007FF7A745595B
@, xrefs: 00007FF7A7455BF6
upper, xrefs: 00007FF7A745593A
!, xrefs: 00007FF7A7455A5E
-, xrefs: 00007FF7A7455A8D
+, xrefs: 00007FF7A7455A67
=, xrefs: 00007FF7A7455A30
UpperFilters, xrefs: 00007FF7A745594E
@, xrefs: 00007FF7A7455A55
LowerFilters, xrefs: 00007FF7A7455973

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: CloseOpenService_wcsicmp$ClassHandleSetupValue$CharDeleteErrorFormatFreeFromGuidsLastLocalManagerMessageNamePrevfputwslstrlenwprintf
String ID: !$+$-$=$@$@$LowerFilters$UpperFilters$lower$upper
API String ID: 2866307409-2693469231
Opcode ID: 475d458dde6b006f2261f451de1f305ec4973a2f126bea94a7a9c44cb4103ff1
Instruction ID: 4e35bff19e0ce4a0c83c82e02e563b084ad0e23adb55cc2e72e96c590ce3f236
Opcode Fuzzy Hash: 475d458dde6b006f2261f451de1f305ec4973a2f126bea94a7a9c44cb4103ff1
Instruction Fuzzy Hash: D0D1D522A0EA4681EA54BF15D454279E3A6EF44BE0FC64231DD6E077F4DE3DED468320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7453EA0, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF7A7453FBD
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF7A7454250

Strings

, xrefs: 00007FF7A745403E

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setup$ClassDestroyDeviceFromGuidsInfoListName
String ID:
API String ID: 1860465623-3916222277
Opcode ID: 58df64179a93e669d7bc1e408b9b82836edc5f97dc6a4b939f47db1f81a18f90
Instruction ID: 4fdb8b6b7ba622f03438816ac5fef6e52440911f4f0ed8f294e4312b6fa75203
Opcode Fuzzy Hash: 58df64179a93e669d7bc1e408b9b82836edc5f97dc6a4b939f47db1f81a18f90
Instruction Fuzzy Hash: ACB1C332B0A64281EB10AF65E4546B9B7A4FB44B98FD14235EE5D0BBE4DF3CD806C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7451194, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7A74511A7
OpenProcessToken.ADVAPI32 ref: 00007FF7A74511BA
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7A74511D2
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7A7451211
CloseHandle.KERNEL32 ref: 00007FF7A745121C
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF7A745123C

Strings

SeShutdownPrivilege, xrefs: 00007FF7A74511CB

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
String ID: SeShutdownPrivilege
API String ID: 2036077386-3733053543
Opcode ID: e4a8f5eeed68fae43d3c058ab3832d3c04b5591a535e3b4deb415aa771e51b5b
Instruction ID: 4c61a5ef0c90da7f43aa13ed97142ffcfe3819b41770f49ca6af193ffc436219
Opcode Fuzzy Hash: e4a8f5eeed68fae43d3c058ab3832d3c04b5591a535e3b4deb415aa771e51b5b
Instruction Fuzzy Hash: 6B113372619A42C2E750DF21F41576AB364FB85B44FC15035E98E46A64CF7CD446CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7456560, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF7A74565A7
FindFirstFileW.KERNEL32 ref: 00007FF7A7456649

Strings

\INF\OEM*.INF, xrefs: 00007FF7A74565FA

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: DirectoryFileFindFirstWindows
String ID: \INF\OEM*.INF
API String ID: 1585389207-2728984289
Opcode ID: 9a86839f2aa0f6237b4c1bfc81412a82363a33fadf86eb67385f59b3bd64b019
Instruction ID: 065c2e5f975df7d067f9d86728182177c6145a4f726777e18ae8ce3cd8ff2bfb
Opcode Fuzzy Hash: 9a86839f2aa0f6237b4c1bfc81412a82363a33fadf86eb67385f59b3bd64b019
Instruction Fuzzy Hash: A241A321B0A68281FE60BF20E1202B9A264EF84B90FD64635DE5D477E5DE2CEC078721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7453764, Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 214
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupOpenInfFileW.SETUPAPI ref: 00007FF7A74537AF
GetLastError.KERNEL32 ref: 00007FF7A74537BE
SetupFindFirstLineW.SETUPAPI ref: 00007FF7A74537E2
SetupGetStringFieldW.SETUPAPI ref: 00007FF7A745380D
SetupFindFirstLineW.SETUPAPI ref: 00007FF7A745385E
SetupGetStringFieldW.SETUPAPI ref: 00007FF7A745387E
CLSIDFromString.OLE32 ref: 00007FF7A7453894
SetupDiGetClassDescriptionExW.SETUPAPI ref: 00007FF7A74538BA
LoadLibraryW.KERNEL32 ref: 00007FF7A74538FC
GetProcAddress.KERNEL32 ref: 00007FF7A7453918
memset.MSVCRT ref: 00007FF7A7453937
GetLastError.KERNEL32 ref: 00007FF7A745395B
GetLastError.KERNEL32 ref: 00007FF7A7453968

Strings

ClassGUID, xrefs: 00007FF7A7453850
DriverVer, xrefs: 00007FF7A74539BC
SetupVerifyInfFile, xrefs: 00007FF7A745390E
Version, xrefs: 00007FF7A74537DB, 00007FF7A7453857, 00007FF7A74539C3
setupapi.dll, xrefs: 00007FF7A74538F5
Provider, xrefs: 00007FF7A74537D4

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setup$ErrorLastString$FieldFindFirstLine$AddressClassDescriptionFileFromLibraryLoadOpenProcmemset
String ID: ClassGUID$DriverVer$Provider$SetupVerifyInfFile$Version$setupapi.dll
API String ID: 653204746-1638047923
Opcode ID: 69602bca725b19a060b4aa2423c0333f56ee32f9dc484792623f52d9b2101a75
Instruction ID: 27571681c4296f1f9c49ec7386e8e6f0e5019a33105a3c8fd827357600040c7b
Opcode Fuzzy Hash: 69602bca725b19a060b4aa2423c0333f56ee32f9dc484792623f52d9b2101a75
Instruction Fuzzy Hash: 4A914C21B0AA8295F754BF61E8101F9A355BF84B84FD24435ED0E676A5DE3CED07C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7453070, Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 281timeCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7A74530BE
memset.MSVCRT ref: 00007FF7A74530D4
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A74530EE
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A7453110
SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF7A7453128
SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF7A7453157
SetupDiGetDriverInfoDetailW.SETUPAPI ref: 00007FF7A74531AB
GetLastError.KERNEL32 ref: 00007FF7A74531B5
FileTimeToSystemTime.KERNEL32 ref: 00007FF7A7453276
GetDateFormatW.KERNEL32 ref: 00007FF7A74532A3

Strings

, xrefs: 00007FF7A745331D

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setup$DriverInfo$DeviceInstallParamsTimememset$BuildDateDetailEnumErrorFileFormatLastListSystem
String ID:
API String ID: 2012139668-3916222277
Opcode ID: 214bb39daba48261a4d9ee10ba38abf92301863c43cf40b1e61d76dfc39f4f69
Instruction ID: 31c56830165c390bdc53d949306b820383d55a747715725156cc052911d10937
Opcode Fuzzy Hash: 214bb39daba48261a4d9ee10ba38abf92301863c43cf40b1e61d76dfc39f4f69
Instruction Fuzzy Hash: F8B19421B0A18246F754BF21D8516FDA255FF85B88FC10835ED4E57BA6CE3CED068760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74517BC, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF7A74517ED
_wcsnicmp.MSVCRT ref: 00007FF7A7451803
CharNextW.USER32 ref: 00007FF7A7451840
lstrlenW.KERNEL32 ref: 00007FF7A745193A
lstrlenW.KERNEL32 ref: 00007FF7A7451946

Strings

*, xrefs: 00007FF7A7451831

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: lstrlen$CharNext_wcsicmp_wcsnicmp
String ID: *
API String ID: 138455478-163128923
Opcode ID: e5cec1f2ab734ab3f8a8e0ac004467d751c666d26f833d1e0f2473941603a68e
Instruction ID: 422b7b158e032180e6a14823965c75873bf564c0e72178fd6900c5af49168dc7
Opcode Fuzzy Hash: e5cec1f2ab734ab3f8a8e0ac004467d751c666d26f833d1e0f2473941603a68e
Instruction Fuzzy Hash: C7415025B0AA5681EA24AF569554079A3A5FF05FC1BC64035DE4F037B0EF3CE993C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7455DD0, Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 253stringCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF7A7455E23
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF7A7455E55
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF7A7455E7D
wprintf.MSVCRT ref: 00007FF7A7455E9D

Part of subcall function 00007FF7A7451084: FormatMessageW.KERNEL32 ref: 00007FF7A74510D5
Part of subcall function 00007FF7A7451084: CharPrevW.USER32 ref: 00007FF7A74510F7
Part of subcall function 00007FF7A7451084: fputws.MSVCRT ref: 00007FF7A7451136
Part of subcall function 00007FF7A7451084: LocalFree.KERNEL32 ref: 00007FF7A7451140

_wcsicmp.MSVCRT ref: 00007FF7A7455FD0
_wcsicmp.MSVCRT ref: 00007FF7A745601B
lstrlenW.KERNEL32 ref: 00007FF7A74560B2
SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF7A74560F5
wprintf.MSVCRT ref: 00007FF7A7456115
wprintf.MSVCRT ref: 00007FF7A7456132
wprintf.MSVCRT ref: 00007FF7A7456142
wprintf.MSVCRT ref: 00007FF7A745615B

Strings

%-60s: , xrefs: 00007FF7A7455E96, 00007FF7A745610B

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: wprintf$DeviceGet_Setup_wcsicmp$CharDetailDevice_FormatFreeInfoListLocalMessageNode_PrevPropertyRegistryStatus_fputwslstrlen
String ID: %-60s:
API String ID: 4048145858-769737362
Opcode ID: 85e9f0c25e025548421e56feeebcc99c5bc4819402c59e825c7775ab218bc565
Instruction ID: 8b0604dccde8d23594e5531163960796018c4ba2fcf4a78d3976b21ba31cb167
Opcode Fuzzy Hash: 85e9f0c25e025548421e56feeebcc99c5bc4819402c59e825c7775ab218bc565
Instruction Fuzzy Hash: 58A1A122B0A64682EA20EF05E55463AF3A5FB44B94FC64131DE4E47BA5DF3DEC52C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74524F4, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF7A7452539
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF7A745254F

Part of subcall function 00007FF7A745115C: fputs.MSVCRT ref: 00007FF7A745117B

CM_Get_Res_Des_Data_Size_Ex.SETUPAPI ref: 00007FF7A7452566
CM_Get_Res_Des_Data_Ex.SETUPAPI ref: 00007FF7A745259B
wprintf.MSVCRT ref: 00007FF7A74525D6
wprintf.MSVCRT ref: 00007FF7A7452639
CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF7A7452664
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF7A745267A

Strings

IRQ : %u, xrefs: 00007FF7A74525CC
DMA : %u, xrefs: 00007FF7A74525E8
IO : %04I64x-%04I64x, xrefs: 00007FF7A7452609
MEM : %08I64x-%08I64x, xrefs: 00007FF7A745262A

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Des_Res_$Get_$Data_Free_HandleNext_wprintf$Size_fputs
String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
API String ID: 722776883-3427375868
Opcode ID: 219a627bf99cf0229d76403beca38c20d34cc29e9f5e404185d46302754bfad3
Instruction ID: 237e0907e176620165cf9bb8684bc82169bacd25391281a3f2214877c84e0e67
Opcode Fuzzy Hash: 219a627bf99cf0229d76403beca38c20d34cc29e9f5e404185d46302754bfad3
Instruction Fuzzy Hash: 0E419F72B1A64286EB14EF25D4542B8A364FB54B88FC60136EE0D477B4DF38EC42C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74551D0, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 138stringCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7A7455256
memset.MSVCRT ref: 00007FF7A7455271
SetupDiGetINFClassW.SETUPAPI ref: 00007FF7A74552E3
SetupDiCreateDeviceInfoList.SETUPAPI ref: 00007FF7A74552F8
SetupDiCreateDeviceInfoW.SETUPAPI ref: 00007FF7A745533A
lstrlenW.KERNEL32 ref: 00007FF7A7455348
SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF7A745536B
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF7A7455382
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF7A74553BD

Strings

, xrefs: 00007FF7A7455310

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setup$Device$Info$ClassCreateList$CallDestroyFullInstallerNamePathPropertyRegistrylstrlenmemset
String ID:
API String ID: 2055260941-3916222277
Opcode ID: ea95f8d8e34dffe6775af6a994d76ed78bc43aeaf0f9397b97750e8cef096d3a
Instruction ID: 7a94003da504550556151380d3c9071d85f106d36fb81db318f6e2579183562a
Opcode Fuzzy Hash: ea95f8d8e34dffe6775af6a994d76ed78bc43aeaf0f9397b97750e8cef096d3a
Instruction Fuzzy Hash: F051D331B05A8186EB10AF61E8047B9B3A6FB84B94FC54136EE4D47BA4DF7DD906C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74563E0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7A745643B
LoadLibraryW.KERNEL32 ref: 00007FF7A745645B
GetProcAddress.KERNEL32 ref: 00007FF7A7456477
GetLastError.KERNEL32 ref: 00007FF7A745649D
FreeLibrary.KERNEL32 ref: 00007FF7A7456524

Strings

SetupUninstallOEMInfW, xrefs: 00007FF7A745646D
setupapi.dll, xrefs: 00007FF7A7456454

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Library$AddressErrorFreeFullLastLoadNamePathProc
String ID: SetupUninstallOEMInfW$setupapi.dll
API String ID: 3805412813-3713901415
Opcode ID: 28361569a6b424ef4abd6fb170231f269fd3b5e35c3d8ea5e6b80940ec833879
Instruction ID: be7ac4dc37dc69cfcb8113120804ffa67eaddeea87e4686a318a944334664252
Opcode Fuzzy Hash: 28361569a6b424ef4abd6fb170231f269fd3b5e35c3d8ea5e6b80940ec833879
Instruction Fuzzy Hash: 4F316B21A0A68682FB60BF11E42537AE355EF84B44FD24435DD4E47BA9DE3CEC428722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74534E0, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 167registryCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF7A745351E
SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00007FF7A7453559
wprintf.MSVCRT ref: 00007FF7A7453654
RegCloseKey.ADVAPI32 ref: 00007FF7A74536DB

Part of subcall function 00007FF7A74516C0: RegQueryValueExW.ADVAPI32 ref: 00007FF7A7451771

Part of subcall function 00007FF7A745115C: fputs.MSVCRT ref: 00007FF7A745117B

Part of subcall function 00007FF7A7451084: FormatMessageW.KERNEL32 ref: 00007FF7A74510D5
Part of subcall function 00007FF7A7451084: CharPrevW.USER32 ref: 00007FF7A74510F7
Part of subcall function 00007FF7A7451084: fputws.MSVCRT ref: 00007FF7A7451136
Part of subcall function 00007FF7A7451084: LocalFree.KERNEL32 ref: 00007FF7A7451140

Part of subcall function 00007FF7A7452F24: wprintf.MSVCRT ref: 00007FF7A7452F4F

Strings

%s, xrefs: 00007FF7A745364D
UpperFilters, xrefs: 00007FF7A745356C
LowerFilters, xrefs: 00007FF7A745368C

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setupwprintf$CharClassCloseDetailDeviceFormatFreeInfoListLocalMessageOpenPrevQueryValuefputsfputws
String ID: %s$LowerFilters$UpperFilters
API String ID: 4180368772-1836264166
Opcode ID: c606a585928f19b9872c7cf4895e86c0d7122ab524f4339a6f7d1a7d5ebc2297
Instruction ID: 0cddbd6b32bbb41b36ebadfd9a0973bf4f36454c5f8d6eb250c34cefbc98f432
Opcode Fuzzy Hash: c606a585928f19b9872c7cf4895e86c0d7122ab524f4339a6f7d1a7d5ebc2297
Instruction Fuzzy Hash: AE519251B0B28251F958BF1194212B99289AF85B94FCB0938ED1F0B7E2DE3DEC438760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7455050, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7A74550C7
GetFileAttributesW.KERNEL32 ref: 00007FF7A74550DF
LoadLibraryW.KERNEL32 ref: 00007FF7A74550F5
GetProcAddress.KERNEL32 ref: 00007FF7A7455111
FreeLibrary.KERNEL32 ref: 00007FF7A745518A

Strings

newdev.dll, xrefs: 00007FF7A74550EE
UpdateDriverForPlugAndPlayDevicesW, xrefs: 00007FF7A7455107

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Library$AddressAttributesFileFreeFullLoadNamePathProc
String ID: UpdateDriverForPlugAndPlayDevicesW$newdev.dll
API String ID: 497426240-3767700378
Opcode ID: 0daadc53b92a1779aa40d490d212808bbe4ed30a6e527f4d60fd2405cb247117
Instruction ID: 2d54d097f58c99b70064ffb145814aa42663e971dee1c897f65d7da822ddbabe
Opcode Fuzzy Hash: 0daadc53b92a1779aa40d490d212808bbe4ed30a6e527f4d60fd2405cb247117
Instruction Fuzzy Hash: 6D317E21B0AB8285FB50AF21E4552B9A3A5FB88B80FD64035DE4D537A5DF3DEC42C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74554F0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF7A745552E
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF7A7455559
SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF7A745559C
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF7A74555B1
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A74555D2
wprintf.MSVCRT ref: 00007FF7A745560F

Strings

%-60s: %s, xrefs: 00007FF7A7455608

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setup$ClassDeviceInstallParams$CallDetailDevice_Get_InfoInstallerListwprintf
String ID: %-60s: %s
API String ID: 1061212145-3470069224
Opcode ID: 6f9338ddb5a4caa4b8fcd1cc9a44fde643f8bb69ad578ea4decead6c0bbc18bd
Instruction ID: 904b1f7a2a1b53e33fda45ba210ac9c70f1e56e40aaae6ba422e34a7e9fb8ffc
Opcode Fuzzy Hash: 6f9338ddb5a4caa4b8fcd1cc9a44fde643f8bb69ad578ea4decead6c0bbc18bd
Instruction Fuzzy Hash: 85315071605A868AF7209F21DC047EAB765FB44B88FC10135DE0C4BAA8DF3DD946C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7453C50, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A74566F4: malloc.MSVCRT(?,?,?,00007FF7A745129B), ref: 00007FF7A7456712

GetLastError.KERNEL32 ref: 00007FF7A7453CB1
SetupDiBuildClassInfoListExW.SETUPAPI ref: 00007FF7A7453D01
SetupDiClassNameFromGuidExW.SETUPAPI ref: 00007FF7A7453D6A
SetupDiGetClassDescriptionExW.SETUPAPI ref: 00007FF7A7453DE2
wprintf.MSVCRT ref: 00007FF7A7453E4A

Strings

%-20s: %s, xrefs: 00007FF7A7453E43

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: ClassSetup$BuildDescriptionErrorFromGuidInfoLastListNamemallocwprintf
String ID: %-20s: %s
API String ID: 894314750-1251934994
Opcode ID: 986012ab14d0c424ce9ab26d0b016c0451a8380168dac182e6dba2f5767a7754
Instruction ID: 076a0747372f9a95bfbc24ce61423367f994437a821bb3bc1935b17ca1cca50d
Opcode Fuzzy Hash: 986012ab14d0c424ce9ab26d0b016c0451a8380168dac182e6dba2f5767a7754
Instruction Fuzzy Hash: 7B51A032B1678282EB50AF21E550AA9B3A8FB44B88FD54135DE4D47B64DF3CE90AC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74520DC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF7A7452114
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF7A7452141
wprintf.MSVCRT ref: 00007FF7A74521AD
wprintf.MSVCRT ref: 00007FF7A74521BC

Strings

%-60s: %s, xrefs: 00007FF7A74521A6
%s, xrefs: 00007FF7A74521B5

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: wprintf$DetailDeviceDevice_Get_InfoListSetup
String ID: %-60s: %s$%s
API String ID: 500149863-1339393084
Opcode ID: 9f2bc23e2d1f42a96e213981ae22f8161a17a3e0885d8cba7927149de7edc2b5
Instruction ID: 682e3722e08ce450807125ebfad502cffc7b292524c8c757ee346cd13c84a590
Opcode Fuzzy Hash: 9f2bc23e2d1f42a96e213981ae22f8161a17a3e0885d8cba7927149de7edc2b5
Instruction Fuzzy Hash: EF218262B1AA8296FA21AF15E84477AA364FF44784FC60031DE0D47674EF3CD907C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7455400, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF7A7455430
GetProcAddress.KERNEL32 ref: 00007FF7A7455465
FreeLibrary.KERNEL32 ref: 00007FF7A7455476
FreeLibrary.KERNEL32 ref: 00007FF7A74554B6

Strings

SetupSetNonInteractiveMode, xrefs: 00007FF7A745545B
setupapi.dll, xrefs: 00007FF7A7455423

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: SetupSetNonInteractiveMode$setupapi.dll
API String ID: 1386263645-1268865691
Opcode ID: 6ec523a6f35e0418e944827c456bf1123f4debe30d39e0958f4724abc6b7df78
Instruction ID: 8edb51b23e7266fbed7724e13bbbd6c57fbc97f17e105bed9049d163783eab95
Opcode Fuzzy Hash: 6ec523a6f35e0418e944827c456bf1123f4debe30d39e0958f4724abc6b7df78
Instruction Fuzzy Hash: 5B216725B0AB0182EA10AF16A841139F7A5BB89FC0FC64434EE4D43B34EE3CE8438714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A745269C, Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF7A74526E2
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF7A745270B
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 00007FF7A7452734
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 00007FF7A7452751
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 00007FF7A745277F
CM_Free_Log_Conf_Handle.SETUPAPI ref: 00007FF7A74527FD

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Conf_Get_Log_$First_$DetailDeviceFree_HandleInfoListNode_SetupStatus_
String ID:
API String ID: 950201049-0
Opcode ID: 183b7b4ae557552bb22e1c9d09f60b7f5903a353b37b2a18227cc174eaeee114
Instruction ID: 68ab519a923c07f7f078466d042dcaf2c6c32f69d06712e216f283a346ace745
Opcode Fuzzy Hash: 183b7b4ae557552bb22e1c9d09f60b7f5903a353b37b2a18227cc174eaeee114
Instruction Fuzzy Hash: A941953261A68286E750EF10E4507AAB360FB84B48FC11135FE4E476A5DF3CD846CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7456E84, Relevance: 9.0, APIs: 6, Instructions: 47timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7A7456EB4
GetCurrentProcessId.KERNEL32 ref: 00007FF7A7456EC2
GetCurrentThreadId.KERNEL32 ref: 00007FF7A7456ECE
GetTickCount.KERNEL32 ref: 00007FF7A7456EDA
GetTickCount.KERNEL32 ref: 00007FF7A7456EEA
QueryPerformanceCounter.KERNEL32 ref: 00007FF7A7456F05

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 6e19578d9e6b8e50ed40d7a7f64d35ebfd7b837366c80e842d98cb2a268ba686
Instruction ID: 3ed00981c2a891fb035723592f01a0be03d28ea182b5fef791027c71398291e1
Opcode Fuzzy Hash: 6e19578d9e6b8e50ed40d7a7f64d35ebfd7b837366c80e842d98cb2a268ba686
Instruction Fuzzy Hash: 21111D22705F418AEB00AF70E85526973A4FB09758FC50A31EE5D46B64DF7CD5A58350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74549F0, Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF7A7454A63
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF7A7454A78
SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF7A7454AB3
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF7A7454AC8
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF7A7454AE5

Part of subcall function 00007FF7A74520DC: SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF7A7452114
Part of subcall function 00007FF7A74520DC: CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF7A7452141
Part of subcall function 00007FF7A74520DC: wprintf.MSVCRT ref: 00007FF7A74521AD

Part of subcall function 00007FF7A74520DC: wprintf.MSVCRT ref: 00007FF7A74521BC

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: Setup$Class$InstallParams$CallDeviceInstallerwprintf$DetailDevice_Get_InfoList
String ID:
API String ID: 3776784670-0
Opcode ID: c1974e11253ec066670219f8e13924fe704f1cefe2663eb8149dba16e3e772a2
Instruction ID: bff1fc0fd568e703ef4cd65ed0545d809755503026b34319ed19968e286448a4
Opcode Fuzzy Hash: c1974e11253ec066670219f8e13924fe704f1cefe2663eb8149dba16e3e772a2
Instruction Fuzzy Hash: CF316D726096418AE7209F52E5543BAB7A4FB49FC8F854139DE4D0BAA8CF3CD946CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7456A70, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7A7456AE3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A7456B02
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A7456B4F
__raise_securityfailure.LIBCMT ref: 00007FF7A7456C34

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 058048644d94887ecaa4144e2d7c7b6937ae20d7a986c2c409f2bc3a275ef3c5
Instruction ID: 20a2f79862a990562605427e0f3e8c67a4d5933dd826e961b8b1bf4ca59350b7
Opcode Fuzzy Hash: 058048644d94887ecaa4144e2d7c7b6937ae20d7a986c2c409f2bc3a275ef3c5
Instruction Fuzzy Hash: 7041B535A0AB4581EA50AF19F894369B3A4FB89784FD24136ED8D43774DF7CE846C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A7451084, Relevance: 6.1, APIs: 4, Instructions: 68windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FF7A74510D5
CharPrevW.USER32 ref: 00007FF7A74510F7
fputws.MSVCRT ref: 00007FF7A7451136
LocalFree.KERNEL32 ref: 00007FF7A7451140

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: CharFormatFreeLocalMessagePrevfputws
String ID:
API String ID: 578739846-0
Opcode ID: 69743a47ebb7d1fb7a5a078017e19093efe5ac0cddd9a8fde7ce9873891134a2
Instruction ID: 64e7fbfe74354b29cb7adc83a2ad0eb0d8f7431d90cbe497b36f41141d0f30b6
Opcode Fuzzy Hash: 69743a47ebb7d1fb7a5a078017e19093efe5ac0cddd9a8fde7ce9873891134a2
Instruction Fuzzy Hash: 4E217A77B05A518AEB019F66D8954BC77B9BB88B98F920535CE0E13B24EF34C896C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7A74557D0, Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

CM_Connect_MachineW.SETUPAPI ref: 00007FF7A74557F7
CM_Locate_DevNode_ExW.SETUPAPI ref: 00007FF7A7455810
CM_Reenumerate_DevNode_Ex.SETUPAPI ref: 00007FF7A7455842
CM_Disconnect_Machine.SETUPAPI ref: 00007FF7A745586D

Memory Dump Source

Source File: 00000011.00000002.330321635.00007FF7A7451000.00000020.00020000.sdmp, Offset: 00007FF7A7450000, based on PE: true

Associated: 00000011.00000002.330307532.00007FF7A7450000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330349680.00007FF7A7458000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.330388990.00007FF7A745B000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.330413097.00007FF7A745C000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff7a7450000_detect_x64.jbxd

Similarity

API ID: MachineNode_$Connect_Disconnect_Locate_Reenumerate_
String ID:
API String ID: 218754429-0
Opcode ID: f49f4ebda9200f29a3b64b84b808d6328c6ce76fa5272c13e91149d8f658dd1b
Instruction ID: cc184c26f079b416a507fa50efd444e724b4d0538ce65112a48db808f3a278e9
Opcode Fuzzy Hash: f49f4ebda9200f29a3b64b84b808d6328c6ce76fa5272c13e91149d8f658dd1b
Instruction Fuzzy Hash: D9119321B0E58282FB54AF26E451679E3A2BFD4B84FC64531EE8D47674DE3DD8068610

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: aes_x64.exe PID: 7004 Parent PID: 5556 aes_x64.exeCOMMON

Executed Functions

Function 00007FF697683750, Relevance: 69.1, APIs: 13, Strings: 26, Instructions: 887encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF69768379F
GetLastError.KERNEL32 ref: 00007FF6976837A9
GetLastError.KERNEL32 ref: 00007FF6976837B1
CryptAcquireContextW.ADVAPI32 ref: 00007FF6976837D6
GetLastError.KERNEL32 ref: 00007FF6976837E0

Part of subcall function 00007FF697689ED0: _errno.LIBCMT ref: 00007FF697689F0B
Part of subcall function 00007FF697689ED0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697689F16

CryptGenRandom.ADVAPI32 ref: 00007FF6976838F1
CryptReleaseContext.ADVAPI32 ref: 00007FF697683A59
sprintf.LIBCMT ref: 00007FF697683B04

Strings

Error: Could not write the file size modulo, xrefs: 00007FF697684653
aescrypt, xrefs: 00007FF697683AEF
Error: Could not write tag to AES file (1), xrefs: 00007FF697683A90
Error: Could not write to output file, xrefs: 00007FF69768461A
66666666, xrefs: 00007FF697683F24
Windows is unable to generate random digits, xrefs: 00007FF6976847CC, 00007FF6976847DD
Error: Could not write the file HMAC, xrefs: 00007FF697684792
Error: Could not flush output file buffer, xrefs: 00007FF6976847AC
Error: Could not write tag to AES file (2), xrefs: 00007FF697683ADC
Error: Could not write tag to AES file (3), xrefs: 00007FF697683B40
Error: Could not write tag to AES file (4), xrefs: 00007FF697683B78
Error: Could not write tag to AES file (6), xrefs: 00007FF697683BF5
CREATED_BY, xrefs: 00007FF697683A99
Error: Could not write tag to AES file (5), xrefs: 00007FF697683BBD
Error: Couldn't read input file, xrefs: 00007FF697684609
Error: Could not write iv_key data, xrefs: 00007FF6976847BE
66666666, xrefs: 00007FF697684328
\\\\\\\\, xrefs: 00007FF697683F68
Error: Could not write out initialization vector, xrefs: 00007FF697683D88
%s %s, xrefs: 00007FF697683AF6
Could not acquire handle to crypto context, xrefs: 00007FF6976837F1
gj, xrefs: 00007FF69768467C
Error: Could not write out header data, xrefs: 00007FF697683A42
Error: Could not write iv_key HMAC, xrefs: 00007FF6976842F0
3.10, xrefs: 00007FF697683AE8
\\\\\\\\, xrefs: 00007FF69768436A

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorLast$Acquire$RandomRelease_errno_invalid_parameter_noinfosprintf
String ID: %s %s$3.10$66666666$66666666$CREATED_BY$Could not acquire handle to crypto context$Error: Could not flush output file buffer$Error: Could not write iv_key HMAC$Error: Could not write iv_key data$Error: Could not write out header data$Error: Could not write out initialization vector$Error: Could not write tag to AES file (1)$Error: Could not write tag to AES file (2)$Error: Could not write tag to AES file (3)$Error: Could not write tag to AES file (4)$Error: Could not write tag to AES file (5)$Error: Could not write tag to AES file (6)$Error: Could not write the file HMAC$Error: Could not write the file size modulo$Error: Could not write to output file$Error: Couldn't read input file$Windows is unable to generate random digits$\\\\\\\\$\\\\\\\\$aescrypt$gj
API String ID: 2628475005-636462672
Opcode ID: c7a29cd750e171fca3b283f2f8563e0e48ccc20f8dd886d10119c66fc6e159ae
Instruction ID: c764671a5f8f3ee3a2cf56b284802d1c69cbf96a118821dffbb3a54871767f7f
Opcode Fuzzy Hash: c7a29cd750e171fca3b283f2f8563e0e48ccc20f8dd886d10119c66fc6e159ae
Instruction Fuzzy Hash: E092C0726087C289EB30CF25E4842ED7BA1FB467C8F400175DA5D9BA9AEF78D645DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768CA14, Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 465
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 00007FF69768CA6A
_errno.LIBCMT ref: 00007FF69768CA71
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69768CA7C

Strings

U, xrefs: 00007FF69768CFF8

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 58048377370e666a2f1d6e046c7c6c99e81a38e45dbd3c5006686a12010112d2
Instruction ID: 56bd119a24914cf73bf562cdb61bee770b8e1f7d5f540823d23209a033fb0615
Opcode Fuzzy Hash: 58048377370e666a2f1d6e046c7c6c99e81a38e45dbd3c5006686a12010112d2
Instruction Fuzzy Hash: 27120332A1864286EF309F25D4443BA67B0FB9A7C4F5400B2DAADC7A94DF3CE445EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697692810, Relevance: 42.6, APIs: 28, Instructions: 573fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF69769286D
__doserrno.LIBCMT ref: 00007FF6976928B3
_errno.LIBCMT ref: 00007FF6976928BD
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6976928C9
__doserrno.LIBCMT ref: 00007FF697692A17
_errno.LIBCMT ref: 00007FF697692A21
_errno.LIBCMT ref: 00007FF697692A2C
CreateFileW.KERNELBASE ref: 00007FF697692A62
CreateFileW.KERNEL32 ref: 00007FF697692AB7
GetLastError.KERNEL32 ref: 00007FF697692AE8
_errno.LIBCMT ref: 00007FF697692AF5
GetFileType.KERNELBASE ref: 00007FF697692B04
GetLastError.KERNEL32 ref: 00007FF697692B2F
CloseHandle.KERNEL32 ref: 00007FF697692B42
_errno.LIBCMT ref: 00007FF697692B4C
_lseek_nolock.LIBCMT ref: 00007FF697692BE0
__doserrno.LIBCMT ref: 00007FF697692BED
_close_nolock.LIBCMT ref: 00007FF697692BFC
_lseek_nolock.LIBCMT ref: 00007FF697692C3D
_close_nolock.LIBCMT ref: 00007FF697692DB0

Part of subcall function 00007FF69768F934: FindCloseChangeNotification.KERNELBASE(?,?,00000000,00007FF697692C01), ref: 00007FF69768F993
Part of subcall function 00007FF69768F934: GetLastError.KERNEL32(?,?,00000000,00007FF697692C01), ref: 00007FF69768F99D

_errno.LIBCMT ref: 00007FF697692DB5
_lseek_nolock.LIBCMT ref: 00007FF697692DD7
CloseHandle.KERNEL32 ref: 00007FF697692F14
CreateFileW.KERNEL32 ref: 00007FF697692F42
GetLastError.KERNEL32 ref: 00007FF697692F4E
_errno.LIBCMT ref: 00007FF697692FD8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697692FE4

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$ErrorFileLast$CloseCreate__doserrno_lseek_nolock$Handle_close_nolock_invalid_parameter_noinfo$ChangeFindNotificationType_get_daylight
String ID:
API String ID: 4064658819-0
Opcode ID: 1cb25b56e59a56da9b886bade463df1bde7de8c464f0ceede616a735d11f07ef
Instruction ID: 9615e5a35d7179c7684b0914905a6db5a74bf96868bdd5f5be9da4c190a5b045
Opcode Fuzzy Hash: 1cb25b56e59a56da9b886bade463df1bde7de8c464f0ceede616a735d11f07ef
Instruction Fuzzy Hash: 7432B232F186528DFF788B69D4903BD26A0EB657E8F144275DA3EC76D5CE3CA841A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976857C0, Relevance: 42.3, APIs: 9, Strings: 15, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwprintf.LIBCMT ref: 00007FF69768597C

Strings

Error: Unknown option '%c', xrefs: 00007FF69768596E
Error opening input file %s : , xrefs: 00007FF697685DCC
user aborted, xrefs: 00007FF697685AA8
Error: STDIN may not be specified with multiple input files., xrefs: 00007FF697685D57
Error: Passwords don't match., xrefs: 00007FF697685B2D
No valid error code specified!!!, xrefs: 00007FF697685AB8
password too long, xrefs: 00007FF697685AB1
Error opening output file %s : , xrefs: 00007FF697685D84
Error: -e or -d not specified, xrefs: 00007FF697685A5B
Error: A single output file may not be specified with multiple input files., xrefs: 00007FF697685B1C
Error in read_password: %s., xrefs: 00007FF697685ACC
Error: No file argument specified, xrefs: 00007FF6976859AB
Error: Could not properly close output file , xrefs: 00007FF697685D9D
Error: No password supplied., xrefs: 00007FF697685A9A
%s.aes, xrefs: 00007FF697685BF5

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: fwprintf
String ID: %s.aes$Error in read_password: %s.$Error opening input file %s : $Error opening output file %s : $Error: -e or -d not specified$Error: A single output file may not be specified with multiple input files.$Error: Could not properly close output file $Error: No file argument specified$Error: No password supplied.$Error: Passwords don't match.$Error: STDIN may not be specified with multiple input files.$Error: Unknown option '%c'$No valid error code specified!!!$password too long$user aborted
API String ID: 968622242-3753910606
Opcode ID: f30bb2431c8e13f17eddbb061c9b9e1cbf90f489282fe55a0e31aa7bc32ccb2c
Instruction ID: 6c333f63a5a1f748e6daf747012c5984d429769e8573ec455f628649cf699c57
Opcode Fuzzy Hash: f30bb2431c8e13f17eddbb061c9b9e1cbf90f489282fe55a0e31aa7bc32ccb2c
Instruction Fuzzy Hash: 85C17C31E1C64245FF71AB2094952F912A1EF537E4F9401B6EA3EC76D7EE6CE806E600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768ED28, Relevance: 32.0, APIs: 21, Instructions: 482COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF69768ED59
_errno.LIBCMT ref: 00007FF69768ED62
__doserrno.LIBCMT ref: 00007FF69768EDBC
_errno.LIBCMT ref: 00007FF69768EDC3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69768F432

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 6a984f06eda76db9bd71f109d79af0c710d8390853ec8f8e7d94d51da18f0398
Instruction ID: 37d02e4581d2bc736e09e6831259e9f35ad573a091b1342cad996750e2da9845
Opcode Fuzzy Hash: 6a984f06eda76db9bd71f109d79af0c710d8390853ec8f8e7d94d51da18f0398
Instruction Fuzzy Hash: 3422C732A0C68646FF728B68C4503FC2AA1EB56BD4F5841B5CA7E837D1DE7CE445A311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768E728, Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF69768E78E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69768E799
_wsopen_s.LIBCMT ref: 00007FF69768E9B8

Part of subcall function 00007FF6976931D8: _errno.LIBCMT ref: 00007FF6976931F6
Part of subcall function 00007FF6976931D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697693201

Strings

UTF-16LE, xrefs: 00007FF69768E944
=, xrefs: 00007FF69768E90D
UTF-8, xrefs: 00007FF69768E921
UNICODE, xrefs: 00007FF69768E967
ccs, xrefs: 00007FF69768E8E0

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$_wsopen_s
String ID: =$UNICODE$UTF-16LE$UTF-8$ccs
API String ID: 2449612375-31882262
Opcode ID: bd018454ee07a4a7cbe0e4cad969b3b4b81e3aaa997bed4a77fc631ea3a10e2b
Instruction ID: 9065b014d2c2b04f2000b2a0e103e51e951010bc67a87a0cb642b1818e324e84
Opcode Fuzzy Hash: bd018454ee07a4a7cbe0e4cad969b3b4b81e3aaa997bed4a77fc631ea3a10e2b
Instruction Fuzzy Hash: 5A71D0B6E0C25285FFB40B1598006F92690EFA3FC4F5940B5DDAEA36D5DE3CE940B241

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768A4A0, Relevance: 13.6, APIs: 9, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF69768A50A
_FF_MSGBANNER.LIBCMT ref: 00007FF69768A535
_RTC_Initialize.LIBCMT ref: 00007FF69768A54E
_amsg_exit.LIBCMT ref: 00007FF69768A562
GetCommandLineW.KERNEL32 ref: 00007FF69768A567
_amsg_exit.LIBCMT ref: 00007FF69768A58E
_amsg_exit.LIBCMT ref: 00007FF69768A5A1
_cinit.LIBCMT ref: 00007FF69768A5AB
_amsg_exit.LIBCMT ref: 00007FF69768A5B6

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _amsg_exit$CommandInitializeLine_cinit
String ID:
API String ID: 760082873-0
Opcode ID: f6cfb71d43cd20810c6ef214805e36bc78dfa22c367f843c34a576be28f3c767
Instruction ID: def50afc0819d7a72c1ac281e779ecb322de8e7be0e29bfced8ab5cccd096473
Opcode Fuzzy Hash: f6cfb71d43cd20810c6ef214805e36bc78dfa22c367f843c34a576be28f3c767
Instruction Fuzzy Hash: 14310C30E0C64386FF706BA495562F92291EF927C4F1445B9DA7DC62D3EE2CE880B752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768F44C, Relevance: 13.6, APIs: 9, Instructions: 81
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 00007FF69768F475
_errno.LIBCMT ref: 00007FF69768F47E
__doserrno.LIBCMT ref: 00007FF69768F4DC
_errno.LIBCMT ref: 00007FF69768F4E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69768F547

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 789be0953b5d205cc116f07ce7cfd0a91e55ccd26e112387eb7a68a54a946db3
Instruction ID: b7e8406bfb8b62fd7e6eea5b4d9081f96ff0e4a7a8e479071b500262bc771676
Opcode Fuzzy Hash: 789be0953b5d205cc116f07ce7cfd0a91e55ccd26e112387eb7a68a54a946db3
Instruction Fuzzy Hash: 7231D132A0824345EA326F69A8912FD3660EF537D0F4552B5EA38CB7D2CF7CE841A701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768E040, Relevance: 10.7, APIs: 7, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF69768E061

Part of subcall function 00007FF69768AF00: Sleep.KERNEL32(?,?,00000000,00007FF697690523,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768AF45

GetFileType.KERNEL32 ref: 00007FF69768E1CC
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF69768E20A

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID:
API String ID: 3473179607-0
Opcode ID: 89a93fa9f7b4a8e379243402f2fb261c7a0f1390623c429a1ec5514ed30cc3dd
Instruction ID: bb3a00232fcc0b8902aeb46d6415765aa383815633ae2ea86e82a912ad3ffdb6
Opcode Fuzzy Hash: 89a93fa9f7b4a8e379243402f2fb261c7a0f1390623c429a1ec5514ed30cc3dd
Instruction Fuzzy Hash: DA817E72A08B8286EF248F24D49436937A0FB56BB4F5443B9CABD862D5DF3CE455E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768A7FC, Relevance: 10.6, APIs: 7, Instructions: 98
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 00007FF69768A825

Part of subcall function 00007FF69768E60C: _amsg_exit.LIBCMT ref: 00007FF69768E636

RtlDecodePointer.NTDLL(?,?,00000000,?,00000040,00000000,00000000,00007FF69768A9E9,?,?,00000000,00007FF69768E63B,?,?,00000000,00007FF697690491), ref: 00007FF69768A858
DecodePointer.KERNEL32(?,?,00000000,?,00000040,00000000,00000000,00007FF69768A9E9,?,?,00000000,00007FF69768E63B,?,?,00000000,00007FF697690491), ref: 00007FF69768A876
DecodePointer.KERNEL32(?,?,00000000,?,00000040,00000000,00000000,00007FF69768A9E9,?,?,00000000,00007FF69768E63B,?,?,00000000,00007FF697690491), ref: 00007FF69768A8B6
DecodePointer.KERNEL32(?,?,00000000,?,00000040,00000000,00000000,00007FF69768A9E9,?,?,00000000,00007FF69768E63B,?,?,00000000,00007FF697690491), ref: 00007FF69768A8D0
DecodePointer.KERNEL32(?,?,00000000,?,00000040,00000000,00000000,00007FF69768A9E9,?,?,00000000,00007FF69768E63B,?,?,00000000,00007FF697690491), ref: 00007FF69768A8E0
ExitProcess.KERNEL32 ref: 00007FF69768A96C

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3411037476-0
Opcode ID: b5a90ec91e7688539324cce18ad1de26dd1e8fa3d9ae9c2edb531a0a43f696c6
Instruction ID: b1ed0735bdc51c27b646a49524157cfbfbfc23926168e20a3201811b22957772
Opcode Fuzzy Hash: b5a90ec91e7688539324cce18ad1de26dd1e8fa3d9ae9c2edb531a0a43f696c6
Instruction Fuzzy Hash: 4A418031A1E60285EE709B11FC4127962A4FF99BC4F5400B5DEADC37A5EF3CE855A301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768D174, Relevance: 10.6, APIs: 7, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 00007FF69768D197
_errno.LIBCMT ref: 00007FF69768D19F

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: bb77454f859d5d999f3e961c9c2e3b4b09b3e5448fa2ad7abce696d26acb4f57
Instruction ID: f04d5f92034f4bca0351a43e63beae011600ff310545282995467a51f1ab3562
Opcode Fuzzy Hash: bb77454f859d5d999f3e961c9c2e3b4b09b3e5448fa2ad7abce696d26acb4f57
Instruction Fuzzy Hash: BD21B332A1854246FE266B6598A13FD6561EF4B7E1F0541F4EA38C72D2CF7CA841A720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768F9F0, Relevance: 10.6, APIs: 7, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 00007FF69768FA09
_errno.LIBCMT ref: 00007FF69768FA11
_close_nolock.LIBCMT ref: 00007FF69768FA68

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: 63e1e10d21e66d8470324006326e402feb7063d55060a64d07fdeb6361bddf2c
Instruction ID: 87fbe6c97e6ea84e4f7b2e52e401df5d058f9b0f95fd1f39910d9769047fd921
Opcode Fuzzy Hash: 63e1e10d21e66d8470324006326e402feb7063d55060a64d07fdeb6361bddf2c
Instruction Fuzzy Hash: 5911D532E1868295FE256B2998913FC2560DF427E0F1511F4E97D8B6C2CF7CA841A710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976858E6, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncpy.LIBCMT ref: 00007FF697685959

Part of subcall function 00007FF697689D1C: _errno.LIBCMT ref: 00007FF697689D25
Part of subcall function 00007FF697689D1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697689D30

Part of subcall function 00007FF69768A060: _errno.LIBCMT ref: 00007FF69768A0A4
Part of subcall function 00007FF69768A060: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69768A13E

Strings

Error: No file argument specified, xrefs: 00007FF6976859AB
Error opening output file %s:, xrefs: 00007FF697685A16

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$wcsncpy
String ID: Error opening output file %s:$Error: No file argument specified
API String ID: 3818259516-2355036129
Opcode ID: 1ea59089b632a4abd0b6fa2749e4329ccf053920aeb24019285bf0d8b2f70447
Instruction ID: 1415d07480399da29fd1c89e6f87280fbbae480e8b79dc07a4cab600c0bb0ea1
Opcode Fuzzy Hash: 1ea59089b632a4abd0b6fa2749e4329ccf053920aeb24019285bf0d8b2f70447
Instruction Fuzzy Hash: ED310C31A2C64785EF30AB20D8952F95221EF927E4F9000B6DA3EC76D6DE2CE546E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976898B4, Relevance: 6.2, APIs: 4, Instructions: 170
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF6976898F3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6976898FE
memcpy_s.LIBCMT ref: 00007FF6976899C7
_errno.LIBCMT ref: 00007FF697689AB9

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 1165161347-0
Opcode ID: bafd9cc178ddeebbbd2594039f02762465be6a3ec6cd1abc9be38599456612f4
Instruction ID: 820839c4799282dff36d4ea85624f6f559a2b2bb5f1968538a90d9b47401178e
Opcode Fuzzy Hash: bafd9cc178ddeebbbd2594039f02762465be6a3ec6cd1abc9be38599456612f4
Instruction Fuzzy Hash: 6B51B231B0D34286EE348B6695005B96694FB47BE4F184770EF7D9BBD1DE3CE851A600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768B158, Relevance: 6.1, APIs: 4, Instructions: 115
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF697689D1C: _errno.LIBCMT ref: 00007FF697689D25
Part of subcall function 00007FF697689D1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697689D30

_errno.LIBCMT ref: 00007FF69768B185
_errno.LIBCMT ref: 00007FF69768B1A1
_isatty.LIBCMT ref: 00007FF69768B202
_getbuf.LIBCMT ref: 00007FF69768B20E

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 3655708593-0
Opcode ID: 235a15e84f851ad925ce755d767c74b27106f3bb69e90eaad664d58338717102
Instruction ID: b7ea533678fcd5dfed12532364c549656846133ef23006694ef6e5a1d0d4a8d3
Opcode Fuzzy Hash: 235a15e84f851ad925ce755d767c74b27106f3bb69e90eaad664d58338717102
Instruction Fuzzy Hash: 6F41C472A1878646EF399F28C4612BC36A0EB86BD4F140275DA7D873D5EE3CE851E740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697689730, Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF697689681
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69768968C
_errno.LIBCMT ref: 00007FF6976896C5
_errno.LIBCMT ref: 00007FF6976896D8

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 6b8eb61a5cfe6eab0d4114e4ea9e7798f106f6131fb2c7af8667512e52f57969
Instruction ID: 1b955e112ddf3cf70ba81b4a1ea43118ce415644d63337e195b0b72980844a7e
Opcode Fuzzy Hash: 6b8eb61a5cfe6eab0d4114e4ea9e7798f106f6131fb2c7af8667512e52f57969
Instruction Fuzzy Hash: 50216F35A0874382FE315B12A8012BEA2A4FF47BC4F0444B0EAADD7795DE7CE891A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697689D44, Relevance: 4.6, APIs: 3, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF697689D7B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697689D86
_flush.LIBCMT ref: 00007FF697689E3B

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_flush_invalid_parameter_noinfo
String ID:
API String ID: 2816740245-0
Opcode ID: 936ae0566bb195d8b879ce566efacac7cde4e3e0a55bbd6cc8ab34ec97f7549b
Instruction ID: f14f1b374367122da5ba2a15d3f00a765c625e6392e68426955c0d2231e44469
Opcode Fuzzy Hash: 936ae0566bb195d8b879ce566efacac7cde4e3e0a55bbd6cc8ab34ec97f7549b
Instruction Fuzzy Hash: DB411731B0CB4246EE388F6295482BAAA90EF47BD4F180674EF7DC6AD5DE3CE4419604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768EBD4, Relevance: 4.6, APIs: 3, Instructions: 95
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF69768EBEB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69768EBF6

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 10e8f31c0f21cb328ce5fdb4828a7a4d70167c430373ff5283243d8142f3e8e2
Instruction ID: 07dc1168ae068785e5a5d75483335176fc39abe0f93c4fb26c0daddf0f404158
Opcode Fuzzy Hash: 10e8f31c0f21cb328ce5fdb4828a7a4d70167c430373ff5283243d8142f3e8e2
Instruction Fuzzy Hash: A741A332E0864242EF748B2995452B876A0EB17BD4F280571DBBDC36C1CF2CE462E744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697689514, Relevance: 4.6, APIs: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF697689537

Part of subcall function 00007FF69768E60C: _amsg_exit.LIBCMT ref: 00007FF69768E636

_fflush_nolock.LIBCMT ref: 00007FF69768958D
_fflush_nolock.LIBCMT ref: 00007FF6976895AA

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _fflush_nolock$_amsg_exit_lock
String ID:
API String ID: 1679097844-0
Opcode ID: 94ec41de16d9da9aa583bfcf5c6d48426ec4209ddf88899d56100d5d9110c7a3
Instruction ID: d92ffacfac295dc21b90dbb81280fd240c133b00387b34236be87c74403d23b8
Opcode Fuzzy Hash: 94ec41de16d9da9aa583bfcf5c6d48426ec4209ddf88899d56100d5d9110c7a3
Instruction Fuzzy Hash: 9321DE72908B4641EE309B25D4802AAB7A1FB97BD8F1416B5DF6D832E5CF3CE840E741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69769123C, Relevance: 4.5, APIs: 3, Instructions: 46memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF69769125F
RtlAllocateHeap.NTDLL(?,?,00000000,00007FF69768AF33,?,?,00000000,00007FF697690523,?,?,00000060,00007FF69768C1D5), ref: 00007FF697691293
_callnewh.LIBCMT ref: 00007FF6976912AA

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: AllocateHeap_callnewh_errno
String ID:
API String ID: 638267422-0
Opcode ID: ba9aaab597774eadb720e42dff618df2e51b796954eb66d54718da7c3654391e
Instruction ID: b8ce2bb9733d9baec925a284221c494b566660faf2924e37ab2a023139772a00
Opcode Fuzzy Hash: ba9aaab597774eadb720e42dff618df2e51b796954eb66d54718da7c3654391e
Instruction Fuzzy Hash: 5F115E31B0D206C5FE796B65D6443B962E1DF64BE4F2886B1CE3DC66C4DE3CA480A200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697690750, Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00007FF697690766
GetVersion.KERNEL32 ref: 00007FF697690778
HeapSetInformation.KERNEL32 ref: 00007FF697690796

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 3f30d392d9e22db7cee4156eec648a2f915f3c65e943b9454f43e1b22c597bbb
Instruction ID: 5d0eab1f83689f5b30bda1485fa6cc96713f5438b30d1d35a3508c6ffb09ea9e
Opcode Fuzzy Hash: 3f30d392d9e22db7cee4156eec648a2f915f3c65e943b9454f43e1b22c597bbb
Instruction Fuzzy Hash: 0CE09234A1974382FFA55724E8557752260FFA83D1F901075D95EC2794DF3DD0459B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697692FB8, Relevance: 3.1, APIs: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF697692FD8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697692FE4

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: a4b350c304c85e033370b9e36e3b5e1013ef79eb8be360b1c2e68ae2ebc069b7
Instruction ID: 4ab8ec17cb8fec7bd6795f9456fa7b63a7208a271903b396863c72acb4077e9e
Opcode Fuzzy Hash: a4b350c304c85e033370b9e36e3b5e1013ef79eb8be360b1c2e68ae2ebc069b7
Instruction Fuzzy Hash: C821D1327187438AEFB58B29E98127D76A0EB507D4F084274EA6EC76E5DF2CD850DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697689AEC, Relevance: 3.0, APIs: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF697689B35
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697689B40

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 1a5f02348ffca2c39cb4ac145a08f289089de7acbedd38a1f9fba3ef7dabbea0
Instruction ID: 392ad2636fca5a27dd8fdfc0660923223fbf349db6cd3a63f43d2acae33c9bc6
Opcode Fuzzy Hash: 1a5f02348ffca2c39cb4ac145a08f289089de7acbedd38a1f9fba3ef7dabbea0
Instruction Fuzzy Hash: AB11A571A0874141EE24DB52A9400EAA275EF47FE0F5846B1EF7D877D6DE3CE401A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697689ED0, Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF697689F0B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697689F16

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: ae1d4774d0486923e578b792778cf7e53538a94a11c915de440f40b19f1c52ba
Instruction ID: 81a5292c5c87523688695e993227187338f10a5187850db8b4895e8abb1199d8
Opcode Fuzzy Hash: ae1d4774d0486923e578b792778cf7e53538a94a11c915de440f40b19f1c52ba
Instruction Fuzzy Hash: 4B01AD71B1878241EE799B12AA411E962A8EF57FC0B0C50F0EF6DD7B86DE2CE450A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69769030C, Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,00007FF69768A579), ref: 00007FF697690320
FreeEnvironmentStringsW.KERNEL32(?,?,?,00007FF69768A579), ref: 00007FF697690373

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 5737fcfbd4457ca073cc79d906ff30093da2433cc3efab02996693838a2f8bd0
Instruction ID: 5894b2bb0230f4137ba44e443e2c1fe11ad9cb13c864cb61e0fe4783f6e9eba0
Opcode Fuzzy Hash: 5737fcfbd4457ca073cc79d906ff30093da2433cc3efab02996693838a2f8bd0
Instruction Fuzzy Hash: 4A018B22E0978386EE70AF52A64106A62A0EFA8BC0B484071DB5D87B85EE2CE4809340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976901D4, Relevance: 2.6, APIs: 2, Instructions: 82COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6976902A6

Part of subcall function 00007FF69768C0C0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF69768C162), ref: 00007FF69768C0D8

free.LIBCMT ref: 00007FF6976902F8

Part of subcall function 00007FF69768E314: HeapFree.KERNEL32(?,?,00000000,00007FF69769055C,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768E32A
Part of subcall function 00007FF69768E314: _errno.LIBCMT ref: 00007FF69768E334
Part of subcall function 00007FF69768E314: GetLastError.KERNEL32(?,?,00000000,00007FF69769055C,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768E33C

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: free$CurrentErrorFreeHeapLastProcess_errno
String ID:
API String ID: 3424231777-0
Opcode ID: 919c352f93d7e12ceeff53492b4a66b6fa39c05595bf4703ca4171d1f0e24b1d
Instruction ID: fa6bb95fc6a6a79376f3cad8b89fa6e787368e1a8013146f92491be3e513e99a
Opcode Fuzzy Hash: 919c352f93d7e12ceeff53492b4a66b6fa39c05595bf4703ca4171d1f0e24b1d
Instruction Fuzzy Hash: 1A316536A08A4381EF649F15A8512B923A4EFA5BC0F6841B6DE6C87795EF7CE450E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768AE80, Relevance: 2.5, APIs: 2, Instructions: 35sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF69768AEAB

Part of subcall function 00007FF697691184: _FF_MSGBANNER.LIBCMT ref: 00007FF6976911B4
Part of subcall function 00007FF697691184: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF69768AEB0,?,?,00000000,00007FF69768E585,?,?,00000040,00007FF69768E62F,?,?,00000000,00007FF697690491), ref: 00007FF6976911D9
Part of subcall function 00007FF697691184: _callnewh.LIBCMT ref: 00007FF6976911F2
Part of subcall function 00007FF697691184: _errno.LIBCMT ref: 00007FF6976911FD
Part of subcall function 00007FF697691184: _errno.LIBCMT ref: 00007FF697691208

Sleep.KERNEL32(?,?,00000000,00007FF69768E585,?,?,00000040,00007FF69768E62F,?,?,00000000,00007FF697690491,?,?,00000000,00007FF697690548), ref: 00007FF69768AEBE

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$AllocateHeapSleep_callnewhmalloc
String ID:
API String ID: 3606348469-0
Opcode ID: c9354145a17a5f32fc41151d9e02bb5dbc7fadae0cec99e402935cc971035593
Instruction ID: 602bb6d8c014ae3bebf9668a0571f87037d350d83b033168b1362290946e9b7a
Opcode Fuzzy Hash: c9354145a17a5f32fc41151d9e02bb5dbc7fadae0cec99e402935cc971035593
Instruction Fuzzy Hash: 2F01F932614B8986EE609F06940006973A1FBD8FD0F580175EE6D47740EF3CF851D780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697690CB8, Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(?,?,?,00007FF69768A77F,?,?,?,00007FF69768A5B0), ref: 00007FF697690CD1

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 5733df841f9bf30cc15ed05bea90cba109e432d79c459d623e3a59b01b312717
Instruction ID: 4daadaf642cfb1d86fd9fb1059801309af6e3eafe3e3befad7500e4a9051932e
Opcode Fuzzy Hash: 5733df841f9bf30cc15ed05bea90cba109e432d79c459d623e3a59b01b312717
Instruction Fuzzy Hash: 13D05E32B58E42D2EF618B11F58127863A0FB98BD4F588071DA6D46758DE3CC8D9C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768AF00, Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF69769123C: _errno.LIBCMT ref: 00007FF69769125F

Sleep.KERNEL32(?,?,00000000,00007FF697690523,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768AF45

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: Sleep_errno
String ID:
API String ID: 1068366078-0
Opcode ID: c9e4a5acadd13c4e2dd1f84ce208ee271624fa232cbad97947f2fc3aa18bbc0b
Instruction ID: 05256624bfb3ccfe08db68db2f34372a7ccfc28b1cd7f4772e22bfd113c55537
Opcode Fuzzy Hash: c9e4a5acadd13c4e2dd1f84ce208ee271624fa232cbad97947f2fc3aa18bbc0b
Instruction Fuzzy Hash: A801D132A24B858AEE649F169801069B7A5FBD8FD0B481176EE6D43B90DF3CE852C700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF69768FD60, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 00007FF69768FDA5
_set_error_mode.LIBCMT ref: 00007FF69768FDB6
GetModuleFileNameW.KERNEL32 ref: 00007FF69768FE18

Part of subcall function 00007FF69768C0C0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF69768C162), ref: 00007FF69768C0D8

GetStdHandle.KERNEL32 ref: 00007FF69768FF2D
WriteFile.KERNEL32 ref: 00007FF69768FF8A

Strings

..., xrefs: 00007FF69768FE6A
Microsoft Visual C++ Runtime Library, xrefs: 00007FF69768FED1
Runtime Error!Program: , xrefs: 00007FF69768FDE5
<program name unknown>, xrefs: 00007FF69768FE27

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 2183313154-4022980321
Opcode ID: b2b6d3fd1844aa9a2b4110a9fbfff80b50738361aa8b93c70a8fac5b9b47c4a8
Instruction ID: 58a490ba94165f3ac715696d40e6128e5cb8098f5b603d25a130f93fc5864b4c
Opcode Fuzzy Hash: b2b6d3fd1844aa9a2b4110a9fbfff80b50738361aa8b93c70a8fac5b9b47c4a8
Instruction Fuzzy Hash: D351C031B1868282EF74DB25A8157FA62A4EF9A7C4F5401B6EE7DC3A85DF3CE105D200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697688EE0, Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF69768B01F
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69768B03E
RtlVirtualUnwind.KERNEL32 ref: 00007FF69768B08A
IsDebuggerPresent.KERNEL32 ref: 00007FF69768B0FC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69768B114
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69768B121
GetCurrentProcess.KERNEL32 ref: 00007FF69768B13A
TerminateProcess.KERNEL32 ref: 00007FF69768B148

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 9d82bf5d351ed8ca9f04b91f331032513dffe6bf735954c8d6f8faddd7f0500b
Instruction ID: f835c025b8ee9fb218687db8589d7dff2a79d6e588e0b2c087348d0a7ad7b9fe
Opcode Fuzzy Hash: 9d82bf5d351ed8ca9f04b91f331032513dffe6bf735954c8d6f8faddd7f0500b
Instruction Fuzzy Hash: DA311935919B46C5EF609B50F880369B3A0FB997D0F5000BADAAD837A5EF7CE444E740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768BF74, Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF69768BFE1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69768BFF9
RtlVirtualUnwind.KERNEL32 ref: 00007FF69768C033
IsDebuggerPresent.KERNEL32 ref: 00007FF69768C069
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69768C073
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69768C07E

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d680cdb66cb2873576b8555f3def3de59f08e11caafc9dd8a5efb4c52c37d403
Instruction ID: abe4bdb48c726f8a3db7ce1198da3e582a9a36a69d8eb301989411b88f499f52
Opcode Fuzzy Hash: d680cdb66cb2873576b8555f3def3de59f08e11caafc9dd8a5efb4c52c37d403
Instruction Fuzzy Hash: 2D315F32608B8286EF70CF25E8407AE73A4FB95794F500275EAAD83B95DF38D549DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697693C88, Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF697693C9D

Part of subcall function 00007FF69768E314: HeapFree.KERNEL32(?,?,00000000,00007FF69769055C,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768E32A
Part of subcall function 00007FF69768E314: _errno.LIBCMT ref: 00007FF69768E334
Part of subcall function 00007FF69768E314: GetLastError.KERNEL32(?,?,00000000,00007FF69769055C,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768E33C

free.LIBCMT ref: 00007FF697693CA6
free.LIBCMT ref: 00007FF697693CAF
free.LIBCMT ref: 00007FF697693CB8
free.LIBCMT ref: 00007FF697693CC1
free.LIBCMT ref: 00007FF697693CCA
free.LIBCMT ref: 00007FF697693CD2
free.LIBCMT ref: 00007FF697693CDB
free.LIBCMT ref: 00007FF697693CE4
free.LIBCMT ref: 00007FF697693CED
free.LIBCMT ref: 00007FF697693CF6
free.LIBCMT ref: 00007FF697693CFF
free.LIBCMT ref: 00007FF697693D08
free.LIBCMT ref: 00007FF697693D11
free.LIBCMT ref: 00007FF697693D1A
free.LIBCMT ref: 00007FF697693D23
free.LIBCMT ref: 00007FF697693D2F
free.LIBCMT ref: 00007FF697693D3B
free.LIBCMT ref: 00007FF697693D47
free.LIBCMT ref: 00007FF697693D53
free.LIBCMT ref: 00007FF697693D5F
free.LIBCMT ref: 00007FF697693D6B
free.LIBCMT ref: 00007FF697693D77
free.LIBCMT ref: 00007FF697693D83
free.LIBCMT ref: 00007FF697693D8F
free.LIBCMT ref: 00007FF697693D9B
free.LIBCMT ref: 00007FF697693DA7
free.LIBCMT ref: 00007FF697693DB3
free.LIBCMT ref: 00007FF697693DBF
free.LIBCMT ref: 00007FF697693DCB
free.LIBCMT ref: 00007FF697693DD7
free.LIBCMT ref: 00007FF697693DE3
free.LIBCMT ref: 00007FF697693DEF
free.LIBCMT ref: 00007FF697693DFB
free.LIBCMT ref: 00007FF697693E07
free.LIBCMT ref: 00007FF697693E13
free.LIBCMT ref: 00007FF697693E1F
free.LIBCMT ref: 00007FF697693E2B
free.LIBCMT ref: 00007FF697693E37
free.LIBCMT ref: 00007FF697693E43
free.LIBCMT ref: 00007FF697693E4F
free.LIBCMT ref: 00007FF697693E5B
free.LIBCMT ref: 00007FF697693E67
free.LIBCMT ref: 00007FF697693E73
free.LIBCMT ref: 00007FF697693E7F
free.LIBCMT ref: 00007FF697693E8B
free.LIBCMT ref: 00007FF697693E97
free.LIBCMT ref: 00007FF697693EA3
free.LIBCMT ref: 00007FF697693EAF
free.LIBCMT ref: 00007FF697693EBB
free.LIBCMT ref: 00007FF697693EC7
free.LIBCMT ref: 00007FF697693ED3
free.LIBCMT ref: 00007FF697693EDF
free.LIBCMT ref: 00007FF697693EEB
free.LIBCMT ref: 00007FF697693EF7
free.LIBCMT ref: 00007FF697693F03
free.LIBCMT ref: 00007FF697693F0F
free.LIBCMT ref: 00007FF697693F1B
free.LIBCMT ref: 00007FF697693F27
free.LIBCMT ref: 00007FF697693F33
free.LIBCMT ref: 00007FF697693F3F
free.LIBCMT ref: 00007FF697693F4B
free.LIBCMT ref: 00007FF697693F57
free.LIBCMT ref: 00007FF697693F63
free.LIBCMT ref: 00007FF697693F6F
free.LIBCMT ref: 00007FF697693F7B
free.LIBCMT ref: 00007FF697693F87
free.LIBCMT ref: 00007FF697693F93
free.LIBCMT ref: 00007FF697693F9F
free.LIBCMT ref: 00007FF697693FAB
free.LIBCMT ref: 00007FF697693FB7
free.LIBCMT ref: 00007FF697693FC3
free.LIBCMT ref: 00007FF697693FCF
free.LIBCMT ref: 00007FF697693FDB
free.LIBCMT ref: 00007FF697693FE7
free.LIBCMT ref: 00007FF697693FF3
free.LIBCMT ref: 00007FF697693FFF
free.LIBCMT ref: 00007FF69769400B
free.LIBCMT ref: 00007FF697694017
free.LIBCMT ref: 00007FF697694023
free.LIBCMT ref: 00007FF69769402F
free.LIBCMT ref: 00007FF69769403B
free.LIBCMT ref: 00007FF697694047
free.LIBCMT ref: 00007FF697694053
free.LIBCMT ref: 00007FF69769405F
free.LIBCMT ref: 00007FF69769406B

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 0c66bc2e7fb6885d9f4da974c2dcd87f12f48d00c2e8f31fd38ef849243fe096
Instruction ID: 782e7fda737b95150455a9d317c64bf1fa0fd5112267a763bc12069a22a6f1f7
Opcode Fuzzy Hash: 0c66bc2e7fb6885d9f4da974c2dcd87f12f48d00c2e8f31fd38ef849243fe096
Instruction Fuzzy Hash: 86A16332A19586C2EE61EBB1C8952FC1320EF86F84F044176FAAD8B5A7CE14DC45D362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976932D0, Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF697693315
GetProcAddress.KERNEL32 ref: 00007FF697693331
EncodePointer.KERNEL32 ref: 00007FF697693343
GetProcAddress.KERNEL32 ref: 00007FF69769335A
EncodePointer.KERNEL32 ref: 00007FF697693363
GetProcAddress.KERNEL32 ref: 00007FF69769337A
EncodePointer.KERNEL32 ref: 00007FF697693383
GetProcAddress.KERNEL32 ref: 00007FF69769339A
EncodePointer.KERNEL32 ref: 00007FF6976933A3
GetProcAddress.KERNEL32 ref: 00007FF6976933C2
EncodePointer.KERNEL32 ref: 00007FF6976933CB
DecodePointer.KERNEL32 ref: 00007FF6976933FE
DecodePointer.KERNEL32 ref: 00007FF69769340E
DecodePointer.KERNEL32 ref: 00007FF697693464
DecodePointer.KERNEL32 ref: 00007FF697693485
DecodePointer.KERNEL32 ref: 00007FF69769349F

Strings

GetActiveWindow, xrefs: 00007FF697693349
GetUserObjectInformationW, xrefs: 00007FF697693389
GetProcessWindowStation, xrefs: 00007FF6976933B8
MessageBoxW, xrefs: 00007FF697693327
GetLastActivePopup, xrefs: 00007FF697693369
USER32.DLL, xrefs: 00007FF69769330E

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2643518689-564504941
Opcode ID: 1b60599b47b6f2fcc2b612a8073123bdd8ff8bf8d69625b38e21e9bf14989da9
Instruction ID: 198e99734e8a55b8e363e7a553c1fc59b0d09174236c8cf964cd8cc123c5528e
Opcode Fuzzy Hash: 1b60599b47b6f2fcc2b612a8073123bdd8ff8bf8d69625b38e21e9bf14989da9
Instruction Fuzzy Hash: 24510934A0AB0391FE759B56BC5413823A0EF69FD0F4510B9CC2EC77A1EE3CA849A351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697691F5C, Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 00007FF697691FB4

Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF697694102
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF697694114
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF697694126
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF697694138
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF69769414A
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF69769415C
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF69769416E
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF697694180
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF697694192
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF6976941A4
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF6976941B9
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF6976941CE
Part of subcall function 00007FF6976940E4: free.LIBCMT ref: 00007FF6976941E3

free.LIBCMT ref: 00007FF697691FA8

Part of subcall function 00007FF69768E314: HeapFree.KERNEL32(?,?,00000000,00007FF69769055C,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768E32A
Part of subcall function 00007FF69768E314: _errno.LIBCMT ref: 00007FF69768E334
Part of subcall function 00007FF69768E314: GetLastError.KERNEL32(?,?,00000000,00007FF69769055C,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768E33C

free.LIBCMT ref: 00007FF697691FCA
__free_lconv_num.LIBCMT ref: 00007FF697691FD6
free.LIBCMT ref: 00007FF697691FE2
free.LIBCMT ref: 00007FF697691FEE
free.LIBCMT ref: 00007FF697692012
free.LIBCMT ref: 00007FF697692026
free.LIBCMT ref: 00007FF697692035
free.LIBCMT ref: 00007FF697692041
free.LIBCMT ref: 00007FF69769206E
free.LIBCMT ref: 00007FF697692096
free.LIBCMT ref: 00007FF6976920B0

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: afbe466903b1bad4d705fb13c7027db65052f1568c9cdbd5fab09c6af889c9bd
Instruction ID: 086caef5b3d43e9de20a0e43fec89225d171344ef47e8a64b4a469eb729d6eaf
Opcode Fuzzy Hash: afbe466903b1bad4d705fb13c7027db65052f1568c9cdbd5fab09c6af889c9bd
Instruction Fuzzy Hash: BC411032A0958685EFB9DF61C4503FC23A0EF94FD4F1800B5DA6D8B295DF6CA891E311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976943E8, Relevance: 18.1, APIs: 12, Instructions: 115memoryfileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6976913B4: _errno.LIBCMT ref: 00007FF6976913D6

_errno.LIBCMT ref: 00007FF697694470

Part of subcall function 00007FF6976913B4: SetFilePointer.KERNEL32(00000000,00000001,00000001,00007FF69768D201,?,00000000,00000000,00007FF69768B2C1,?,?,00000000,00007FF69768B3C1,?,?,00000200,00007FF69768BE4E), ref: 00007FF6976913F6
Part of subcall function 00007FF6976913B4: GetLastError.KERNEL32(?,?,00000000,00007FF69768B3C1,?,?,00000200,00007FF69768BE4E), ref: 00007FF697691405

GetProcessHeap.KERNEL32(00000000,?,00000109,00007FF697692C31), ref: 00007FF697694442
HeapAlloc.KERNEL32(?,00000109,00007FF697692C31), ref: 00007FF697694457
_errno.LIBCMT ref: 00007FF697694465
__doserrno.LIBCMT ref: 00007FF6976944CA
_errno.LIBCMT ref: 00007FF6976944D4
GetProcessHeap.KERNEL32(?,00000109,00007FF697692C31), ref: 00007FF6976944ED
HeapFree.KERNEL32(?,00000109,00007FF697692C31), ref: 00007FF6976944FB
SetEndOfFile.KERNEL32(00000000,?,00000109,00007FF697692C31), ref: 00007FF697694526
_errno.LIBCMT ref: 00007FF69769453D
__doserrno.LIBCMT ref: 00007FF697694548
GetLastError.KERNEL32(?,00000109,00007FF697692C31), ref: 00007FF697694550

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$Heap$ErrorFileLastProcess__doserrno$AllocFreePointer
String ID:
API String ID: 3112900366-0
Opcode ID: 8fa5c975ca1302a5621f48dab1f57444fa0cfd130c2beb9aa4edf79659a3bef6
Instruction ID: 8cd28b7fe62e4dc7cfeffcf674d996efbf65bd7749f0f2b23d1114dbfb59328f
Opcode Fuzzy Hash: 8fa5c975ca1302a5621f48dab1f57444fa0cfd130c2beb9aa4edf79659a3bef6
Instruction Fuzzy Hash: F041C432B0865245EE396B2598001BE3691EF55FF4F1447B0EE7D877D6DE3CE406A600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697693744, Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF697693A81), ref: 00007FF6976937DE
malloc.LIBCMT ref: 00007FF697693847
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF697693A81), ref: 00007FF69769387B
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF697693A81), ref: 00007FF6976938A2
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF697693A81), ref: 00007FF6976938EA
malloc.LIBCMT ref: 00007FF697693947

Part of subcall function 00007FF697691184: _FF_MSGBANNER.LIBCMT ref: 00007FF6976911B4
Part of subcall function 00007FF697691184: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF69768AEB0,?,?,00000000,00007FF69768E585,?,?,00000040,00007FF69768E62F,?,?,00000000,00007FF697690491), ref: 00007FF6976911D9
Part of subcall function 00007FF697691184: _callnewh.LIBCMT ref: 00007FF6976911F2
Part of subcall function 00007FF697691184: _errno.LIBCMT ref: 00007FF6976911FD
Part of subcall function 00007FF697691184: _errno.LIBCMT ref: 00007FF697691208

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF697693A81), ref: 00007FF69769397C
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF697693A81), ref: 00007FF6976939BC
free.LIBCMT ref: 00007FF6976939D0
free.LIBCMT ref: 00007FF6976939E1

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocateHeap_callnewh
String ID:
API String ID: 1390791636-0
Opcode ID: 11be6be9f369e93f683f6a8170eaf3fd29ff5d98fc1515839b7da019f3569823
Instruction ID: 1c704b6a57643b5308b83394124edfdf62ecfd1bc95c93c0322e3a8ceeeb826d
Opcode Fuzzy Hash: 11be6be9f369e93f683f6a8170eaf3fd29ff5d98fc1515839b7da019f3569823
Instruction Fuzzy Hash: 88819232B0878286EF348F26944026976A5FB55BE4F54427AEA7DC7BD4EF3CD8009300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697692250, Relevance: 15.1, APIs: 10, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF697692297
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6976922A3
_errno.LIBCMT ref: 00007FF6976922ED
_errno.LIBCMT ref: 00007FF6976922F8
_errno.LIBCMT ref: 00007FF69769232A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697692334
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000001FE,?,00007FF697692423), ref: 00007FF6976923A6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000001FE,?,00007FF697692423), ref: 00007FF6976923C3
_errno.LIBCMT ref: 00007FF6976923E9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6976923F5

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 2295021086-0
Opcode ID: 566035e36478186dd9b37d364e25fd0c6083275eb929e70b6505bb55b334f3a2
Instruction ID: 1231aea19e51abecc575ad909b5fcf439b87a92b26a26f618711b96bad7d84b6
Opcode Fuzzy Hash: 566035e36478186dd9b37d364e25fd0c6083275eb929e70b6505bb55b334f3a2
Instruction Fuzzy Hash: A3516232F097429EFF799B60C4813FC26A0EF61BE4F5441B0DA6D86AD5DF2CA441A701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976908D0, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF69769091E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697690929
DecodePointer.KERNEL32(?,?,?,?,?,00007FF6976935B8,?,?,?,?,00007FF69769087A,?,?,?,?,00007FF69768FD11), ref: 00007FF6976909D8
_lock.LIBCMT ref: 00007FF697690A03

Strings

;,, xrefs: 00007FF697690943, 00007FF69769094A
;,, xrefs: 00007FF6976909C1, 00007FF6976909C8
;,, xrefs: 00007FF697690953, 00007FF69769095A
;,, xrefs: 00007FF697690930, 00007FF697690937

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID: ;,$;,$;,$;,
API String ID: 27599310-848503248
Opcode ID: 8f543041265930e3a5cc53c945aa37d58d1b047566755cc9ac1f792daf5a0a99
Instruction ID: 1c6c354d36e1377325b8335dfdf6b312cf4bd7fb64ed2d226f9e34548805f086
Opcode Fuzzy Hash: 8f543041265930e3a5cc53c945aa37d58d1b047566755cc9ac1f792daf5a0a99
Instruction Fuzzy Hash: A7519F32E0C64386FE758B24A44027E66A1EFA57C4F2491B5DA7EC2A95DF3CFC41E241

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697685FC0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

wprintf.LIBCMT ref: 00007FF697686026
wprintf.LIBCMT ref: 00007FF697686037
fflush.LIBCMT ref: 00007FF697686045
_getwch.LIBCMT ref: 00007FF697686050
_getwch.LIBCMT ref: 00007FF697686078
wprintf.LIBCMT ref: 00007FF69768609B

Strings

Re-, xrefs: 00007FF69768601A
Enter password: , xrefs: 00007FF697686030

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: wprintf$_getwch$fflush
String ID: Enter password: $Re-
API String ID: 639105918-153011214
Opcode ID: 316d47cdd9c8665c01b12bba5576ed5c28c83b10aaa8f5201f46697b4bd26d3b
Instruction ID: 51ffa1021bfc46a36866d2fc6086b654fb8be063d694104b58c5885dfb04d064
Opcode Fuzzy Hash: 316d47cdd9c8665c01b12bba5576ed5c28c83b10aaa8f5201f46697b4bd26d3b
Instruction Fuzzy Hash: EF41B531A1869681EE309719DA113B92691FB467D4F9402B1EEBEC33D7DE3CE442E704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768E524, Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF69768E54B

Part of subcall function 00007FF69768FFC0: _set_error_mode.LIBCMT ref: 00007FF69768FFC9
Part of subcall function 00007FF69768FFC0: _set_error_mode.LIBCMT ref: 00007FF69768FFD8

Part of subcall function 00007FF69768FD60: _set_error_mode.LIBCMT ref: 00007FF69768FDA5
Part of subcall function 00007FF69768FD60: _set_error_mode.LIBCMT ref: 00007FF69768FDB6
Part of subcall function 00007FF69768FD60: GetModuleFileNameW.KERNEL32 ref: 00007FF69768FE18

Part of subcall function 00007FF69768A668: ExitProcess.KERNEL32 ref: 00007FF69768A677

Part of subcall function 00007FF69768AE80: malloc.LIBCMT ref: 00007FF69768AEAB
Part of subcall function 00007FF69768AE80: Sleep.KERNEL32(?,?,00000000,00007FF69768E585,?,?,00000040,00007FF69768E62F,?,?,00000000,00007FF697690491,?,?,00000000,00007FF697690548), ref: 00007FF69768AEBE

_errno.LIBCMT ref: 00007FF69768E58D
_lock.LIBCMT ref: 00007FF69768E5A1
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000040,00007FF69768E62F,?,?,00000000,00007FF697690491,?,?,00000000,00007FF697690548,?,?,00000060,00007FF69768C1D5), ref: 00007FF69768E5B7
free.LIBCMT ref: 00007FF69768E5C4
_errno.LIBCMT ref: 00007FF69768E5C9
LeaveCriticalSection.KERNEL32(?,?,00000040,00007FF69768E62F,?,?,00000000,00007FF697690491,?,?,00000000,00007FF697690548,?,?,00000060,00007FF69768C1D5), ref: 00007FF69768E5EC

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 2d1ef2fde54ebfedcf42dc4894739ded5dea42c6a09302ca36246490a2853921
Instruction ID: c1078e790b6317256490f31f88c5c3dbf910ba6bb09f2afcf7900c671fc0c81d
Opcode Fuzzy Hash: 2d1ef2fde54ebfedcf42dc4894739ded5dea42c6a09302ca36246490a2853921
Instruction Fuzzy Hash: 88214C35E0964282FE70AB10E4153F96264EF42BC0F4451B5E6AED66D2DF3CE840A712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69769144C, Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF69769146F
_errno.LIBCMT ref: 00007FF697691477

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: a12748f3224555f0109c8e8443556a5b406f29b52e68776097e169668b520645
Instruction ID: 4801c817eb5d6c4ea9b63a1ac9e78a7022cd5586571ba781b7beb08e2cdde1ed
Opcode Fuzzy Hash: a12748f3224555f0109c8e8443556a5b406f29b52e68776097e169668b520645
Instruction Fuzzy Hash: B721C172A1854241EE2A6B1598912BD2560DF56BF1F1903F4EA3DC63C2CF3CA441A710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768E650, Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF69768E669
FlushFileBuffers.KERNEL32(?,00002200,?,00007FF697689506,?,?,?,00007FF69768962C), ref: 00007FF69768E6CC
GetLastError.KERNEL32(?,?,?,00007FF69768962C), ref: 00007FF69768E6D6
__doserrno.LIBCMT ref: 00007FF69768E6E6
_errno.LIBCMT ref: 00007FF69768E6ED

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno
String ID:
API String ID: 1845094721-0
Opcode ID: f42d8c3413bafc89c2e94a35f9fce746286aaf44ae2381123df08c8b06903874
Instruction ID: 10b7c9b07aea1b480e59417be6949b597506f2e66f5ecd8953773c32baa40786
Opcode Fuzzy Hash: f42d8c3413bafc89c2e94a35f9fce746286aaf44ae2381123df08c8b06903874
Instruction Fuzzy Hash: 06219231E0864345EE325FA598A42FD2661DF42BD0F1901B4E67D862D2CF6CA881E714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697691C24, Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF697691C43

Part of subcall function 00007FF697690574: _amsg_exit.LIBCMT ref: 00007FF69769058A

Part of subcall function 00007FF697691860: _getptd.LIBCMT ref: 00007FF69769186A
Part of subcall function 00007FF697691860: _amsg_exit.LIBCMT ref: 00007FF697691907

Part of subcall function 00007FF69769191C: GetOEMCP.KERNEL32 ref: 00007FF697691946

Part of subcall function 00007FF69768AE80: malloc.LIBCMT ref: 00007FF69768AEAB
Part of subcall function 00007FF69768AE80: Sleep.KERNEL32(?,?,00000000,00007FF69768E585,?,?,00000040,00007FF69768E62F,?,?,00000000,00007FF697690491,?,?,00000000,00007FF697690548), ref: 00007FF69768AEBE

free.LIBCMT ref: 00007FF697691CCE

Part of subcall function 00007FF69768E314: HeapFree.KERNEL32(?,?,00000000,00007FF69769055C,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768E32A
Part of subcall function 00007FF69768E314: _errno.LIBCMT ref: 00007FF69768E334
Part of subcall function 00007FF69768E314: GetLastError.KERNEL32(?,?,00000000,00007FF69769055C,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768E33C

_lock.LIBCMT ref: 00007FF697691CFE
free.LIBCMT ref: 00007FF697691DA1
free.LIBCMT ref: 00007FF697691DCD
_errno.LIBCMT ref: 00007FF697691DD2

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: 9fac4b628bf90c6cc894e34464ee3d8af706cad85a3ec321a2f95b6b747c8ec0
Instruction ID: 4ff3dd0ac7fd2b9800ffb38b6ccf74a81cb3d066946f56b3a55a9b0da385be64
Opcode Fuzzy Hash: 9fac4b628bf90c6cc894e34464ee3d8af706cad85a3ec321a2f95b6b747c8ec0
Instruction Fuzzy Hash: 5251C276A0864286EF789B21D4402B976A1FFA1BD4F2441B6DA7EC7396CF3CE405E700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976904F0, Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF6976904FA
FlsGetValue.KERNEL32(?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF697690508
SetLastError.KERNEL32(?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF697690560

Part of subcall function 00007FF69768AF00: Sleep.KERNEL32(?,?,00000000,00007FF697690523,?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF69768AF45

FlsSetValue.KERNEL32(?,?,00000060,00007FF69768C1D5,?,?,?,?,00007FF697689BE6), ref: 00007FF697690534
free.LIBCMT ref: 00007FF697690557

Part of subcall function 00007FF697690438: _lock.LIBCMT ref: 00007FF69769048C
Part of subcall function 00007FF697690438: _lock.LIBCMT ref: 00007FF6976904AB

GetCurrentThreadId.KERNEL32 ref: 00007FF697690548

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 3bcabad23f4079c9271230c6d7d8097488f8e0719cd1c741459f8bc2f7f33a94
Instruction ID: 7c467022fefd99e20408403d23b7913384da8d1121291e9d71a999a396652b31
Opcode Fuzzy Hash: 3bcabad23f4079c9271230c6d7d8097488f8e0719cd1c741459f8bc2f7f33a94
Instruction Fuzzy Hash: 08017135A08743D3FF659B69A4550382291EF58BE0B4882B4D93EC23D5EE3CE444E210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697685E30, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

fwprintf.LIBCMT ref: 00007FF697685F37
fwprintf.LIBCMT ref: 00007FF697685F6F

Strings

%s: illegal option -- %c, xrefs: 00007FF697685F61
%s: option requires an argument -- %c, xrefs: 00007FF697685F29
vhdep:o:, xrefs: 00007FF697685ECD

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: fwprintf
String ID: %s: illegal option -- %c$%s: option requires an argument -- %c$vhdep:o:
API String ID: 968622242-129695684
Opcode ID: d38e01b72fa250cba9d00fe88fd717ba0fd9e1bc252ca4bb4f909f3b139bc0e1
Instruction ID: c128bfaa71890d048457e7ab40f05b212bce63cc22de3d0c76d82f1bdfdd3035
Opcode Fuzzy Hash: d38e01b72fa250cba9d00fe88fd717ba0fd9e1bc252ca4bb4f909f3b139bc0e1
Instruction Fuzzy Hash: 82414D71E18A0285EF349F15E4802B823B2EFA5BC4F4581B6DA2DC72A5DF7CE841A740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697685740, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 35COMMON

Download Yara Rule

APIs

fwprintf.LIBCMT ref: 00007FF6976857B4

Strings

April 16, 2015, xrefs: 00007FF697685793
3.10, xrefs: 00007FF69768579F
%s version %s (%s), xrefs: 00007FF6976857A6
aescrypt, xrefs: 00007FF697685783

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: fwprintf
String ID: %s version %s (%s)$3.10$April 16, 2015$aescrypt
API String ID: 968622242-1689261965
Opcode ID: 6bea94347dba1452cf1a0993a8da4e45dc40ae7915ad74c7f292145320ccaee8
Instruction ID: 0b5d917e0fb00c435af21ed5292a95f0fef8f751a15fa0fb46219013d5b663e2
Opcode Fuzzy Hash: 6bea94347dba1452cf1a0993a8da4e45dc40ae7915ad74c7f292145320ccaee8
Instruction Fuzzy Hash: 9F013175E1930BD1EF306B50E4551F563B0EF627C0F8884B2C63E866D1EEBCA685A241

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768C80C, Relevance: 7.6, APIs: 5, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF69768E524: _FF_MSGBANNER.LIBCMT ref: 00007FF69768E54B

_lock.LIBCMT ref: 00007FF69768C846
_lock.LIBCMT ref: 00007FF69768C89F
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,?,?,?,00000109,00007FF697692A10), ref: 00007FF69768C8B4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000109,00007FF697692A10), ref: 00007FF69768C8DF
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000109,00007FF697692A10), ref: 00007FF69768C8EF

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: CriticalSection$_lock$CountEnterInitializeLeaveSpin
String ID:
API String ID: 3451527041-0
Opcode ID: 8e708ab45b179a98bcd60c1698d711b8e8d2c9dd02b78884525adedc86402b9f
Instruction ID: 3d30fff2b05a64b8003c4ca0ef866f9a1e2ade9398fb1aa0ef0a095d9da352f6
Opcode Fuzzy Hash: 8e708ab45b179a98bcd60c1698d711b8e8d2c9dd02b78884525adedc86402b9f
Instruction Fuzzy Hash: 5A51D172A0864286EF208B24D4403B966A0FB95BE8F4452F5DABE863D5EF7CE855D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697693AA8, Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,00007FF697693C63), ref: 00007FF697693B02
malloc.LIBCMT ref: 00007FF697693B66
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,00007FF697693C63), ref: 00007FF697693BAE
GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,00007FF697693C63), ref: 00007FF697693BC5
free.LIBCMT ref: 00007FF697693BD9

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: 1ae47fa2b74ae960bf7b266387c26869b3ec2c29c50c0ff91ef57fd4c3cfd6f4
Instruction ID: 896f4124f068bd36ad4ba52d8e6a49c2e2e1adcd1f39bb81ff2310decbf500a4
Opcode Fuzzy Hash: 1ae47fa2b74ae960bf7b266387c26869b3ec2c29c50c0ff91ef57fd4c3cfd6f4
Instruction Fuzzy Hash: 52413D32A0468296EF219F2698005A97395FF65BE8F58427AEE3D877D9DE38E4019300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697689BB4, Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF697689BE1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697689BEC
_errno.LIBCMT ref: 00007FF697689C8D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697689C98
_ftbuf.LIBCMT ref: 00007FF697689CC8

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$_ftbuf
String ID:
API String ID: 2784728999-0
Opcode ID: ad868f1876aaf54274916ed795feb26fbbd98b085143bf8b65d46564722a6239
Instruction ID: 95684c6e7cd2ffa75f65564468e858dbc0d37a0a134842d5e682e576a75755f3
Opcode Fuzzy Hash: ad868f1876aaf54274916ed795feb26fbbd98b085143bf8b65d46564722a6239
Instruction Fuzzy Hash: 6D31F272A0870202EE79972598912FD2291EF57BE0F6456B1EE3DC62D1CF2CE841E600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697690B94, Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,00007FF697690CA9,?,?,?,?,00007FF69768A7A2,?,?,?,00007FF69768A5B0), ref: 00007FF697690BBD
DecodePointer.KERNEL32(?,?,?,00007FF697690CA9,?,?,?,?,00007FF69768A7A2,?,?,?,00007FF69768A5B0), ref: 00007FF697690BCD

Part of subcall function 00007FF6976935E0: _errno.LIBCMT ref: 00007FF6976935E9
Part of subcall function 00007FF6976935E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6976935F4

EncodePointer.KERNEL32(?,?,?,00007FF697690CA9,?,?,?,?,00007FF69768A7A2,?,?,?,00007FF69768A5B0), ref: 00007FF697690C4B

Part of subcall function 00007FF69768AF84: realloc.LIBCMT ref: 00007FF69768AFAF
Part of subcall function 00007FF69768AF84: Sleep.KERNEL32(?,?,00000000,00007FF697690C3B,?,?,?,00007FF697690CA9,?,?,?,?,00007FF69768A7A2), ref: 00007FF69768AFCB

EncodePointer.KERNEL32(?,?,?,00007FF697690CA9,?,?,?,?,00007FF69768A7A2,?,?,?,00007FF69768A5B0), ref: 00007FF697690C5B
EncodePointer.KERNEL32(?,?,?,00007FF697690CA9,?,?,?,?,00007FF69768A7A2,?,?,?,00007FF69768A5B0), ref: 00007FF697690C68

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 82bf35ad9383b557b09efbdd719a92cf33183cf339ba5caf8f12645cf8dc4d7d
Instruction ID: 36fa5600d2227d6e028ed040f8d95b676bd9ac7696a4d407c77cc4c2bcf3c92d
Opcode Fuzzy Hash: 82bf35ad9383b557b09efbdd719a92cf33183cf339ba5caf8f12645cf8dc4d7d
Instruction Fuzzy Hash: 69218E31B0AB4381EE609B22F94817963A1FF59BC1F4448B5DE2E97795EE3CE485A700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768A060, Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF69768A0A4
_errno.LIBCMT ref: 00007FF69768A0B9
_errno.LIBCMT ref: 00007FF69768A11A
_errno.LIBCMT ref: 00007FF69768A133
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69768A13E

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 2d2ea91e8a03f3fcd4de8369c3cb072467851a1b2b4d040e1b562c3bcf192a49
Instruction ID: 7d29c341ab824d25bae972afd30993931367eff145ead022b38677269704ea25
Opcode Fuzzy Hash: 2d2ea91e8a03f3fcd4de8369c3cb072467851a1b2b4d040e1b562c3bcf192a49
Instruction Fuzzy Hash: D121E531E0864241EE365B2899922FD6561EF823D4F5881B5EABC876D6CE7CA881E301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976907A8, Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6976907DF
GetCurrentProcessId.KERNEL32 ref: 00007FF6976907EA
GetCurrentThreadId.KERNEL32 ref: 00007FF6976907F6
GetTickCount.KERNEL32 ref: 00007FF697690802
QueryPerformanceCounter.KERNEL32 ref: 00007FF697690813

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 224e98c6ffcdb278ad89ace20e785edfc2ce05eeeb390f0b5b9b36c5165881d7
Instruction ID: e2f100cba7081b8cf128a5b66daf665abac640155210a308a69513f5e4c5a225
Opcode Fuzzy Hash: 224e98c6ffcdb278ad89ace20e785edfc2ce05eeeb390f0b5b9b36c5165881d7
Instruction Fuzzy Hash: 32016135629A02C1EF618F21E8402656360FB59BD0F442671EE6EC77A4CF3CD984E700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768C6C8, Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF69768C6D1
_errno.LIBCMT ref: 00007FF69768C6D9

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: d087394f14bd1936270b2dc7d139320fe832fb5d9573574ad5fcf41e10290610
Instruction ID: 87416ecb38a054d7030e698e64b8608529383326c766a471e8ab7054cb3f946c
Opcode Fuzzy Hash: d087394f14bd1936270b2dc7d139320fe832fb5d9573574ad5fcf41e10290610
Instruction Fuzzy Hash: B4016DB2E08A0641FE261B28C8E13F82570DF52BF1F9143F5D63D863D2CF2C6441A610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6976930C0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6976930F6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697693101

Strings

A, xrefs: 00007FF697693134
Z, xrefs: 00007FF69769313A

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: A$Z
API String ID: 2959964966-4098844585
Opcode ID: d20ba54dd1814ab2af6b89c24a35e29c972fa68435731ba382d4b3cf6284b3af
Instruction ID: 00429b19c8da1161bb187600122830e4eb65c675a8f3b84db81b6358f99d2f94
Opcode Fuzzy Hash: d20ba54dd1814ab2af6b89c24a35e29c972fa68435731ba382d4b3cf6284b3af
Instruction Fuzzy Hash: 44319172E18282C1FF71571295401B9B2A1FB60BD1F9841BAEAED877E5DF2CE941E304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697690DB4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69768B2E8: _getptd.LIBCMT ref: 00007FF69768B2FA

_errno.LIBCMT ref: 00007FF697690DE1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697690DEC

Part of subcall function 00007FF697693628: iswctype.LIBCMT ref: 00007FF697693695

Strings

Z, xrefs: 00007FF697690E2A
A, xrefs: 00007FF697690E24

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 0803aee2681a22c70580b2b450e4753fc818621dec8902612a5e4baa8115117e
Instruction ID: 582e4c6ffcd47ba2617779868c45f2ac834d2bff40d72a24b053fe8e2b75b8ec
Opcode Fuzzy Hash: 0803aee2681a22c70580b2b450e4753fc818621dec8902612a5e4baa8115117e
Instruction Fuzzy Hash: 9921BF72E1C69782EF705B1591401BD76A0EB60BE0F9841B6EAED877D5CE2CE881E704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768A62C, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,00007FF69768A675,?,?,00000028,00007FF6976911CD,?,?,00000000,00007FF69768AEB0,?,?,00000000,00007FF69768E585), ref: 00007FF69768A63B
GetProcAddress.KERNEL32(?,?,000000FF,00007FF69768A675,?,?,00000028,00007FF6976911CD,?,?,00000000,00007FF69768AEB0,?,?,00000000,00007FF69768E585), ref: 00007FF69768A650

Strings

mscoree.dll, xrefs: 00007FF69768A634
CorExitProcess, xrefs: 00007FF69768A646

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: d768da7d125e80c1b9ef37ad8dcc2285ebecfe23f030a1b8b23080145edad4f3
Instruction ID: abd6e1f8a1338f2f2aeb8a546387d9d11758b7b9d65d926b40f2e971b6762963
Opcode Fuzzy Hash: d768da7d125e80c1b9ef37ad8dcc2285ebecfe23f030a1b8b23080145edad4f3
Instruction Fuzzy Hash: D8E01230F1A70242FE795B60A8951741391DF69B80B4811B9C83E863D3FEACA5D9E340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697694258, Relevance: 6.1, APIs: 4, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF697689D1C: _errno.LIBCMT ref: 00007FF697689D25
Part of subcall function 00007FF697689D1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697689D30

_errno.LIBCMT ref: 00007FF697694283
_errno.LIBCMT ref: 00007FF6976942A1
_isatty.LIBCMT ref: 00007FF697694302
_getbuf.LIBCMT ref: 00007FF69769430E

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _errno$_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 3655708593-0
Opcode ID: 9d028643f62ca4cb0bd7679b00d7929341a53bdd9b36be22845da04e5a3a773c
Instruction ID: fc8e31335cd16457a410a308730ecb07d1ef72fec424de4d32d14c699082b937
Opcode Fuzzy Hash: 9d028643f62ca4cb0bd7679b00d7929341a53bdd9b36be22845da04e5a3a773c
Instruction Fuzzy Hash: 8B416E73A0860285EF389B3AD4412BE3AA0EF65BD4F144275DA7D873D9DE38E851E640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768EA08, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF69768EA1C

Part of subcall function 00007FF69768E60C: _amsg_exit.LIBCMT ref: 00007FF69768E636

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF69768EAD4
free.LIBCMT ref: 00007FF69768EAE9
EnterCriticalSection.KERNEL32 ref: 00007FF69768EB0B

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterInitializeSpin_amsg_exit_lockfree
String ID:
API String ID: 3786353176-0
Opcode ID: ebdfc22b25f2f5a8880d524cd0444043a57087bddbfa82e0597896c189cfdc12
Instruction ID: 72473bf4e2f686479a66b0c9f887471b0d23d7efc0e0744d99c33d82c9285de3
Opcode Fuzzy Hash: ebdfc22b25f2f5a8880d524cd0444043a57087bddbfa82e0597896c189cfdc12
Instruction Fuzzy Hash: 4D418032A18A4682EF208B25D5843B87361FF66FC4F144675CAAE873E5DF2CE801E344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697691860, Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF69769186A

Part of subcall function 00007FF697690574: _amsg_exit.LIBCMT ref: 00007FF69769058A

_lock.LIBCMT ref: 00007FF697691898
free.LIBCMT ref: 00007FF6976918CE
_amsg_exit.LIBCMT ref: 00007FF697691907

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: c508ad0cd615e05640d9338cf0dca328dd1022c8bf87a7fa6993910036ca0970
Instruction ID: afe7d44e773f75523177cfd00c818963eeb795914741c2c193f58a27c30ce16f
Opcode Fuzzy Hash: c508ad0cd615e05640d9338cf0dca328dd1022c8bf87a7fa6993910036ca0970
Instruction Fuzzy Hash: 0D114C76A0D64282EEA89B51E5413B973A1FBA4BC0F1800B6EE6D83395DF2CE450F741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69768E354, Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF69768E368

Part of subcall function 00007FF69768E60C: _amsg_exit.LIBCMT ref: 00007FF69768E636

fclose.LIBCMT ref: 00007FF69768E398
DeleteCriticalSection.KERNEL32(?,?,?,?,?,00007FF6976892EF), ref: 00007FF69768E3BC
free.LIBCMT ref: 00007FF69768E3CD

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: CriticalDeleteSection_amsg_exit_lockfclosefree
String ID:
API String ID: 594724896-0
Opcode ID: 45cb9dd5733144bb85f733cb220613c2383cf725c8d0bf54250945974cfdd33f
Instruction ID: 8a23b247b02148166783642e3fc9d934756d309dd4fee4c94141dbe18d37d863
Opcode Fuzzy Hash: 45cb9dd5733144bb85f733cb220613c2383cf725c8d0bf54250945974cfdd33f
Instruction Fuzzy Hash: A5115135908A4282EE209B19E4843BC7760FB92FC4F144275DAAED32B5CF3DEC41D604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697692130, Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF697692136

Part of subcall function 00007FF697690574: _amsg_exit.LIBCMT ref: 00007FF69769058A

_getptd.LIBCMT ref: 00007FF697692156
_lock.LIBCMT ref: 00007FF697692169
_amsg_exit.LIBCMT ref: 00007FF697692197

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: 80f0dad736781ac731d672acec243250c0765e746191206ca567636be8096a81
Instruction ID: 3dce5b591332cce096f5b1d74653232d1afc2e2d91d0fc46224e3b1499d62f6c
Opcode Fuzzy Hash: 80f0dad736781ac731d672acec243250c0765e746191206ca567636be8096a81
Instruction Fuzzy Hash: 2DF0F931F09142D5FE79AB5188417F82261EFA5BC4F0842B4DB6C873D2DE2CA864F711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697688C08, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF697688DF7
_wcwild.LIBCMT ref: 00007FF697688EAC

Strings

C:\Users\user\AppData\Local\Temp\aes_x64.exe, xrefs: 00007FF697688DDC

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: FileModuleName_wcwild
String ID: C:\Users\user\AppData\Local\Temp\aes_x64.exe
API String ID: 3323776934-4021023222
Opcode ID: 6bd8d6e7bad2f501a54204c0fbdf73bde0db0993f076b6fa9848faa7d6e3352f
Instruction ID: d49e61af148c5e6e97296dfbebbc9b89089c340be7f6618e945a53aa62aae544
Opcode Fuzzy Hash: 6bd8d6e7bad2f501a54204c0fbdf73bde0db0993f076b6fa9848faa7d6e3352f
Instruction Fuzzy Hash: 7C21A132A2974781EE308B65A4440AAA390FF997F0F440776EA7D87BD4EE7CE0449B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF697694618, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

wcsnlen.LIBCMT ref: 00007FF69769463C
LCMapStringW.KERNEL32(?,?,?,?,UTF-8,00007FF6976936D5,?,?,?,?,?,?,?,?,?,00007FF697693179), ref: 00007FF69769465F

Strings

UTF-8, xrefs: 00007FF697694622

Memory Dump Source

Source File: 00000024.00000002.388086380.00007FF697681000.00000020.00020000.sdmp, Offset: 00007FF697680000, based on PE: true

Associated: 00000024.00000002.388065280.00007FF697680000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388115021.00007FF697695000.00000002.00020000.sdmp Download File
Associated: 00000024.00000002.388135116.00007FF69769A000.00000004.00020000.sdmp Download File
Associated: 00000024.00000002.388162054.00007FF6976A2000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff697680000_aes_x64.jbxd

Yara matches

Similarity

API ID: Stringwcsnlen
String ID: UTF-8
API String ID: 1747122221-243350608
Opcode ID: a339f4ad7e84e27e57b0a66e3852421559cfd4e7fd8628abe59421ee9f693860
Instruction ID: 307585d15ca0b15b63c8e4323d954e90cb3c5c87de32168cf0915027b731a8ca
Opcode Fuzzy Hash: a339f4ad7e84e27e57b0a66e3852421559cfd4e7fd8628abe59421ee9f693860
Instruction Fuzzy Hash: 85F08276B08B8182DB208B06B44046BEBA5FBA9BD4F588134EF9C97F19CF3CD4518B40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	File monitoring, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Mes_Drivers_3.0.4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Exploits:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre